MS-102 Practice Test

Sample MS-102 Practice Questions

10 real questions from the free MS-102bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A Microsoft 365 administrator needs to protect users from malicious URLs that may be embedded in emails, Teams chats, and Office documents. Specifically, they require time-of-click URL reputation evaluation so that links are re-checked at the moment the user clicks them, and that users are blocked or warned when a destination is found to be malicious. Which Microsoft Defender for Office 365 capability should they configure?

   • A. Safe Attachments - scans email attachments for malware in a detonation sandbox before delivery; this protects against malicious files, not against URL clicks.
   • B. Anti-phishing policy with user and domain impersonation protection - detects spoofed senders such as a CEO impersonator, but does not perform per-click URL reputation evaluation.
   • C. Zero-hour Auto Purge (ZAP) - retroactively removes already-delivered malicious messages from mailboxes after delivery, but does not block URLs at click time.
   • D. Safe Links - performs time-of-click URL verification across Exchange Online, Teams, and Office desktop apps, blocking the user when a clicked URL is judged malicious.
   Show answer

   Correct answer: D

   Safe Links (D) is the Microsoft Defender for Office 365 feature that performs time-of-click URL verification: when a user clicks a link in email, Teams, or an Office document, Safe Links re-checks the destination against Microsoft's reputation services and blocks or warns the user if it is malicious. Safe Attachments (A) detonates attached files in a sandbox before delivery - different threat vector. Anti-phishing impersonation protection (B) addresses spoofed senders, not URL reputation. Zero-hour Auto Purge (C) retroactively removes already-delivered messages but does not act on URL clicks.

2. 2. A Microsoft 365 administrator must provision 200 new corporate Windows 11 laptops so that, when an employee first powers one on, it automatically joins Microsoft Entra ID, enrolls in Intune, and applies corporate policies without IT re-imaging the device. Which Microsoft technology delivers this zero-touch provisioning?

   • A. Microsoft Configuration Manager task-sequence imaging, which wipes and reloads a corporate Windows image over the network before delivery.
   • B. Microsoft Entra Connect Sync, which provisions the device objects into Intune as the laptops synchronize from on-premises Active Directory.
   • C. Windows Autopilot, a cloud-based deployment service that pre-registers the devices and configures them through Intune during the out-of-box experience.
   • D. Microsoft Defender for Endpoint onboarding, which images and enrolls the devices automatically as part of the EDR onboarding process.
   Show answer

   Correct answer: C

   Windows Autopilot is the cloud-based, zero-touch deployment technology: devices are pre-registered (by the vendor or IT) and, on first boot, configure themselves through the out-of-box experience - joining Microsoft Entra ID, enrolling in Intune, and applying policies without traditional imaging (C). Configuration Manager imaging (A) is the legacy wipe-and-load approach, Entra Connect Sync (B) synchronizes identities not device provisioning, and Defender for Endpoint onboarding (D) is for EDR, not provisioning.

3. 3. A compliance administrator configures a sensitivity label that encrypts content and restricts access to internal users with View and Edit permissions. A user applies this label to a Word document and shares it via OneDrive with an authorized colleague, who later downloads the file to a personal device. Which statement best describes how protection is enforced?

   • A. The colleague can open the document offline indefinitely without re-authentication, because the encryption keys are cached on the device permanently after the first time the document is opened.
   • B. The label applies to copies of the file stored in SharePoint or OneDrive, but access to locally downloaded or USB-copied versions of the file is unrestricted.
   • C. The document requires the colleague to be on a domain-joined Windows device that is also registered with the tenant's Microsoft Entra ID before it will open.
   • D. The colleague must authenticate, and Microsoft Purview Information Protection (Azure Rights Management) enforces the configured View/Edit permissions wherever the document is opened.
   Show answer

   Correct answer: D

   Sensitivity labels with encryption use Microsoft Purview Information Protection - the service formerly known as Azure Information Protection, with encryption enforced by Azure Rights Management. Because protection is bound into the file itself, the configured View/Edit permissions travel with it: the colleague authenticates to obtain a use license and is bound by those permissions wherever the document is opened, including local copies. Option A is wrong because use licenses expire and re-authentication is required after the offline period elapses. Option B is wrong because protection follows the file, not its storage location. Option C is wrong because domain join is not a prerequisite for opening protected content.

4. 4. An organization uses Microsoft Entra Connect Sync with default settings to synchronize identities from on-premises Active Directory to Microsoft Entra ID. An employee leaves the company, and the administrator must permanently disable the employee's access to Microsoft 365 while making the change flow correctly through the hybrid identity environment. What is the correct first action?

   • A. Disable the on-premises Active Directory user account or move it to a non-synced organizational unit, then allow synchronization to disable the corresponding Microsoft Entra account.
   • B. Delete the user directly from the Microsoft Entra admin center; the cloud deletion will replicate back to on-premises Active Directory via Microsoft Entra Connect Sync within the next sync cycle.
   • C. Block sign-in for the user in the Microsoft 365 admin center; this also disables the corresponding on-premises Active Directory account through the Entra Connect Sync writeback channel.
   • D. Remove the Microsoft 365 licenses assigned to the user; the user's identity is then automatically deleted from both Microsoft Entra ID and on-premises Active Directory within 24 hours.
   Show answer

   Correct answer: A

   In a hybrid identity environment using Microsoft Entra Connect Sync, on-premises Active Directory is the source of authority for synchronized user objects. Deprovisioning must therefore start on-premises: disable the AD user (or move them to a non-synced OU), then let synchronization carry the change to Microsoft Entra ID, where the cloud account is disabled and ultimately soft-deleted if the AD object is removed. Option B is wrong because Entra Connect Sync flows on-prem → cloud for users; cloud-side deletions are overwritten on the next sync. Option C is wrong because Microsoft 365 sign-in blocks do not modify on-premises AD. Option D is wrong because removing licenses ends service access but does not delete the identity from either directory.

5. 5. A compliance administrator must configure a Microsoft Purview DLP policy for Exchange Online and Teams that blocks credit card numbers from being sent to external recipients, while still allowing internal users to share that content if they enter a written business justification. Which combination of DLP policy actions correctly meets both requirements?

   • A. Configure a single "Block everyone" action for both internal and external recipients of credit card data, and rely on Microsoft Defender for Cloud Apps reporting to capture justifications.
   • B. Send a policy tip rather than a block to senders for both internal and external sharing; auditing and reporting are handled by separate Microsoft Defender for Cloud Apps file policies and connected app governance.
   • C. Auto-apply a sensitivity label with encryption to matched messages and disable the DLP block action, since label encryption substitutes for a block decision in Exchange and Teams.
   • D. Use "Block everyone" for external recipients and "Block with user override and business justification" for internal recipients, with incident reports sent to the security team.
   Show answer

   Correct answer: D

   Microsoft Purview DLP supports different actions per recipient scope: Block everyone, Block with user override (optionally requiring a business justification), Allow with policy tip, and Audit only. Option D combines a hard external block with an internal override-with-justification action and routes incident reports - exactly the policy described. Option A externally blocks but only audits internal traffic, missing the justification capture. Option B is policy-tip-only and therefore not a hard block in any scope; relying on a separate product for reporting is not part of DLP policy actions. Option C confuses controls - auto-labeling encrypts content via sensitivity labels but does not block transmission, and "encrypt" is not itself a DLP policy action.