Mixed Deck — All MS-102 Topics Flashcards

Which Defender for Office 365 feature provides a detonation-based analysis of email attachments in an isolated environment before delivery?

Answer: Safe Attachments

Safe Attachments detonates suspicious attachments in a sandboxed virtual environment to detect malware before the email is delivered to the recipient.

What is the purpose of the 'Live Response' feature in Microsoft Defender for Endpoint?

Answer: Provide a remote shell session to investigate and remediate a device in real time

Live Response gives security analysts a remote shell connection to a device, allowing them to run commands, collect files, and remediate threats interactively.

What is 'co-management' in the context of Microsoft Intune and Microsoft Endpoint Configuration Manager (MECM)?

Answer: Sharing device management workloads between Configuration Manager and Intune simultaneously

Co-management connects existing ConfigMgr-managed Windows devices to Intune and allows organizations to progressively shift specific management workloads (e.g., Compliance, Device Configuration) from on-premises ConfigMgr to cloud-based Intune.

An organization has synchronized on-premises Active Directory users to Azure AD using Azure AD Connect. A user's account is disabled in on-premises AD. What happens to the Azure AD account?

Answer: The Azure AD account is disabled on the next synchronization cycle

Azure AD Connect synchronizes account state changes, so the Azure AD account will be disabled after the next sync cycle (default every 30 minutes).

Which role is required to create and manage DLP policies in the Microsoft Purview compliance portal?

Answer: DLP Compliance Management

The DLP Compliance Management role grants permissions to create, edit, and manage DLP policies in the Microsoft Purview compliance portal.

An administrator must ensure that all Microsoft 365 license assignments are removed when a user account is deleted. Which behavior is correct by default?

Answer: Licenses remain assigned to the deleted user account for 30 days then are reclaimed

When a user is deleted in Microsoft 365, the account enters a soft-delete state for 30 days, during which the license remains consumed; the license is reclaimed after the 30-day retention period.

A Microsoft 365 administrator wants to allow partner organizations to manage specific aspects of the tenant. Which feature enables this delegation?

Answer: Delegated Administration (GDAP or DAP) via Partner Center

Delegated Administration Privileges (DAP or Granular DAP/GDAP) through the Microsoft Partner Center allows partner organizations to administer specific tenant functions on behalf of the customer.

A Conditional Access policy targets 'All guest and external users'. Which user type is included by this assignment?

Answer: B2B collaboration guest users invited to the tenant

'All guest and external users' targets B2B collaboration users who have been invited to and have accounts in the Azure AD tenant.

A Conditional Access policy uses the 'All users' assignment. Which user type is NOT included by default?

Answer: Service principals

Service principals (workload identities) are not covered by user-based Conditional Access policies and require separate workload identity policies.

When an administrator performs a 'Fresh Start' remote action on a Windows 10/11 device in Intune, what is the outcome?

Answer: Windows is reinstalled, OEM pre-installed apps are removed, and user data can optionally be retained

Fresh Start reinstalls a clean version of Windows 10/11, removes OEM bloatware, and gives the administrator the option to keep the user's personal files while ensuring a clean OS state.

Which Microsoft 365 admin center page allows an administrator to configure the default time zone and language for the entire tenant?

Answer: Settings > Org settings > Organization profile

The Organization profile page under Settings > Org settings in the Microsoft 365 admin center allows configuration of the tenant's default name, address, phone, language, and time zone.

An administrator needs to deploy Defender for Endpoint to Linux servers. Which onboarding method is supported for Linux?

Answer: Local script or Ansible/Puppet/Chef

Linux devices can be onboarded using a local shell script or configuration management tools like Ansible, Puppet, or Chef.

A Defender for Office 365 alert fires indicating that a user clicked a malicious URL. Which AIR playbook is automatically triggered in response?

Answer: URL click verdict changed to malicious playbook

When a user clicks a URL that is later determined to be malicious, the 'URL click verdict changed to malicious' AIR playbook automatically investigates the click and associated emails.

A Microsoft 365 administrator needs to ensure that users can sign in only from devices that are joined to Azure AD. Which Conditional Access condition should be configured?

Answer: Require Hybrid Azure AD joined device

The 'Require Hybrid Azure AD joined device' grant control restricts access to devices that are joined to both on-premises AD and Azure AD.

An organization uses authentication strength in Conditional Access to require phishing-resistant MFA for privileged administrators. Which method satisfies this requirement?

Answer: FIDO2 security key

FIDO2 security keys meet the phishing-resistant MFA authentication strength requirement because they are bound to the origin and cannot be phished.

Which Microsoft Defender for Office 365 plan 2 feature allows security teams to investigate the full email delivery path and all recipients of a malicious message?

Answer: Threat Explorer (Real-time detections)

Threat Explorer in Defender for Office 365 Plan 2 shows detailed email flow, delivery actions, and all recipients, enabling thorough investigation of threats.

An administrator needs to ensure that a contractor's guest account is automatically reviewed and removed if no action is taken within 30 days. Which feature should be used?

Answer: Azure AD access reviews

Azure AD access reviews can be scheduled to periodically review guest accounts and automatically remove access if reviewers take no action.

Your company has acquired another organization, and you are planning a tenant-to-tenant migration. Which of the following is a critical pre-migration step to ensure a smooth transition for users?

Answer: Provision and pre-instantiate user accounts in the target tenant.

A key best practice in tenant-to-tenant migrations is to pre-instantiate (create) user accounts in the target tenant before moving data. This ensures that when data is migrated, it has an owner, which helps maintain proper access controls and permissions from the start.

An administrator is configuring Entra ID self-service password reset (SSPR). The organization requires users to verify identity with two methods. Which combination is NOT a valid SSPR authentication method?

Answer: Manager approval and backup email

Manager approval is not a supported SSPR authentication method; supported methods include phone, email, authenticator app, security questions, and OATH tokens.

An administrator configures a retention label with 'Trigger retention based on an event.' Which scenario best represents an event-based retention use case?

Answer: Retain employee HR records for 5 years from the employee's termination date

Event-based retention starts the retention clock when a specific business event occurs, such as employee termination, making it ideal for HR records tied to lifecycle events.