Practice Test Geeks(MS-102) Microsoft 365 Administrator Expert Practice Test
← All MS-102 Flashcard Decks

Security & Compliance Flashcards

7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Security & Compliance flashcards as text

  1. Which Microsoft 365 feature allows an admin to query raw event data across endpoints, emails, and identities using Kusto Query Language (KQL)?

    Answer: Advanced Hunting

    Advanced Hunting in Microsoft 365 Defender uses KQL to query up to 30 days of raw telemetry across all protected workloads.

  2. An admin wants to ensure that high-risk sign-ins require additional verification automatically. Which Azure AD feature should be configured?

    Answer: Identity Protection risk-based Conditional Access policy

    Azure AD Identity Protection can evaluate sign-in risk level and trigger Conditional Access policies requiring MFA or blocking access for high-risk logins.

  3. What is the function of Microsoft Purview Compliance Manager?

    Answer: Provides risk assessments and improvement actions for regulatory compliance

    Compliance Manager assesses the tenant against regulatory frameworks and provides a compliance score with actionable improvement recommendations.

  4. A Microsoft 365 admin receives an alert that a user account may be compromised. Which Microsoft 365 Defender action can directly force a password reset and revoke sessions?

    Answer: Remediate user via Identity investigation actions

    In Microsoft 365 Defender, identity investigation actions allow admins to force password resets and revoke active sessions for compromised accounts.

  5. Which Microsoft Purview capability monitors employee emails and Teams messages for policy violations such as harassment or regulatory misconduct?

    Answer: Communication Compliance

    Communication Compliance reviews messages against configured policies to detect inappropriate language, sensitive data sharing, or regulatory violations.

  6. An admin needs to prevent external sharing of files labeled 'Confidential' in SharePoint. Which combination of features achieves this?

    Answer: Sensitivity label with encryption + DLP policy

    Sensitivity labels with encryption restrict who can access labeled files, while DLP policies can block external sharing of labeled content.

  7. Which Microsoft Defender for Office 365 plan 2 feature allows security teams to investigate the full email delivery path and all recipients of a malicious message?

    Answer: Threat Explorer (Real-time detections)

    Threat Explorer in Defender for Office 365 Plan 2 shows detailed email flow, delivery actions, and all recipients, enabling thorough investigation of threats.