MD-102 Managing Identity and Access 2 — Questions and Answers
Question 1: An administrator wants to require devices to be Azure AD joined before granting access to a SharePoint site. Which policy type should be used?
- Intune compliance policy
- Azure AD Conditional Access policy (Correct answer)
- Azure AD Identity Protection policy
- Microsoft Defender policy
Correct answer: Azure AD Conditional Access policy
An Azure AD Conditional Access policy can require a device to be Azure AD joined as a condition before granting access to specific cloud apps like SharePoint.
Question 2: A user has left the organization. Which action should an administrator take in Azure AD to immediately prevent the user from signing in?
- Delete the user account
- Disable the user account (Correct answer)
- Remove all group memberships
- Revoke all refresh tokens
Correct answer: Disable the user account
Disabling the user account in Azure AD immediately prevents sign-in while preserving the account, licenses, and data for potential recovery.
Question 3: Which Azure AD feature can automatically detect risky sign-in events and prompt for MFA or block access based on a risk score?
- Conditional Access
- Identity Protection (Correct answer)
- Privileged Identity Management
- Access Reviews
Correct answer: Identity Protection
Azure AD Identity Protection evaluates sign-in risk using machine learning and can automatically enforce MFA or block access based on the detected risk level.
Question 4: An organization uses Hybrid Azure AD Join. What tool is used to synchronize on-premises AD accounts to Azure AD?
- ADFS Proxy
- Azure AD Connect (Correct answer)
- Active Directory Migration Tool
- Azure AD App Proxy
Correct answer: Azure AD Connect
Azure AD Connect is the Microsoft tool that synchronizes on-premises Active Directory identities, including device objects, to Azure AD.
Question 5: Which license is required to use Azure AD Privileged Identity Management (PIM)?
- Azure AD Free
- Microsoft 365 Business Basic
- Azure AD Premium P1
- Azure AD Premium P2 (Correct answer)
Correct answer: Azure AD Premium P2
Azure AD Privileged Identity Management requires Azure AD Premium P2 licenses to provide just-in-time privileged access management.
Question 6: A Windows 10 device is Azure AD joined. A user wants to use Windows Hello for Business. What is required for cloud-only deployments?
- On-premises PKI infrastructure
- Azure AD Premium P1 license (Correct answer)
- Active Directory Federation Services
- Active Directory Certificate Services
Correct answer: Azure AD Premium P1 license
Windows Hello for Business cloud-only deployments require Azure AD Premium P1 to support the certificate trust or key trust models.
MD-102 Managing Identity and Access 2
An administrator wants to require devices to be Azure AD joined before granting access to a SharePoint site.
Which policy type should be used?