MS-100 Case Studies & Practical Application 4 — Questions and Answers
Question 1: A healthcare organization must ensure that any patient data shared via email is automatically encrypted. Users should not need to take manual action. What should be configured?
- Microsoft Purview sensitivity labels with auto-labeling policies using trainable classifiers or sensitive info types (Correct answer)
- Azure Information Protection manual classification requiring user selection
- Exchange Online S/MIME certificates for all mailboxes
- Microsoft Defender for Office 365 Safe Attachments
Correct answer: Microsoft Purview sensitivity labels with auto-labeling policies using trainable classifiers or sensitive info types
Auto-labeling policies in Microsoft Purview can detect sensitive information types and automatically apply encryption-enforcing sensitivity labels without user action.
Question 2: Contoso's Azure AD Connect sync is running but newly created on-premises AD user accounts are not appearing in Azure AD after 48 hours. What is the most likely cause?
- The Organizational Unit containing new users is excluded from the Azure AD Connect sync scope (Correct answer)
- Password hash sync is disabled for new accounts
- Azure AD licensing has reached its user limit
- The new accounts do not have Exchange attributes set
Correct answer: The Organizational Unit containing new users is excluded from the Azure AD Connect sync scope
If the OU where new accounts are created is not included in the Azure AD Connect filtering scope, those accounts will never be synchronized.
Question 3: A company needs to migrate 200 shared mailboxes from on-premises Exchange to Exchange Online. The migration must minimize downtime and keep both environments in sync during the cutover window. Which migration type is appropriate?
- Cutover migration
- Staged migration
- Hybrid migration using the Migration Endpoint (MRS Proxy) (Correct answer)
- IMAP migration
Correct answer: Hybrid migration using the Migration Endpoint (MRS Proxy)
Hybrid migration using MRS Proxy allows incremental synchronization with a final delta sync at cutover, minimizing downtime for mailbox moves.
Question 4: An organization implements Azure AD Password Protection to block weak passwords. After deployment, some on-premises users can still set banned passwords. What is missing?
- The Azure AD Password Protection DC Agent is not installed on all domain controllers (Correct answer)
- The password protection proxy service is running on a domain controller instead of a member server
- Azure AD Password Protection requires Azure AD Premium P2
- Password writeback must be enabled in Azure AD Connect
Correct answer: The Azure AD Password Protection DC Agent is not installed on all domain controllers
The DC Agent must be installed on every domain controller to enforce the banned password list; DCs without the agent do not enforce the custom policy.
Question 5: Litware Inc. needs to ensure that Teams meeting recordings stored in OneDrive are automatically deleted after 60 days for non-essential meetings. What should be configured?
- A Microsoft Purview retention policy targeting Teams meeting recordings in OneDrive with a 60-day delete action (Correct answer)
- A Microsoft Purview retention label manually applied by users to recordings
- Conditional Access policy blocking access to recordings after 60 days
- SharePoint site collection storage limits set to 60 days
Correct answer: A Microsoft Purview retention policy targeting Teams meeting recordings in OneDrive with a 60-day delete action
A Purview retention policy targeting OneDrive with a 60-day retain-and-delete action automatically deletes Teams recordings after the retention period expires.
Question 6: A multinational company configures Azure AD tenant restrictions to prevent employees from signing into unauthorized external Microsoft 365 tenants on corporate devices. Where must this be enforced?
- In the company's Azure AD Conditional Access policies
- On the corporate network proxy or firewall via HTTP header injection (Correct answer)
- In the Microsoft Defender for Cloud Apps session policies
- Via Microsoft Intune device configuration profiles
Correct answer: On the corporate network proxy or firewall via HTTP header injection
Tenant Restrictions v1 work by injecting the Restrict-Access-To-Tenants HTTP header at the corporate proxy/firewall layer, so all outbound Microsoft authentication traffic carries the restriction.
Question 7: During a Microsoft 365 deployment, an admin notices that some pilot users cannot access the Microsoft 365 admin center even though they are assigned the Global Reader role. What is the likely issue?
- Global Reader does not grant access to the Microsoft 365 admin center
- The users have not completed MFA registration required by a Conditional Access policy (Correct answer)
- The users' accounts are synchronized from on-premises AD and cannot hold cloud roles
- Global Reader requires an Azure AD Premium P1 license
Correct answer: The users have not completed MFA registration required by a Conditional Access policy
If a Conditional Access policy requires MFA for admin center access and users haven't registered for MFA, they will be blocked from signing in.
MS-100 Case Studies & Practical Application 4
A healthcare organization must ensure that any patient data shared via email is automatically encrypted.
Users should not need to take manual action.
What should be configured?