MS-102: Microsoft 365 Administrator - Free download from Exam Hub

Your company has a Microsoft 365 subscription.

You need to identify all the users in the subscription who are licensed for Office 365 through a group membership. The solution must include the name of the group used to assign the license.

What should you use?

Active users in the Microsoft 365 admin center
Reports in Microsoft Purview compliance portal
the Licenses blade in the Azure portal
Reports in the Microsoft 365 admin center

Correct answer: C

Explanation:

In the Azure AD Admin Center, select Azure Active Directory then select Licenses to open the Licenses blade. From there you need to click on the 'Managed your purchased licenses link'. Select a license you want to view, for example Office 365 E3. This will then display a list of all users with that license. In the 'Assignment Paths' column, it will say 'Direct' for a license that has been assigned directly to a user or 'Inherited (Group Name)' for a license that has been assigned through a group. Reference: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-assign

In the Azure AD Admin Center, select Azure Active Directory then select Licenses to open the Licenses blade.

From there you need to click on the 'Managed your purchased licenses link'. Select a license you want to view, for example Office 365 E3. This will then display a list of all users with that license. In the 'Assignment Paths' column, it will say 'Direct' for a license that has been assigned directly to a user or 'Inherited (Group Name)' for a license that has been assigned through a group.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-assign

You have a Microsoft 365 subscription that contains the users shown in the following table.

You need to configure group-based licensing to meet the following requirements:

To all users, deploy an Office 365 E3 license without the Power Automate license option.
To all users, deploy an Enterprise Mobility + Security E5 license.
To the users in the research department only, deploy a Power BI Pro license.
To the users in the marketing department only, deploy a Visio Plan 2 license.

What is the minimum number of deployment groups required?

1
2
3
4
5

Correct answer: C

Explanation:

3 groups needed : Group 1: Allusers (deploy EMS+S E5 licence and O365 E3 licence with "PowerAutomate for Office 365" disabled. group 2: "Research group" : deploy Power Bi Pro Licence (not included in O365 E3 but in O365 E5). Group 3: "Marketing group" deploy Visio plan 2 Licence.

3 groups needed :

Group 1: Allusers (deploy EMS+S E5 licence and O365 E3 licence with "PowerAutomate for Office 365" disabled.
group 2: "Research group" : deploy Power Bi Pro Licence (not included in O365 E3 but in O365 E5).
Group 3: "Marketing group" deploy Visio plan 2 Licence.

You have a Microsoft 365 subscription.

You view the Service health Overview as shown in the following exhibit.

You need to ensure that a user named User1 can view the advisories to investigate service health issues.

Which role should you assign to User1?

Message Center Reader
Reports Reader
Service Support Administrator
Compliance

Correct answer: C

Explanation:

Service Support Admin - Assign the Service Support admin role as an additional role to admins or users who need to do the following in addition to their usual admin role: Open and manage service requests View and share message center posts Monitor service health https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide#commonly-used-microsoft-365-admin-center-roles

Service Support Admin - Assign the Service Support admin role as an additional role to admins or users who need to do the following in addition to their usual admin role:

Open and manage service requests
View and share message center posts
Monitor service health

https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide#commonly-used-microsoft-365-admin-center-roles

Your network contains an Active Directory forest named contoso.local.

You purchase a Microsoft 365 subscription.

You plan to move to Microsoft 365 and to implement a hybrid deployment solution for the next 12 months.

You need to prepare for the planned move to Microsoft 365.

What is the best action to perform before you implement directory synchronization? More than one answer choice may achieve the goal. Select the BEST answer.

Purchase a third-party X.509 certificate.
Create an external forest trust.
Rename the Active Directory forest.
Purchase a custom domain name.

Correct answer: D

Explanation:

The best action to take before implementing directory synchronization for a hybrid deployment with Microsoft 365 would be to purchase a custom domain name. When you set up Microsoft 365, you're prompted to provide your domain name. This domain should match the domain you use within your on-premises Active Directory environment to ensure a seamless user experience and email delivery.

You have a Microsoft 365 subscription.

You configure a new Azure AD enterprise application named App1. App1 requires that a user be assigned the Reports Reader role.

Which type of group should you use to assign the Reports Reader role and to access App1?

a Microsoft 365 group that has assigned membership
a Microsoft 365 group that has dynamic user membership
a security group that has assigned membership
a security group that has dynamic user membership

Correct answer: C

Explanation:

You can not assign Azure AD roles to dynamic groups. And you don't need a mailbox/sharepoint/etc, so it is not a 365 group.

ave a new Microsoft 365 E5 tenant.

You need to enable an alert policy that will be triggered when an elevation of Microsoft Exchange Online administrative privileges is detected.

What should you do first?

Enable auditing.
Enable Microsoft 365 usage analytics.
Create an Insider risk management policy.
Create a communication compliance policy.

Correct answer: A

Explanation:

In order to monitor and get alerted on specific activities such as elevation of administrative privileges, auditing needs to be enabled in your Microsoft 365 environment. Auditing will record events such as changes in permissions and other administrative activities, which can then be monitored through alert policies to notify administrators when specific events occur.

Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices.

You perform a proof of concept (PoC) deployment of Microsoft Defender for Endpoint for 10 test devices. During the onboarding process, you configure Microsoft Defender for Endpoint-related data to be stored in the United States.

You plan to onboard all the devices to Microsoft Defender for Endpoint.

You need to store the Microsoft Defender for Endpoint data in Europe.

What should you do first?

Delete the workspace.
Create a workspace.
Onboard a new device.
Offboard the test devices.

Correct answer: D

Explanation:

To store the Microsoft Defender for Endpoint data in Europe, you need to offboard the test devices from the current workspace that is configured to store data in the United States. This is because the data storage location cannot be changed once it is configured during the onboarding process. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/data-storage-privacy?view=o365-worldwide

To store the Microsoft Defender for Endpoint data in Europe, you need to offboard the test devices from the current workspace that is configured to store data in the United States. This is because the data storage location cannot be changed once it is configured during the onboarding process.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/data-storage-privacy?view=o365-worldwide

You have a Microsoft 365 E5 subscription that contains a user named User1.

User1 exceeds the default daily limit of allowed email messages and is on the Restricted entities list.

You need to remove User1 from the Restricted entities list.

What should you use?

the Exchange admin center
the Microsoft Purview compliance portal
the Microsoft 365 admin center
the Microsoft 365 Defender portal
the Microsoft Entra admin center

Correct answer: D

Explanation:

Remove a user from the Restricted entities page in the Microsoft 365 Defender portal In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Restricted entities. Or, to go directly to the Restricted entities page, use https://security.microsoft.com/restrictedentities. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/removing-user-from-restricted-users-portal-after-spam?view=o365-worldwide

Remove a user from the Restricted entities page in the Microsoft 365 Defender portal

In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Email & collaboration > Review > Restricted entities. Or, to go directly to the Restricted entities page, use https://security.microsoft.com/restrictedentities.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/removing-user-from-restricted-users-portal-after-spam?view=o365-worldwide

Your company has a Microsoft 365 E5 subscription.

Users in the research department work with sensitive data.

You need to prevent the research department users from accessing potentially unsafe websites by using hyperlinks embedded in email messages and documents. Users in other departments must not be restricted.

What should you do?

Create a data loss prevention (DLP) policy that has a Content is shared condition.
Modify the safe links policy Global settings.
Create a data loss prevention (DLP) policy that has a Content contains condition.
Create a new safe links policy.

Correct answer: D

Explanation:

With this action, you can create a Safe Links policy specifically targeting the users in the research department, ensuring that only they are restricted from accessing potentially unsafe websites through hyperlinks, while other departments remain unaffected. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-links-policies?view=o365-worldwide

With this action, you can create a Safe Links policy specifically targeting the users in the research department, ensuring that only they are restricted from accessing potentially unsafe websites through hyperlinks, while other departments remain unaffected.

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-links-policies?view=o365-worldwide

You have a Microsoft 365 E5 subscription.

You need to compare the current Safe Links configuration to the Microsoft recommended configurations.

What should you use?

Microsoft Purview
Azure AD Identity Protection
Microsoft Secure Score
the configuration analyzer

Correct answer: D

Explanation:

The goal of the configuration analyzer is to compare Exchange Online Protection policies (aka Threat Policies) currently configured with MS recommendations. There is two tabs named "Standard recommendations" & "Strict recommendations" that give the gap between current configuration & MS recommendations. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide#use-the-configuration-analyzer-in-the-microsoft-365-defender-portal

The goal of the configuration analyzer is to compare Exchange Online Protection policies (aka Threat Policies) currently configured with MS recommendations.

There is two tabs named "Standard recommendations" & "Strict recommendations" that give the gap between current configuration & MS recommendations.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide#use-the-configuration-analyzer-in-the-microsoft-365-defender-portal