Microsoft 365 Administrator Expert Managing Entra ID Authentication Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Entra ID Authentication flashcards as text
An administrator wants to block legacy authentication protocols across the tenant to reduce attack surface. Which is the most straightforward method to accomplish this?
Answer: Create a Conditional Access policy targeting legacy authentication client apps
A Conditional Access policy that targets the 'Other clients' and legacy authentication app types and blocks access is the recommended granular approach for blocking legacy protocols.
A global administrator notices a spike in Entra ID Identity Protection risk detections labeled 'Atypical travel.' What does this detection indicate?
Answer: Two sign-ins occurred from geographically distant locations within an impossible timeframe
Atypical travel detection flags sign-ins from two locations that could not be physically reached within the time elapsed between them, suggesting account compromise.
Which Entra ID feature allows administrators to require users to re-verify their identity after a set number of hours, even if they have a valid session token?
Answer: Sign-in frequency Conditional Access control
The Sign-in Frequency control in Conditional Access forces reauthentication after a configurable time interval, overriding persistent session tokens.
An administrator is configuring Entra ID self-service password reset (SSPR). The organization requires users to verify identity with two methods. Which combination is NOT a valid SSPR authentication method?
Answer: Manager approval and backup email
Manager approval is not a supported SSPR authentication method; supported methods include phone, email, authenticator app, security questions, and OATH tokens.
A company uses AD FS for federated authentication. The administrator wants to migrate to Entra ID cloud authentication without disrupting users. Which migration approach allows gradual rollout by user group?
Answer: Staged Rollout feature
The Staged Rollout feature in Entra ID Connect allows selective migration of specific groups from AD FS to PHS or PTA while the rest of the tenant remains federated.
Which Entra ID audit log category would an administrator review to track changes to Conditional Access policies?
Answer: AuditLogs with category 'Policy'
Changes to Conditional Access policies are recorded in AuditLogs under the 'Policy' category, capturing who made changes and what was modified.
An administrator configures an Authentication Strength policy in Conditional Access requiring phishing-resistant MFA. Which method satisfies this requirement?
Answer: FIDO2 security key
FIDO2 security keys are classified as phishing-resistant because they use cryptographic attestation tied to the specific relying party, preventing credential interception.