HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You need to implement Microsoft Entra ID protection. The solution must meet the following requirements: Identify when a user's credentials are compromised and shared on the dark web.Provide users that have compromised credentials with the ability to self-remediate.What should you do? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: A user risk policyIdentify when a user's credentials are compromised and shared on the dark web.User risk-based Conditional Access policyIdentity Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user has been compromised. If a user has risky sign-in behavior, or their credentials have been leaked, Identity Protection will use these signals to calculate the user risk level. Administrators can configure user risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as:Block accessAllow access but require a secure password change.A secure password change will remediate the user risk and close the risky user event to prevent unnecessary noise for administrators.Box 2: Require password changeProvide users that have compromised credentials with the ability to self-remediate.A secure password change will remediate the user risk and close the risky user event to prevent unnecessary noise for administrators
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection- policies#user-risk-based-conditional-access-policy
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory domain and a Microsoft 365 subscription. The domain contains the users shown in the following table.The domain contains the groups shown in the following table.You are deploying Microsoft Entra Connect.You configure Domain and OU filtering as shown in the following exhibit.You configure Filter users and devices as shown in the following exhibit.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
https://azurecloudai.blog/2019/11/07/field-notes-azure-active-directory-group-filtering-gotchas/
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains the users shown in the following table.You configure the Microsoft Authenticator authentication method policy to enable passwordless authentication as shown in the following exhibit.Both User1 and User2 report that they are NOT prompted for passwordless sign-in in the Microsoft Authenticator app.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: YesUser1 is member of Group1.User1 has MFA registered method of Microsoft Authenticater app (push notification)The Microsoft Authenticator authentication method policy is configured for Group1, registration is optional, authentication method is any.Note: Microsoft Authenticator can be used to sign in to any Microsoft Entra account without using a password. Microsoft Authenticator uses key-based authentication to enable a user credential that is tied to a device, where the device uses a PIN or biometric. Windows Hello for Business uses a similar technology.This authentication technology can be used on any device platform, including mobile. This technology can also be used with any app or website that integrates with Microsoft Authentication Libraries.Box 2: NoUser2 is member of Group2.The Microsoft Authenticator authentication method policy is configured for Group1, not for Group2.Box 3: NoUser3 is member of Group1.User3 has no MFA method registered.User3 must choose an authentication method.Note: Enable passwordless phone sign-in authentication methodsMicrosoft Entra lets you choose which authentication methods can be used during the sign-in process. Users then register for the methods they'd like to use.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-phone
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.The domain syncs to a Microsoft Entra tenant named contoso.com as shown in the exhibit. (Click the Exhibit tab.)User2 fails to authenticate to the Microsoft Entra when signing in as user2@fabrikam.com. You need to ensure that User2 can access the resources in Microsoft Entra ID.Solution: From the Microsoft Entra admin center, you assign User2 the Security Reader role. You instructUser2 to sign in as user2@contoso.com. Does this meet the goal?
Answer(s): B
This is not a permissions issue so you do not need to assign the Security Reader role.The on-premises Active Directory domain is named contoso.com. User2 could sign on as user2@contoso.com but you would first need to change the UPN of User2 to user2@contoso.com.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.The domain syncs to a Microsoft Entra tenant named contoso.com as shown in the exhibit. (Click the Exhibit tab.)User2 fails to authenticate to the Microsoft Entra when signing in as user2@fabrikam.com. You need to ensure that User2 can access the resources in Microsoft Entra ID.Solution: From the on-premises Active Directory domain, you set the UPN suffix for User2 to @contoso.com. You instruct User2 to sign in as user2@contoso.com.Does this meet the goal?
The on-premises Active Directory domain is named contoso.com. You can enable users to sign on using a different UPN (different domain), by adding the domain to Microsoft 365 as a custom domain. Alternatively, you can configure the user account to use the existing domain (contoso.com).
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.