Microsoft 365 Administrator (MS-102) Exam — Questions and Answers

Question 1: An admin configures a Safe Attachments policy in Microsoft Defender for Office 365 with the 'Dynamic Delivery' action. What does this do?

Delivers the email body immediately while scanning the attachment in a sandbox, then re-attaches it (Correct answer)
Blocks all attachments until manually reviewed
Replaces attachments with a safe link to the file
Quarantines the email and notifies the recipient

Correct answer: Delivers the email body immediately while scanning the attachment in a sandbox, then re-attaches it

Dynamic Delivery allows the email body to reach the recipient immediately while the attachment is detonated in a sandbox, then delivered once deemed safe.

Question 2: An administrator needs to prevent users from creating new Microsoft 365 Groups unless they belong to a specific security group. Which Azure AD setting should be configured?

Dynamic membership rule
Group naming policy
Group expiration policy
Group creation restriction (Correct answer)

Correct answer: Group creation restriction

Group creation restriction in Azure AD settings allows admins to limit Microsoft 365 Group creation to members of a designated security group.

Question 3: Which Microsoft Defender for Office 365 plan 2 feature allows security teams to investigate the full email delivery path and all recipients of a malicious message?

Anti-phishing policy
Safe Attachments policy
Threat Explorer (Real-time detections) (Correct answer)
Mail flow rules

Correct answer: Threat Explorer (Real-time detections)

Threat Explorer in Defender for Office 365 Plan 2 shows detailed email flow, delivery actions, and all recipients, enabling thorough investigation of threats.

Question 4: An administrator wants to configure Defender for Endpoint to send alerts to a SIEM solution. Which integration method is recommended for Microsoft Sentinel?

Manually download CSV reports
Use the Microsoft 365 Defender connector in Microsoft Sentinel (Correct answer)
Export alerts via email
Configure an SMTP relay on the Defender portal

Correct answer: Use the Microsoft 365 Defender connector in Microsoft Sentinel

The Microsoft 365 Defender data connector in Microsoft Sentinel natively ingests incidents and alerts from Defender for Endpoint without requiring custom scripting.

Question 5: A security team wants to create a custom detection rule that triggers an alert when a specific behavior pattern is observed. Which Microsoft 365 Defender feature supports this?

Custom detection rules via Advanced Hunting (Correct answer)
Automated Investigation rules
Threat Analytics reports
Microsoft Secure Score actions

Correct answer: Custom detection rules via Advanced Hunting

Custom detection rules in Microsoft 365 Defender are built on Advanced Hunting KQL queries and trigger alerts or actions when defined conditions are met.

Question 6: What is the purpose of the 'confidence level' setting in a DLP sensitive information type rule?

It sets the minimum pattern-match accuracy required to trigger the rule (Correct answer)
It determines how long match evidence is retained
It defines how many users must approve a match
It controls the policy's enforcement priority

Correct answer: It sets the minimum pattern-match accuracy required to trigger the rule

The confidence level (Low, Medium, High) specifies the required accuracy of pattern matching before a sensitive information type is considered detected.

Question 7: An administrator wants to ensure that only licensed users can be assigned the Teams Administrator role. Where is role assignability controlled in Azure AD?

Azure AD > Conditional Access > Assignments
Azure AD > Roles and administrators > Role settings (Correct answer)
Microsoft 365 admin center > Billing > Licenses
Azure AD > Identity Governance > Access packages

Correct answer: Azure AD > Roles and administrators > Role settings

Role settings in Azure AD Roles and administrators control eligibility, activation requirements, and assignment rules for each role.

Question 8: Your company wants to allow new employees to set up their passwordless authentication methods, such as the Microsoft Authenticator app or a FIDO2 key, without needing to know a password first. Which Entra ID feature is specifically designed to facilitate this initial onboarding process?

Self-Service Password Reset (SSPR)
Conditional Access
Security Defaults
Temporary Access Pass (TAP) (Correct answer)

Correct answer: Temporary Access Pass (TAP)

A Temporary Access Pass (TAP) is a time-limited passcode that can be given to a user to sign in and register their passwordless authentication methods. This is the primary method for bootstrapping passwordless credentials without needing a permanent password first.

Question 9: A Microsoft 365 administrator needs to view which admin roles are currently assigned to a specific user. What is the fastest way to check this in the admin center?

Exchange admin center > Permissions > Admin roles > Search user
Microsoft 365 admin center > Users > Active users > Select user > Roles tab (Correct answer)
Microsoft 365 admin center > Roles > Role assignments > Filter by user
Azure AD > Roles and administrators > Search by user

Correct answer: Microsoft 365 admin center > Users > Active users > Select user > Roles tab

In the Microsoft 365 admin center, selecting a user from Active users and viewing their Roles tab shows all currently assigned admin roles for that specific user.

Question 10: Which Microsoft Purview feature uses machine learning to identify sensitive content based on examples rather than fixed patterns?

Trainable classifiers (Correct answer)
Exact data match
Keyword dictionaries
Document fingerprinting

Correct answer: Trainable classifiers

Trainable classifiers use machine learning trained on content samples to identify sensitive categories without relying on explicit patterns or keywords.

Question 11: You are configuring a Data Loss Prevention (DLP) policy to monitor for the sharing of project codenames. Your goal is to educate users without blocking their actions. When a user attempts to send an email containing a project codename, you want a small notification to appear in Outlook informing them of a potential policy violation. Which DLP policy setting should you configure?

Set the incident report severity to 'Low'
Enable user notifications and show policy tips (Correct answer)
Restrict access and block everyone
Add an exception for internal users

Correct answer: Enable user notifications and show policy tips

Policy tips are the in-context notifications that appear in Office applications like Outlook to warn users that they may be about to violate a DLP policy. [11] Configuring 'User notifications' and enabling 'Policy tips' is the specific action to achieve this educational goal without blocking the user. [1, 15] The other options relate to incident management or restrictive actions.

Question 12: An organization enables Seamless SSO. Which on-premises object is created in Active Directory as part of this configuration?

A service account named AzureADSSO
An OU named SeamlessSSO
A computer account named AZUREADSSOACC (Correct answer)
A group named AzureSSO_Users

Correct answer: A computer account named AZUREADSSOACC

Azure AD Connect creates a computer account named AZUREADSSOACC in the on-premises AD to facilitate Seamless SSO Kerberos ticket issuance.

Question 13: Which attribute is used by default as the source anchor (immutableId) in Azure AD Connect when syncing users?

sAMAccountName
mail
userPrincipalName
objectGUID (Correct answer)

Correct answer: objectGUID

ObjectGUID is the default source anchor attribute used by Azure AD Connect to uniquely and immutably identify objects.

Question 14: A company is implementing a policy for unmanaged personal devices (BYOD). The goal is to allow browser-based access to SharePoint Online but prevent users from downloading sensitive files to these non-compliant devices. Which of the following Conditional Access controls is specifically designed to achieve this granular, in-session control?

Use Conditional Access App Control (Correct answer)
Use app enforced restrictions
Persistent browser session
Sign-in frequency

Correct answer: Use Conditional Access App Control

Use Conditional Access App Control, which integrates with Microsoft Defender for Cloud Apps, acts as a reverse proxy to monitor and control user sessions in real-time. This allows for granular policies like blocking downloads, which is more advanced than the limited controls offered by app enforced restrictions.

Question 15: A company wants to implement Azure AD Connect cloud sync instead of Azure AD Connect. Which on-premises requirement is eliminated with cloud sync?

An on-premises SQL Server for the sync database (Correct answer)
An on-premises Active Directory Domain Services environment
A network connection to Azure AD
A server running the provisioning agent

Correct answer: An on-premises SQL Server for the sync database

Azure AD Connect cloud sync uses a lightweight provisioning agent and does not require a local SQL Server, unlike the full Azure AD Connect which uses SQL Server Express or a full SQL instance.

Question 16: What happens when Azure AD Connect is placed in staging mode?

It performs a full synchronization immediately
It exports changes but does not import from on-premises AD
It imports and synchronizes objects but does not export changes (Correct answer)
It disables password hash synchronization

Correct answer: It imports and synchronizes objects but does not export changes

In staging mode, Azure AD Connect runs the full import and sync process but does not export any changes to Azure AD or on-premises AD.

Question 17: A Conditional Access policy is set to 'Report-only' mode. What is the effect on users signing in?

Users must satisfy all policy conditions but are not blocked
The policy is disabled and has no effect
Users are blocked from signing in until the policy is enabled
Users can sign in normally, but results are logged for evaluation without enforcement (Correct answer)

Correct answer: Users can sign in normally, but results are logged for evaluation without enforcement

Report-only mode evaluates the policy and logs what would happen without actually enforcing access controls, enabling impact assessment.

Question 18: A Conditional Access policy is set to 'Report-Only' mode. What is the impact on end users?

Users experience no change in sign-in behavior, but policy outcomes are logged (Correct answer)
Users must complete MFA but results are only logged
Users receive a warning message during sign-in
Users are blocked from signing in until the policy is activated

Correct answer: Users experience no change in sign-in behavior, but policy outcomes are logged

Report-Only mode evaluates a Conditional Access policy and logs what the outcome would have been without enforcing it, allowing administrators to assess impact before enablement.

Question 19: Which of the following administrator roles has the highest level of permissions within a Microsoft 365 tenant, including the ability to manage all aspects of the service and assign other administrator roles?

Global Administrator (Correct answer)
Service Support Administrator
Exchange Administrator
User Administrator

Correct answer: Global Administrator

The Global Administrator role has unlimited access to all management features and data across all Microsoft 365 services. This includes the ability to assign other administrator roles. It is the highest-level admin role in the tenant.

Question 20: During Microsoft 365 deployment, an administrator needs to configure DNS for Exchange Online. Which DNS record type is responsible for directing inbound email to Exchange Online?

MX (Correct answer)
TXT
SRV
CNAME

Correct answer: MX

The MX (Mail Exchanger) record must be updated to point to Exchange Online Protection so that inbound email is routed to Exchange Online.

Question 21: When configuring a Microsoft 365 tenant's organizational profile, which setting determines the default time zone used for scheduling in apps like Teams and Outlook?

Exchange Online regional settings
Organization information time zone in Microsoft 365 admin center (Correct answer)
Locale setting in Azure AD
User mailbox time zone

Correct answer: Organization information time zone in Microsoft 365 admin center

The Organization information section in the Microsoft 365 admin center includes a default time zone that affects tenant-wide scheduling defaults.

Question 22: You are preparing to deploy a new Conditional Access policy that will require all administrators to sign in from a compliant device. Before enforcing the policy, you need to evaluate its potential impact on all administrator sign-ins over a one-week period without blocking anyone. What is the recommended state for the policy during this evaluation phase?

On
Off
Report-only (Correct answer)
Disabled

Correct answer: Report-only

Report-only mode is a policy state specifically designed for testing and evaluation. When a policy is in Report-only mode, it evaluates sign-ins against its conditions and logs the outcome (Success, Failure, etc.) as if it were enforced, but it does not actually block or prompt the user. This allows administrators to assess the impact safely.

Question 23: Which Intune feature allows administrators to deploy traditional Win32 applications (.exe or .msi) to Windows 10/11 managed devices?

SCCM co-management with workload shift only
Microsoft Store for Business app deployment
Windows Package Manager (winget) integration
Win32 app deployment via the Intune Management Extension (IME) (Correct answer)

Correct answer: Win32 app deployment via the Intune Management Extension (IME)

The Intune Management Extension (IME) agent enables Win32 app packaging and deployment to Intune-managed Windows devices, supporting complex installation scenarios with detection rules.

Question 24: Which Microsoft 365 Defender feature provides a unified view correlating alerts from Defender for Endpoint, Defender for Identity, and Defender for Office 365 into a single incident?

Incidents queue (Correct answer)
Threat analytics
Microsoft Secure Score
Action center

Correct answer: Incidents queue

The incidents queue in Microsoft 365 Defender automatically correlates related alerts from multiple Defender products into a single incident for unified investigation.

Question 25: An administrator wants to prevent end users from releasing their own quarantined messages that were identified as high-confidence phishing. Which quarantine policy setting achieves this?

Set the quarantine retention period to 1 day
Disable end-user spam notifications globally
Enable zero-hour auto purge on the anti-phishing policy
Assign a quarantine policy that grants NoAccess permissions to end users (Correct answer)

Correct answer: Assign a quarantine policy that grants NoAccess permissions to end users

Assigning a quarantine policy with NoAccess permissions prevents end users from viewing or releasing their quarantined messages, keeping admin control over high-confidence phishing verdicts.

Question 26: An administrator needs to configure Self-Service Password Reset (SSPR) to require users to verify identity using two methods. Which setting controls the number of required authentication methods?

Authentication methods > Number of methods required to reset (Correct answer)
Identity Protection > User risk policy strength
Conditional Access > Authentication strength
Password protection > Lockout threshold

Correct answer: Authentication methods > Number of methods required to reset

In Azure AD SSPR settings, 'Number of methods required to reset' controls how many authentication methods a user must verify before resetting their password.

Question 27: An organization using Microsoft Purview wants to automatically apply a retention label to documents containing specific keywords. Which feature enables this?

Manual sensitivity label assignment
Compliance Manager assessment
Auto-apply retention label policy using keyword query (Correct answer)
DLP policy with block action

Correct answer: Auto-apply retention label policy using keyword query

Auto-apply retention label policies can use keyword queries, sensitive information types, or trainable classifiers to automatically label matching content.

Question 28: During an Azure AD Connect configuration, an administrator wants to filter which OUs are synchronized to Azure AD. Where is this configured?

Azure AD Connect synchronization rules editor
Active Directory Sites and Services
Azure AD Connect domain and OU filtering (Correct answer)
Azure AD portal > Users

Correct answer: Azure AD Connect domain and OU filtering

Domain and OU filtering in the Azure AD Connect configuration wizard allows administrators to select specific OUs to synchronize.

Question 29: An organization uses Azure AD Password Protection. What happens when a user attempts to set a password containing a term from the global banned password list?

The password is accepted after MFA verification
The account is locked until an admin resets it
The password is accepted but flagged for review
The user receives an error and must choose a different password (Correct answer)

Correct answer: The user receives an error and must choose a different password

Azure AD Password Protection rejects passwords that match or are variants of terms on the global or custom banned password lists.

Question 30: An admin wants to ensure that high-risk sign-ins require additional verification automatically. Which Azure AD feature should be configured?

Access Reviews
Privileged Identity Management
Multi-Factor Authentication per-user setting
Identity Protection risk-based Conditional Access policy (Correct answer)

Correct answer: Identity Protection risk-based Conditional Access policy

Azure AD Identity Protection can evaluate sign-in risk level and trigger Conditional Access policies requiring MFA or blocking access for high-risk logins.

Question 31: A Microsoft 365 administrator reviews a DLP alert and notices a user justified overriding a block by providing a business reason. Where is this justification stored?

Azure AD sign-in logs
Microsoft Defender Incidents queue
The Audit log in the Microsoft Purview compliance portal (Correct answer)
The user's mailbox sent items

Correct answer: The Audit log in the Microsoft Purview compliance portal

User override justifications for DLP policy matches are recorded as audit events in the Microsoft Purview Audit log.

Question 32: A Microsoft 365 administrator is configuring a Conditional Access policy to respond to risky sign-ins detected by Microsoft Entra ID Protection. The policy should apply when the sign-in risk level is medium or high. What is the most appropriate 'Grant' control to configure for this policy to allow users to self-remediate?

Block access
Require multifactor authentication (Correct answer)
Require Microsoft Entra hybrid joined device
Require device to be marked as compliant

Correct answer: Require multifactor authentication

When configuring a sign-in risk policy, requiring multifactor authentication allows a user to prove their identity and self-remediate the risk. Blocking access would prevent self-remediation, and requiring a compliant or hybrid joined device might not be possible for the user at that moment and doesn't directly address the sign-in risk itself.

Question 33: An admin observes in the Threat protection status report that many messages are being delivered despite having a phish verdict due to an ETR override. What does 'ETR' stand for in this context?

Enhanced Threat Remediation
External Threat Response
Exchange Transport Rule (Correct answer)
Email Tenant Record

Correct answer: Exchange Transport Rule

ETR stands for Exchange Transport Rule; when a transport rule is configured to bypass filtering (e.g., setting SCL to -1), it can override phishing verdicts and force message delivery.

Question 34: What is the purpose of the Microsoft 365 Deployment Center?

To monitor user logins.
To deploy and manage Microsoft 365 apps and services (Correct answer)
To configure network policies.
To create custom applications.

Correct answer: To deploy and manage Microsoft 365 apps and services

The Microsoft 365 Deployment Center (often referring to guidance and tools within the Microsoft 365 admin center or specific deployment guides) helps organizations plan, deploy, and manage their Microsoft 365 applications and services. It provides resources, checklists, and step-by-step instructions to ensure a smooth rollout of services like Exchange Online, SharePoint Online, and Teams, as well as client applications. Its goal is to simplify the adoption and configuration of the Microsoft 365 suite across an organization.

Question 35: An administrator is reviewing the authentication methods policies in Microsoft Entra ID and notices separate legacy policies for MFA and SSPR. What is the recommended approach for managing authentication methods going forward?

Use PowerShell to synchronize the settings between the legacy and modern policies.
Disable the legacy policies and have users re-register their methods.
Keep the MFA and SSPR policies separate for more granular control.
Migrate the settings from the legacy MFA and SSPR policies to the modern 'Authentication methods' policy. (Correct answer)

Correct answer: Migrate the settings from the legacy MFA and SSPR policies to the modern 'Authentication methods' policy.

Microsoft's recommended approach is to use the modern 'Authentication methods' policy to centrally manage all methods for both MFA and SSPR. There is a migration guide within the Microsoft Entra admin center to help consolidate settings from the legacy policies into the modern, unified policy.

Question 36: An administrator has configured a Conditional Access policy in 'Report-only' mode. What is the effect of this mode?

The policy is disabled and not evaluated
The policy evaluates sign-ins and reports results without enforcing controls (Correct answer)
The policy enforces controls but logs all evaluations
The policy only enforces controls for users in a pilot group

Correct answer: The policy evaluates sign-ins and reports results without enforcing controls

Report-only mode evaluates all sign-ins against the policy conditions and logs what would happen, without actually enforcing the grant or block controls.

Question 37: What is Microsoft 365’s default security feature for protecting emails?

Multi-factor authentication.
Password protection.
Microsoft Defender for Office 365 (Correct answer)
Email encryption.

Correct answer: Microsoft Defender for Office 365

Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) is a cloud-based email filtering service that protects organizations from advanced threats like phishing, spoofing, business email compromise, and malware. It provides robust protection for email, links, and collaboration tools like SharePoint and Teams, going beyond basic spam filtering. This service is Microsoft 365's primary defense against sophisticated email-borne attacks.

Question 38: An administrator needs to proactively investigate the scope of a potential phishing campaign. They need to find all emails with a specific malicious URL that were delivered to user mailboxes across the organization within the last 7 days, including messages that were not clicked. Which Defender for Office 365 tool should be used?

Secure Score
Quarantine
Message Trace
Threat Explorer (Correct answer)

Correct answer: Threat Explorer

Threat Explorer (available in Defender for Office 365 Plan 2) is the primary tool for threat hunting and investigation. It allows administrators to search for emails based on various criteria, including sender, recipient, subject, and specific URLs, across a 30-day period. Unlike Message Trace, it provides rich security details and threat information.

Question 39: What happens to email messages that match a Microsoft Purview retention policy with a 'retain and delete' action after the retention period expires?

They are held indefinitely until manually reviewed
They are permanently deleted immediately
They are moved to the Recoverable Items folder and then purged (Correct answer)
They are archived to an online archive mailbox

Correct answer: They are moved to the Recoverable Items folder and then purged

When a retain-and-delete retention policy expires, items are moved to the Recoverable Items folder where they are purged after the deletion period.

Question 40: Which of the following BEST describes the primary purpose of implementing Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

To prevent common malware infection techniques by blocking specific software behaviors and actions, such as Office apps creating executable content. (Correct answer)
To automatically quarantine malicious files based on cloud-delivered protection intelligence.
To provide a remote shell for in-depth, real-time investigation on a compromised device.
To scan for and report on software vulnerabilities and device misconfigurations.

Correct answer: To prevent common malware infection techniques by blocking specific software behaviors and actions, such as Office apps creating executable content.

Attack Surface Reduction (ASR) rules are a set of controls that prevent software behaviors often leveraged by malware to infect machines. They target specific actions, like scripts launching downloaded content or credential theft from LSASS, rather than relying on traditional file-based signatures. This reduces the number of ways an attacker can exploit a device.

Question 41: An organization wants to require MFA only when users sign in from outside the corporate network. Which Conditional Access feature is used to define the corporate network boundary?

IP risk detection threshold
Compliant device filter
Trusted locations / Named locations (Correct answer)
Network Access Control integration

Correct answer: Trusted locations / Named locations

Named locations (marked as trusted) in Conditional Access define IP ranges for the corporate network, enabling location-based policy conditions.

Question 42: Which setting in the Microsoft 365 admin center controls whether users can install Office applications on personal devices?

Apps for Microsoft 365 settings
Conditional Access policy
Device compliance policy
User-initiated installs under Microsoft 365 Apps (Correct answer)

Correct answer: User-initiated installs under Microsoft 365 Apps

The 'User-initiated installs' toggle under Microsoft 365 Apps settings in the admin center controls whether users can download and install Office from their account portal.

Question 43: Which Microsoft 365 feature allows an admin to query raw event data across endpoints, emails, and identities using Kusto Query Language (KQL)?

Advanced Hunting (Correct answer)
Compliance Manager
Threat Analytics
Content Search

Correct answer: Advanced Hunting

Advanced Hunting in Microsoft 365 Defender uses KQL to query up to 30 days of raw telemetry across all protected workloads.

Question 44: A company must prevent users from printing documents labeled 'Highly Confidential' on unmanaged devices. Which DLP capability addresses this scenario?

SharePoint IRM
Endpoint DLP print restriction (Correct answer)
Conditional Access policy
Exchange transport rule

Correct answer: Endpoint DLP print restriction

Endpoint DLP can restrict print actions on managed Windows devices when sensitive content or specific sensitivity labels are detected.

Question 45: An administrator wants to apply a sensitivity label automatically to all Office documents containing the term 'Classified – Internal' in the header. Which configuration supports this scenario?

Auto-labeling policy with a keyword sensitive information type (Correct answer)
Manual label recommendation
Trainable classifier
Exact data match (EDM)

Correct answer: Auto-labeling policy with a keyword sensitive information type

An auto-labeling policy using a custom keyword as a sensitive information type will automatically classify documents containing that specific term.

Question 46: A Defender for Endpoint alert is classified as 'Informational' severity. What does this indicate?

The activity is suspicious but has low impact on the organization (Correct answer)
The alert requires immediate remediation
The alert is a false positive and can be dismissed
No further investigation is needed

Correct answer: The activity is suspicious but has low impact on the organization

Informational alerts indicate activity that may not be harmful in isolation but could be part of a larger attack pattern worth monitoring.

Question 47: During a hybrid Exchange migration, an administrator needs to ensure that on-premises users can view free/busy information for cloud mailboxes. Which feature must be configured?

Directory synchronization only
SMTP relay
Availability service federation (Correct answer)
Mail flow connectors

Correct answer: Availability service federation

The availability service federation (organization relationship) must be configured so that on-premises and cloud users can share free/busy calendar data.

Question 48: An administrator needs to deploy Defender for Endpoint to Linux servers. Which onboarding method is supported for Linux?

Group Policy Object (GPO)
Microsoft Intune MDM
Local script or Ansible/Puppet/Chef (Correct answer)
Windows Configuration Designer

Correct answer: Local script or Ansible/Puppet/Chef

Linux devices can be onboarded using a local shell script or configuration management tools like Ansible, Puppet, or Chef.

Question 49: Which Microsoft 365 admin center role allows a user to manage service health and message center posts but NOT make configuration changes?

Global Reader
Message Center Reader (Correct answer)
Helpdesk Admin
Service Support Admin

Correct answer: Message Center Reader

The Message Center Reader role grants read-only access to Message Center posts but no ability to change tenant configurations.

Question 50: When deploying Microsoft 365 Apps for enterprise, an administrator wants to use the Office Deployment Tool (ODT). What file format does the ODT use for its configuration?

INI
XML (Correct answer)
JSON
YAML

Correct answer: XML

The Office Deployment Tool uses an XML configuration file (configuration.xml) to define installation settings, update channels, and excluded applications.

Microsoft 365 Administrator (MS-102) Exam

The MS-102 exam validates expertise in deploying, configuring, and managing Microsoft 365 tenants, including identity and access, security with Microsoft Defender XDR, and compliance with Microsoft Purview.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds