MS-102 - Microsoft 365 Administrator Expert Implementing Conditional Access Policies Questions and Answers

Question 1

An organization wants to enforce multifactor authentication (MFA) for all users accessing Microsoft 365 services, but they want to bypass this requirement when users are connected to the corporate office network.
The public IP addresses of the corporate office have been configured in a named location called 'CorpNet'.
How should the Conditional Access policy be configured to meet this requirement?

Accepted Answer

Create one policy targeting 'All users', with the Locations condition including 'Any location' and excluding 'CorpNet', and the Grant control set to 'Require multifactor authentication'.

Answer

Create two policies: one that requires MFA from 'Any location' and a second, higher-precedence policy that blocks access from the 'CorpNet' named location.

Answer

Create one policy targeting 'All users', with the Locations condition including only the 'CorpNet' named location, and the Grant control set to 'Block access'.

Answer

Create one policy targeting 'All users', with the Client apps condition configured for 'Browser' and 'Mobile apps and desktop clients', and the Grant control set to 'Require multifactor authentication'.

Question 2

A company is implementing a policy for unmanaged personal devices (BYOD). The goal is to allow browser-based access to SharePoint Online but prevent users from downloading sensitive files to these non-compliant devices. Which of the following Conditional Access controls is specifically designed to achieve this granular, in-session control?

Accepted Answer

Use Conditional Access App Control

Answer

Sign-in frequency

Answer

Persistent browser session

Answer

Use app enforced restrictions

Question 3

An administrator is designing a Conditional Access policy to automatically respond when Microsoft Entra ID Protection flags a user with a 'High' user risk level. The desired outcome is to allow the user to self-remediate the risk and regain access securely. Which Grant control is the most appropriate for this policy?

Accepted Answer

Require password change

Answer

Require device to be marked as compliant

Answer

Block access

Answer

Require multifactor authentication

Question 4

You are preparing to deploy a new Conditional Access policy that will require all administrators to sign in from a compliant device. Before enforcing the policy, you need to evaluate its potential impact on all administrator sign-ins over a one-week period without blocking anyone. What is the recommended state for the policy during this evaluation phase?

Accepted Answer

Report-only

Answer

Off

Answer

On

Answer

Disabled

Question 5

An administrator needs to simulate the effect of several Conditional Access policies on a specific user's sign-in attempt from an unmanaged device in a specific country. The goal is to troubleshoot why the user might be getting blocked without actually performing the sign-in. Which tool within Microsoft Entra should be used for this purpose?

Accepted Answer

What If

Answer

Access Reviews

Answer

Sign-in logs

Answer

Audit logs

Question 6

An organization is creating a high-security Conditional Access policy for privileged roles. The policy must ensure that when an administrator signs in, they are both using a compliant device AND they satisfy a multifactor authentication requirement. How should the Grant controls be configured to enforce both conditions simultaneously?

Accepted Answer

Select 'Require device to be marked as compliant' and 'Require multifactor authentication', then select the option for 'Require all the selected controls'.

Answer

Select 'Require device to be marked as compliant' and 'Require multifactor authentication', then select the option for 'Require one of the selected controls'.

Answer

Create two separate policies, one for requiring a compliant device and another for requiring multifactor authentication.

Answer

Select only 'Require multifactor authentication' as it implicitly checks for device compliance.