MS-102 Practice Test

Answer choices

1. A. Create one shared mailbox and add all employees as delegates since delegates automatically become individually licensed Microsoft 365 users.
2. B. Use Entra bulk operations for file-based batches or Microsoft Graph for repeatable programmatic user lifecycle management, while preserving the intended access model.
3. C. Create a Microsoft 365 service-health incident because Microsoft support automatically provisions the users listed in an incident attachment.
4. D. Use Microsoft Defender XDR advanced hunting because KQL query results can be committed directly as new Microsoft Entra user objects.

Wrong-answer review

• A. Create one shared mailbox and add all employees as delegates since delegates automatically become individually licensed Microsoft 365 users.: Incorrect. Delegating a shared mailbox does not create or license individual employee identities.
• C. Create a Microsoft 365 service-health incident because Microsoft support automatically provisions the users listed in an incident attachment.: Incorrect. Service health is for operational cloud-service status and does not provision customer identities.
• D. Use Microsoft Defender XDR advanced hunting because KQL query results can be committed directly as new Microsoft Entra user objects.: Incorrect. Advanced hunting queries security telemetry and is not an identity-provisioning write API.

Answer choices

1. A. Create a Defender for Cloud Apps activity policy because activity thresholds calculate WAN latency and recommend the nearest Microsoft edge location.
2. B. Review Microsoft 365 Network Insights for the affected location and follow its detected issues and recommendations, and verify the resulting tenant state.
3. C. Change the organization profile country so Microsoft 365 automatically moves this tenant's data plane to the branch office region.
4. D. Reassign Microsoft 365 licenses for the branch because license assignment determines the network path used to reach Microsoft cloud services.

Answer choices

1. A. Assign ownership of the Microsoft 365 tenant domain because domain ownership automatically grants all Defender and Purview investigation permissions.
2. B. Assign the appropriate Microsoft Purview role group with only the permissions and scope required for the compliance task.
3. C. Use group-based licensing as the authorization model because assigning a Defender or Purview license also grants the user all administrative permissions for that product.
4. D. Assign Global Administrator because Defender and Purview administrative tasks cannot be delegated through product-specific roles or role groups.

Answer choices

1. A. Create a sensitivity label named after each identifier since label names are automatically scanned as regular expressions inside documents.
2. B. Create a retention label with a five-year period because retention settings also define custom content-matching patterns for DLP and labeling.
3. C. Create a custom sensitive information type with the needed pattern, supporting evidence, proximity, and confidence.
4. D. Create a Defender for Cloud Apps activity policy because cloud-activity thresholds are the Purview classifier for structured identifiers.

Answer choices

1. A. Assign Standard or Strict preset security protection to the intended recipients and verify its effective scope.
2. B. Enable every Defender XDR alert policy because alert policies automatically apply Strict email protection to their notification recipients.
3. C. Configure Conditional Access authentication strength because stronger sign-in controls replace Defender for Office 365 threat policies for email content.
4. D. Create a Microsoft 365 retention policy because retention presets also configure anti-phishing, Safe Links, and Safe Attachments settings.

Answer choices

1. A. Use a retention label that requires justification because label downgrade justification is equivalent to an MFA or authentication-strength grant control.
2. B. Use Conditional Access grant controls to require MFA or the required authentication strength for the targeted access, while preserving emergency access.
3. C. Use Microsoft Entra Password Protection because banned-password rules are the policy surface for requiring phishing-resistant MFA during application sign-in.
4. D. Use a Defender for Office 365 Strict preset policy because Strict email protection satisfies MFA requirements for every Microsoft 365 application.

Answer choices

1. A. Use Microsoft 365 Service health because every DLP policy violation is posted as a tenant service incident with the matched content.
2. B. Use Microsoft Secure Score since DLP alerts are security recommendations and their underlying events are stored only in score history.
3. C. Use Entra sign-in logs because sign-in events contain the full DLP rule match, sensitive content, and policy action for each file operation.
4. D. Use the Purview DLP Alerts dashboard to inspect the alert, associated events, metadata, policy details, and permitted content context.

Answer choices

1. A. Configure a Cloud Apps activity policy with the needed filters, activity threshold, alert settings, and governance action, after reviewing the relevant activity context.
2. B. Create a DLP retention label since retention labels count repeated cloud activities and generate Defender for Cloud Apps alerts when thresholds are exceeded.
3. C. Create a Microsoft 365 usage report because usage reports can enforce governance actions when a user crosses an activity threshold.
4. D. Create an Entra dynamic group rule because dynamic group membership is the supported engine for detecting repeated downloads in connected cloud applications.

Answer choices

1. A. Use Defender for Cloud Apps Cloud Discovery since discovery logs are the authoritative source for all Microsoft Entra authentication failures.
2. B. Use Entra sign-in logs to inspect the affected event, authentication details, failure, resource, client, and Conditional Access result.
3. C. Use Purview Activity explorer because data-classification activities include the complete authentication trace for each Microsoft Entra sign-in.
4. D. Use Microsoft 365 usage reports because usage reports contain the full authentication failure code and Conditional Access decision for every sign-in.

Answer choices

1. A. Assign a Microsoft 365 Apps license directly to the label because licensing automatically publishes every unpublished sensitivity label.
2. B. Create a retention policy that references the sensitivity label because retention policies are the only mechanism that makes labels visible in Office.
3. C. Add the label name to a custom sensitive information type because matching the label name causes Office clients to download the label.
4. D. Publish the required sensitivity labels to the intended audience through a sensitivity label policy, before publishing or enforcing it more broadly.