Hard — MS-102 Practice Quiz

Question 1

Contoso currently enforces multifactor authentication for all users by enabling per-user MFA (the legacy per-user setting on each account). The security team wants to move to a modern, policy-based approach that allows conditions such as trusted locations and specific applications to influence when MFA is required, while retaining reporting on authentication methods. What should the administrator do to transition users off per-user MFA correctly?

Accepted Answer

Create a Conditional Access policy requiring MFA, then set each user's per-user MFA state to Disabled after confirming the policy applies

Answer

Leave per-user MFA set to Enforced and also create the Conditional Access policy so both mechanisms run together

Answer

Turn off Security Defaults and rely solely on per-user MFA with trusted IP exclusions

Answer

Convert all per-user MFA states to Enabled and configure app passwords for legacy clients

Question 2

Contoso uses Microsoft Defender for Office 365 Plan 2. The security team has enabled the built-in Standard preset security policy for all users. Separately, an administrator created a custom Anti-phishing policy scoped to the finance department with a higher spoof-intelligence threshold. A finance user reports that a phishing email that should have matched the custom finance policy was instead evaluated by different settings. What is the most likely reason the custom policy did not apply?

Accepted Answer

Preset security policies are always evaluated before custom policies, so the Standard preset takes precedence over the custom anti-phishing policy for the finance user.

Answer

Custom policies always override preset security policies, so the issue must be an incorrect recipient scope in the custom policy.

Answer

Anti-phishing policies cannot be applied to a subset of users, so the custom policy is ignored entirely.

Answer

Defender for Office 365 Plan 2 does not support custom anti-phishing policies when a preset is enabled.

Question 3

Your organization has deployed Endpoint DLP to onboarded Windows 10 devices. A DLP policy blocks copying files that contain credit card numbers to USB removable storage. Users report that files are sometimes copied to USB drives before the policy classifies them, because classification occurs after the file has already left the device. You need to ensure that files are evaluated and blocked at the moment of the egress activity, even for content that has not yet been classified. What should you configure?

Accepted Answer

Enable Just-in-time protection in the Endpoint DLP settings

Answer

Increase the sensitive information type confidence level to High

Answer

Add the USB device to the list of unallowed Bluetooth apps

Answer

Change the policy mode from Test to Enforce with policy tips

Question 4

Your organization assigns Microsoft 365 E5 licenses through a dynamic security group named 'All-Staff'. A user, Priya, is a member of both 'All-Staff' and a second group 'Contractors' that assigns Microsoft 365 E3. Priya reports that some of her E5 service plans are showing as errors in the Microsoft 365 admin center under her license assignment. What is the most likely cause and the recommended way to resolve it?

Accepted Answer

Two group-based license assignments contain conflicting or duplicate service plans; resolve it by disabling the overlapping service plans on one of the groups or removing Priya from one group.

Answer

There are not enough available E5 licenses in the tenant; purchase additional E5 licenses to clear the error.

Answer

Priya has a directly assigned license that overrides the group license; remove the group-based assignment to fix the conflict.

Answer

The dynamic group membership rule is misconfigured; convert 'All-Staff' to an assigned (static) group to resolve the service plan error.

Question 5

Contoso has a retention policy applied to all SharePoint sites that retains content for 5 years, then deletes it. The compliance team also publishes a retention label that retains matching contracts for 10 years, then deletes them, and configures it to auto-apply to any document containing specific contract keywords. A contract document stored in SharePoint matches both. How long will the contract be retained before deletion?

Accepted Answer

10 years, because retention wins over deletion and the longest retention period is applied

Answer

5 years, because the site-level retention policy always takes precedence over labels

Answer

5 years, because the shorter retention period always wins to minimize storage

Answer

The content is deleted immediately because the two settings conflict and cancel each other out