MS-102 Identity & Access Management 5

Question 1

An organization wants to require MFA only when users sign in from outside the corporate network. Which Conditional Access feature is used to define the corporate network boundary?

Accepted Answer

Trusted locations / Named locations

Answer

Named locations (marked as trusted) in Conditional Access define IP ranges for the corporate network, enabling location-based policy conditions.

Question 2

What is the default behavior when a Conditional Access policy has no exclusions and targets 'All users' — does it apply to the Global Administrator account?

Accepted Answer

Yes, the policy applies to Global Administrators unless explicitly excluded

Answer

Conditional Access policies apply to all users including Global Administrators unless the admin account is explicitly added to exclusions.

Question 3

A Microsoft 365 administrator wants to enforce that users can only access Exchange Online from Outlook mobile apps with app protection policies applied. Which Conditional Access grant control achieves this?

Accepted Answer

Require approved client app + Require app protection policy

Answer

Combining 'Require approved client app' and 'Require app protection policy' controls enforces that only Intune-managed apps with protection policies can access Exchange Online.

Question 4

Which Azure AD feature can detect when a user's credentials appear in a known data breach and automatically trigger a risk event?

Accepted Answer

Azure AD Identity Protection — leaked credentials detection

Answer

Azure AD Identity Protection's leaked credentials detection compares user credentials against lists of breached credentials from dark web sources.

Question 5

An administrator needs to configure Self-Service Password Reset (SSPR) to require users to verify identity using two methods. Which setting controls the number of required authentication methods?

Accepted Answer

Authentication methods > Number of methods required to reset

Answer

In Azure AD SSPR settings, 'Number of methods required to reset' controls how many authentication methods a user must verify before resetting their password.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Identity & Access Management 5