Microsoft 365 Administrator (MS-102) Exam — Questions and Answers

Question 1: What does the 'Apply real-time URL detonation' option in Safe Attachments do?

Detonates URLs embedded within Safe Attachments-scanned files at time of click (Correct answer)
Enables Safe Links on all outbound messages
Rewrites all URLs in messages before delivery
Forces URL scanning on Teams messages

Correct answer: Detonates URLs embedded within Safe Attachments-scanned files at time of click

The real-time URL detonation option in Safe Attachments causes URLs found inside scanned attachment files to be detonated at click time for additional protection.

Question 2: An administrator notices that planned maintenance notifications for Microsoft 365 services appear in a specific admin center location. Where should they check regularly for these planned changes?

Security & Compliance Center > Alerts
Message Center (Correct answer)
Reports > Service usage
Service Health > History

Correct answer: Message Center

The Message Center in the Microsoft 365 admin center contains notifications about planned maintenance, new features, and required admin actions.

Question 3: An organization wants to prevent users from accessing known malicious IP addresses at the network level on Windows 10 devices. Which Defender for Endpoint feature should be enabled?

Controlled folder access
Attack surface reduction rules
Web content filtering
Network protection (Correct answer)

Correct answer: Network protection

Network protection extends SmartScreen to block outbound connections to malicious IP addresses and domains at the kernel level.

Question 4: An administrator needs to restrict users from changing their Microsoft 365 profile photo. Which admin center setting controls this?

SharePoint admin center > Sharing > Profile photos
Exchange admin center > User roles
Microsoft 365 admin center > Org settings > User owned apps and services
Azure AD > User settings > Users can manage their own profile photo (Correct answer)

Correct answer: Azure AD > User settings > Users can manage their own profile photo

The 'Users can manage their own profile photo' setting in Azure AD User settings controls whether users can upload or change their profile photo.

Question 5: An admin wants to export a report of all Microsoft 365 licenses assigned to users, including which licenses are unused. What is the most efficient method?

Use Microsoft Graph API to query license assignments
Check Azure Cost Management for license utilization
Download the licensing report from Microsoft 365 admin center > Billing > Licenses (Correct answer)
Run Get-MsolAccountSku in PowerShell

Correct answer: Download the licensing report from Microsoft 365 admin center > Billing > Licenses

The Billing > Licenses section in the Microsoft 365 admin center provides a clear view of assigned versus available licenses for each subscription.

Question 6: Your company wants to allow new employees to set up their passwordless authentication methods, such as the Microsoft Authenticator app or a FIDO2 key, without needing to know a password first. Which Entra ID feature is specifically designed to facilitate this initial onboarding process?

Conditional Access
Security Defaults
Self-Service Password Reset (SSPR)
Temporary Access Pass (TAP) (Correct answer)

Correct answer: Temporary Access Pass (TAP)

A Temporary Access Pass (TAP) is a time-limited passcode that can be given to a user to sign in and register their passwordless authentication methods. This is the primary method for bootstrapping passwordless credentials without needing a permanent password first.

Question 7: An organization enables Seamless SSO. Which on-premises object is created in Active Directory as part of this configuration?

An OU named SeamlessSSO
A service account named AzureADSSO
A computer account named AZUREADSSOACC (Correct answer)
A group named AzureSSO_Users

Correct answer: A computer account named AZUREADSSOACC

Azure AD Connect creates a computer account named AZUREADSSOACC in the on-premises AD to facilitate Seamless SSO Kerberos ticket issuance.

Question 8: Which DNS record type is used as the primary method to verify domain ownership when adding a custom domain to a Microsoft 365 tenant?

CNAME record pointing to autodiscover.outlook.com
A record pointing to Microsoft IP addresses
MX record pointing to Microsoft servers
TXT record with a Microsoft-provided verification string (Correct answer)

Correct answer: TXT record with a Microsoft-provided verification string

Microsoft primarily uses a TXT record with a unique verification string added at the domain registrar to confirm domain ownership before the domain can be used in the tenant.

Question 9: An organization needs to automatically apply a 'Confidential' sensitivity label to all documents stored in a specific SharePoint Online site. This label must encrypt the content and restrict access. What is the most direct method to configure this requirement in the Microsoft Purview compliance portal?

Configure a default sensitivity label directly on the document library settings within the SharePoint site.
Create a Data Loss Prevention (DLP) policy that applies to the SharePoint site and triggers on any content.
Publish the 'Confidential' sensitivity label to all users and rely on them to apply it manually.
Create an auto-labeling policy that targets the specific SharePoint site location and applies the 'Confidential' label. (Correct answer)

Correct answer: Create an auto-labeling policy that targets the specific SharePoint site location and applies the 'Confidential' label.

An auto-labeling policy is the correct tool to automatically find and apply a sensitivity label to content at rest in specific locations like a SharePoint site. [18] While a default label can be set on a library, an auto-labeling policy is more scalable and can be managed centrally for multiple sites or conditions. [3, 20] DLP policies are designed to prevent data exfiltration, not primarily for applying encryption labels to all content at rest. Manual application is not an automatic solution.

Question 10: Which configuration allows Defender for Office 365 Safe Links to track which users clicked a specific URL in a phishing campaign?

Enable 'Do not allow users to click through to the original URL' setting
Enable 'Track user clicks' in the Safe Links policy (Correct answer)
Enable user-reported message settings
Enable URL detonation intelligence sharing

Correct answer: Enable 'Track user clicks' in the Safe Links policy

The 'Track user clicks' setting in the Safe Links policy records click data, allowing administrators to see which users clicked specific URLs via Threat Explorer and URL click reports.

Question 11: A tenant administrator needs to review all changes made to tenant settings over the last 30 days. Where should they look?

Service Health dashboard
Microsoft Secure Score
Microsoft 365 Message Center
Azure AD Audit Logs (Correct answer)

Correct answer: Azure AD Audit Logs

Azure AD Audit Logs record all administrative activities including tenant configuration changes with timestamps and actor details.

Question 12: An organization using AD FS for federation wants to add Azure AD Connect Pass-Through Authentication as a fallback. What must they configure?

Install the PTA agent on the AD FS servers
Configure Azure AD Connect in staging mode with PTA
Convert the domain from Federated to Managed in Azure AD (Correct answer)
Enable PTA as an additional sign-in option alongside AD FS

Correct answer: Convert the domain from Federated to Managed in Azure AD

To switch from AD FS to Pass-Through Authentication, the domain must be converted from Federated to Managed in Azure AD using Azure AD Connect.

Question 13: Which Azure AD feature provides a time-limited, approval-based workflow for activating privileged roles?

Privileged Identity Management (PIM) (Correct answer)
Identity Protection
Conditional Access
Access Reviews

Correct answer: Privileged Identity Management (PIM)

PIM allows eligible users to activate privileged roles for a limited time with optional approval and justification requirements.

Question 14: What is the default data retention period for Defender for Endpoint raw data in the Microsoft 365 Defender portal?

365 days
30 days
180 days (Correct answer)
90 days

Correct answer: 180 days

Defender for Endpoint retains raw telemetry data for 180 days by default, giving analysts a six-month window for threat hunting and investigation.

Question 15: An administrator needs to ensure that a contractor's guest account is automatically reviewed and removed if no action is taken within 30 days. Which feature should be used?

Privileged Identity Management
Azure AD group expiration policy
Azure AD access reviews (Correct answer)
Identity Protection

Correct answer: Azure AD access reviews

Azure AD access reviews can be scheduled to periodically review guest accounts and automatically remove access if reviewers take no action.

Question 16: A company wants to prevent users in their Microsoft 365 tenant from installing add-ins for Outlook from the Office Store. What is the correct configuration path?

Azure AD > Enterprise applications > User settings
Microsoft 365 admin center > Settings > Integrated apps
Exchange admin center > Organization > Add-ins (Correct answer)
Microsoft 365 admin center > Settings > Org settings > User owned apps

Correct answer: Exchange admin center > Organization > Add-ins

Outlook add-in deployment and restrictions for end users are managed in the Exchange admin center under Organization > Add-ins.

Question 17: Which Microsoft Defender for Office 365 plan 2 feature allows security teams to investigate the full email delivery path and all recipients of a malicious message?

Anti-phishing policy
Threat Explorer (Real-time detections) (Correct answer)
Safe Attachments policy
Mail flow rules

Correct answer: Threat Explorer (Real-time detections)

Threat Explorer in Defender for Office 365 Plan 2 shows detailed email flow, delivery actions, and all recipients, enabling thorough investigation of threats.

Question 18: An administrator needs to prevent users from creating new Microsoft 365 Groups unless they belong to a specific security group. Which Azure AD setting should be configured?

Group expiration policy
Group naming policy
Dynamic membership rule
Group creation restriction (Correct answer)

Correct answer: Group creation restriction

Group creation restriction in Azure AD settings allows admins to limit Microsoft 365 Group creation to members of a designated security group.

Question 19: Which Intune policy type should be used to configure Windows Defender Antivirus settings — such as real-time protection, cloud-delivered protection, and exclusions — on managed Windows 10/11 devices?

Device configuration – Device restrictions profile
Endpoint security – Antivirus policy (Correct answer)
Device compliance policy
Windows Update for Business policy

Correct answer: Endpoint security – Antivirus policy

Endpoint security Antivirus policies in Intune provide a dedicated interface for configuring Windows Defender Antivirus settings, separate from broader device configuration profiles.

Question 20: An auto-labeling policy is configured to label emails containing Social Security Numbers as 'Sensitive PII.' In simulation mode, what does the admin see?

Labels are applied immediately to matching content
Content is quarantined for review
A report showing what would be labeled without actually applying labels (Correct answer)
Users receive notifications about pending labels

Correct answer: A report showing what would be labeled without actually applying labels

Simulation mode for auto-labeling shows administrators a preview of which items would be labeled, without making any actual changes.

Question 21: A company must prevent users from printing documents labeled 'Highly Confidential' on unmanaged devices. Which DLP capability addresses this scenario?

SharePoint IRM
Conditional Access policy
Endpoint DLP print restriction (Correct answer)
Exchange transport rule

Correct answer: Endpoint DLP print restriction

Endpoint DLP can restrict print actions on managed Windows devices when sensitive content or specific sensitivity labels are detected.

Question 22: Which Microsoft 365 admin center section displays the organization's current Microsoft Secure Score and provides actionable improvement recommendations?

Compliance Manager > Score
Microsoft 365 Defender > Secure Score (Correct answer)
Microsoft 365 admin center > Health > Secure Score
Reports > Usage

Correct answer: Microsoft 365 Defender > Secure Score

Microsoft Secure Score is found in the Microsoft 365 Defender portal, where it shows the current score and provides prioritized security improvement actions.

Question 23: An administrator needs to customize an attribute flow for user objects being synchronized to Microsoft Entra ID. To ensure the changes are not overwritten during a future Microsoft Entra Connect upgrade, what is the recommended practice?

Directly edit the default 'In from AD - User Common' rule.
Clone the default rule, disable the original, and give the new rule a precedence value less than 100. (Correct answer)
Disable the default rule and create a new custom rule from scratch.
Export the default rule, modify it, and re-import it with the same precedence.

Correct answer: Clone the default rule, disable the original, and give the new rule a precedence value less than 100.

The best practice for customizing default synchronization rules is to clone the existing rule, disable the original default rule, and then modify the cloned rule. The new custom rule should be given a high precedence (a lower numeric value, typically between 1-99) to ensure it is processed before other rules. This prevents the custom changes from being overwritten when Microsoft Entra Connect is upgraded.

Question 24: Which role-based access control (RBAC) permission is required in Microsoft 365 Defender to approve or reject pending remediation actions in the Action center?

Compliance Administrator
Active remediation actions permission (Correct answer)
Global Reader
Security Reader

Correct answer: Active remediation actions permission

The 'Active remediation actions' permission within Defender for Endpoint RBAC allows users to approve or reject pending automated investigation actions.

Question 25: An administrator is creating a custom Sensitive Information Type (SIT) to detect a unique internal project code with the format 'PROJ-' followed by exactly six digits (e.g., PROJ-123456). Which of the following should be used as the primary element to define this specific pattern?

A keyword dictionary
A regular expression (Correct answer)
A document fingerprint
A trainable classifier

Correct answer: A regular expression

A regular expression (regex) is the ideal primary element for defining a specific, repeatable pattern like 'PROJ-' followed by six digits. A regex such as `PROJ-\d{6}` would accurately match this format. A keyword dictionary is impractical for a large number of unique codes, a document fingerprint detects entire forms, and a trainable classifier is for less-structured data.

Question 26: An admin receives a Microsoft 365 Message Center notification about a planned feature change. What action should the admin take to prevent the change from rolling out to users immediately?

Disable the feature in the Security & Compliance center
Use the 'Targeted release' option for a limited group first (Correct answer)
Set the tenant to 'Standard release' channel
Open a support ticket to block the change

Correct answer: Use the 'Targeted release' option for a limited group first

Configuring Targeted release allows the admin to test changes with a subset of users before broader rollout, providing time to prepare.

Question 27: A user successfully completes MFA but is still blocked by a Conditional Access policy. What should the administrator check first in the sign-in logs?

The Conditional Access tab in sign-in logs to review which policy applied and why (Correct answer)
The user's group membership in Azure AD
The user's MFA registration status in the Authentication methods blade
The device compliance status in the Intune admin center

Correct answer: The Conditional Access tab in sign-in logs to review which policy applied and why

The Conditional Access tab in Azure AD sign-in logs shows each policy that was evaluated, its result, and the reason for any block.

Question 28: What does the Intune 'Retire' remote action do to a managed device?

Wipes the device to factory settings and removes it from Azure AD
Removes only the Intune Management Extension from the device
Locks the device remotely until the user enters a PIN
Removes corporate data and unenrolls the device while leaving personal data intact (Correct answer)

Correct answer: Removes corporate data and unenrolls the device while leaving personal data intact

Retire removes company-managed apps, email profiles, certificates, and Intune enrollment from the device while leaving personal data and apps untouched, making it ideal for BYOD offboarding.

Question 29: An administrator is deploying Microsoft 365 Apps using Microsoft Intune. Which deployment model allows apps to be installed without user interaction?

Uninstall
Available
Required (Correct answer)
User-initiated

Correct answer: Required

Setting the app assignment to 'Required' in Intune causes the app to install automatically without requiring user interaction.

Question 30: An organization wants to ensure that emails failing SPF, DKIM, or DMARC checks are automatically moved to quarantine. Which policy controls this behavior?

Safe Links policy
Safe Attachments policy
Anti-phishing policy with spoof intelligence settings (Correct answer)
Anti-spam inbound policy with bulk complaint level threshold

Correct answer: Anti-phishing policy with spoof intelligence settings

The anti-phishing policy's spoof intelligence settings control how messages that fail composite authentication (SPF/DKIM/DMARC) are handled, including moving them to quarantine.

Question 31: An administrator wants to customize the look and feel of the Microsoft 365 navigation bar for all users by adding the company logo and changing the color scheme to match corporate branding. Which setting should be configured?

Microsoft 365 admin center > Reports > Usage
Azure AD > Company branding
Microsoft 365 admin center > Settings > Org settings > Custom themes (Correct answer)
Microsoft 365 admin center > Settings > Domains

Correct answer: Microsoft 365 admin center > Settings > Org settings > Custom themes

Within the Microsoft 365 admin center, the 'Custom themes' option under 'Org settings' and the 'Organization profile' tab allows an administrator to set a default theme that includes a custom logo, navigation bar color, and other visual elements for all users in the organization.

Question 32: A user reports they cannot activate their PIM-eligible Global Administrator role. The activation requires MFA, but the user skipped MFA registration. What should the administrator do first?

Remove MFA requirement from the PIM role setting
Assign a different admin to complete the task
Grant the role as a permanent assignment temporarily
Require the user to complete MFA registration in My Security Info (Correct answer)

Correct answer: Require the user to complete MFA registration in My Security Info

The user must first register MFA methods at My Security Info before they can satisfy the MFA requirement during PIM role activation.

Question 33: What is the default behavior when a Conditional Access policy has no exclusions and targets 'All users' — does it apply to the Global Administrator account?

No, Global Administrators are always excluded from Conditional Access
Only if the administrator is signing in from outside the tenant
Yes, the policy applies to Global Administrators unless explicitly excluded (Correct answer)
Only if the policy uses a block control, not grant controls

Correct answer: Yes, the policy applies to Global Administrators unless explicitly excluded

Conditional Access policies apply to all users including Global Administrators unless the admin account is explicitly added to exclusions.

Question 34: Which Microsoft Purview capability scans on-premises file shares and SharePoint Server repositories to identify and label sensitive data?

Microsoft Purview Information Protection scanner (Correct answer)
Microsoft Defender for Endpoint
Endpoint DLP
Microsoft Compliance Manager

Correct answer: Microsoft Purview Information Protection scanner

The Microsoft Purview Information Protection scanner is an on-premises agent that discovers, classifies, and labels files in local repositories.

Question 35: Which feature in Microsoft Purview allows organizations to place a legal hold on a user's mailbox to preserve all content indefinitely?

Inactive mailbox
Litigation hold (Correct answer)
MRM policy
Retention label

Correct answer: Litigation hold

Litigation hold preserves all mailbox content for an indefinitely period, preventing deletion or modification of items.

Question 36: An administrator wants to ensure that the Conditional Access policy does not lock out break-glass accounts during an authentication incident. What is the recommended approach?

Set sign-in frequency to 'Every time' for break-glass accounts
Configure break-glass accounts with a compliant device requirement
Enable the policy in report-only mode for break-glass accounts
Assign break-glass accounts to a group excluded from all Conditional Access policies (Correct answer)

Correct answer: Assign break-glass accounts to a group excluded from all Conditional Access policies

Break-glass (emergency access) accounts should be excluded from all Conditional Access policies to ensure administrative access during incidents.

Question 37: Which Microsoft 365 license feature allows an organization to store and apply the organization's branding on the Azure AD sign-in page?

Microsoft 365 E3 — Company Branding in Azure AD (Correct answer)
Azure AD Free — Default branding
Microsoft 365 Business Basic — Custom themes
Microsoft 365 F1 — Custom domains only

Correct answer: Microsoft 365 E3 — Company Branding in Azure AD

Company Branding in Azure AD, available with paid licenses including Microsoft 365 E3, allows organizations to customize the sign-in experience with logos and backgrounds.

Question 38: An administrator wants to ensure that only licensed users can be assigned the Teams Administrator role. Where is role assignability controlled in Azure AD?

Microsoft 365 admin center > Billing > Licenses
Azure AD > Conditional Access > Assignments
Azure AD > Roles and administrators > Role settings (Correct answer)
Azure AD > Identity Governance > Access packages

Correct answer: Azure AD > Roles and administrators > Role settings

Role settings in Azure AD Roles and administrators control eligibility, activation requirements, and assignment rules for each role.

Question 39: Which Android Enterprise enrollment mode in Intune provides the highest level of corporate management, including full device wipe, and is designed for corporate-owned devices used exclusively for work?

Android device administrator (legacy)
Personally-owned work profile
Fully managed (COBO) (Correct answer)
Corporate-owned work profile

Correct answer: Fully managed (COBO)

Android Enterprise fully managed (COBO — Corporate Owned, Business Only) provides complete device control, including full wipe, and is designed for devices used solely for corporate purposes.

Question 40: A user reports that clicking a URL in an Outlook desktop client is not being checked by Safe Links. Which setting must be enabled in the Safe Links policy?

Apply Safe Links to supported Office apps (Correct answer)
Enable click-through protection
Apply Safe Links to Microsoft Teams
Apply Safe Links to email messages

Correct answer: Apply Safe Links to supported Office apps

The 'Apply Safe Links to supported Office apps' setting must be enabled to protect URLs clicked within Office desktop applications like Word, Excel, and Outlook.

Question 41: Which endpoint DLP setting controls whether users can copy sensitive content detected on a managed device to a USB drive?

Restricted app and browser group
Unallowed removable storage device (Correct answer)
Sensitive service domain restriction
Endpoint DLP audit activity

Correct answer: Unallowed removable storage device

The 'Unallowed removable storage device' setting in endpoint DLP blocks or audits attempts to copy sensitive content to USB or other removable media.

Question 42: Which Microsoft 365 Defender feature provides a unified view correlating alerts from Defender for Endpoint, Defender for Identity, and Defender for Office 365 into a single incident?

Threat analytics
Microsoft Secure Score
Action center
Incidents queue (Correct answer)

Correct answer: Incidents queue

The incidents queue in Microsoft 365 Defender automatically correlates related alerts from multiple Defender products into a single incident for unified investigation.

Question 43: Which policy in Defender for Office 365 protects users from emails that impersonate a specific trusted domain by analyzing the sender's domain against a list of protected domains?

DMARC enforcement policy
Safe Attachments policy with dynamic delivery
Anti-spam policy with domain block list
Anti-phishing policy with domain impersonation protection (Correct answer)

Correct answer: Anti-phishing policy with domain impersonation protection

The anti-phishing policy's domain impersonation protection feature checks inbound sender domains against a configured list of protected domains and takes action when lookalike domains are detected.

Question 44: An administrator has configured a quarantine policy to allow users to release messages that were quarantined as 'Spam'. However, users report they cannot release messages that were quarantined because of a 'Malware' verdict from a Safe Attachments policy. What is the reason for this behavior?

Users must be assigned the 'Security Reader' role to release messages quarantined as malware.
The global quarantine notification setting has been disabled by the administrator.
By design, users can never release messages quarantined as malware or high-confidence phishing, regardless of quarantine policy permissions. (Correct answer)
The quarantine policy has not been applied to the Safe Attachments policy correctly.

Correct answer: By design, users can never release messages quarantined as malware or high-confidence phishing, regardless of quarantine policy permissions.

Microsoft Defender for Office 365 has a built-in security control that prevents end-users from releasing certain high-risk message types from quarantine themselves. Messages classified as malware or high-confidence phishing can only be managed by administrators. Even if a quarantine policy grants users release permissions, for these specific threat types, the user will only be able to request release, not perform the release directly.

Question 45: An administrator notices that Safe Links is not rewriting URLs in emails sent between internal users. What is the most likely cause?

The MX record is not pointing to Exchange Online
The anti-spam policy is blocking Safe Links processing
Safe Links does not support internal email scanning by default and requires enabling 'Apply Safe Links to email sent within the organization' (Correct answer)
The Safe Links policy is scoped only to external recipients

Correct answer: Safe Links does not support internal email scanning by default and requires enabling 'Apply Safe Links to email sent within the organization'

Safe Links must be explicitly configured to scan internal email by enabling the 'Apply Safe Links to email sent within the organization' setting in the policy.

Question 46: A company is piloting passwordless authentication using FIDO2 security keys. Where in the Microsoft Entra admin center should the administrator enable this authentication method?

Security defaults settings
Identity Protection policies
Conditional Access policies
Authentication methods policy (Correct answer)

Correct answer: Authentication methods policy

FIDO2 security key support is enabled under Authentication Methods Policy in the Entra ID admin center, allowing granular targeting to specific user groups.

Question 47: Which Microsoft 365 Defender portal feature provides a unified view of incidents across endpoints, email, and identities?

Microsoft Secure Score
Attack Simulator
Incidents & Alerts queue (Correct answer)
Threat Analytics

Correct answer: Incidents & Alerts queue

The Incidents & Alerts queue in Microsoft 365 Defender correlates alerts across all workloads into unified incidents.

Question 48: An administrator needs to review all content searches and eDiscovery cases in Microsoft Purview. Which role group must they be a member of?

Security Operator
Compliance Administrator
Global Reader
eDiscovery Manager (Correct answer)

Correct answer: eDiscovery Manager

The eDiscovery Manager role group allows members to create and manage eDiscovery cases and run content searches in Microsoft Purview.

Question 49: A Conditional Access policy requires MFA for all cloud apps, but an administrator needs to exempt the Microsoft Intune Enrollment app. What is the correct configuration?

Add the Intune Enrollment app to the trusted locations list
Exclude Microsoft Intune Enrollment from the cloud apps assignment (Correct answer)
Configure a separate policy with block access for Intune Enrollment
Set the device platform condition to exclude Windows

Correct answer: Exclude Microsoft Intune Enrollment from the cloud apps assignment

Excluding Microsoft Intune Enrollment from the cloud apps assignment prevents the MFA requirement from applying during the device enrollment process.

Question 50: An administrator wants Conditional Access to evaluate every request continuously, not just at initial sign-in. Which feature enables this capability?

Sign-in frequency set to 1 hour
Azure AD Identity Protection user risk policy
Continuous Access Evaluation (CAE) (Correct answer)
Persistent browser session disabled

Correct answer: Continuous Access Evaluation (CAE)

Continuous Access Evaluation (CAE) enables near-real-time enforcement of policy changes and revocations without waiting for the token to expire.

Microsoft 365 Administrator (MS-102) Exam

The MS-102 exam validates expertise in deploying, configuring, and managing Microsoft 365 tenants, including identity and access, security with Microsoft Defender XDR, and compliance with Microsoft Purview.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds