You have a Microsoft 365 E5 subscription that contains the users shown in the following table.You plan to create a Conditional Access policy that will use GPS-based named locations. Which users can the policy protect?
Answer(s): C
If you select Determine location by GPS coordinates, the user needs to have the Microsoft Authenticator app installed on their mobile device. Every hour, the system contacts the user’s Microsoft Authenticator app to collect the GPS location of the user’s mobile device.Incorrect:Not User2: GPS location doesn't work with passwordless authentication methods.Not User3, User4: If you select Determine location by GPS coordinates, the user needs to have the Microsoft Authenticator app installed on their mobile deviceNote: Using the location condition in a Conditional Access policyThe location found using the public IP address a client provides to Microsoft Entra ID or GPS coordinates provided by the Microsoft Authenticator app.Named locationsLocations exist in the Azure portal under Microsoft Entra ID > Security > Conditional Access > Named locations. These named network locations may include locations like an organization's headquarters network ranges, VPN network ranges, or ranges that you wish to block. Named locations are defined by IPv4 and IPv6 address ranges or by countries/regions.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains the users shown in the following table.You enable self-service password reset (SSPR) for Group1. You configure security questions as the only authentication method for SSPR.Which users can use SSPR, and which users must answer security questions to reset their password? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: User1, User2, and User4 only User1 and User2 are in Group1.User4 is Global Administrator. Box 2: User1 and User2 onlyNot User4:I configured my policy to require users to use security questions for reset, but the Azure administrators seem to be configured differently.This is the expected behavior. Microsoft enforces a strong default two-gate password reset policy for any Azure administrator role. This prevents administrators from using security questions.
https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/let-users-reset-passwords https://learn.microsoft.com/en-us/azure/active-directory/authentication/passwords-faq
Your network contains an Active Directory forest named contoso.local. You have a Microsoft 365 subscription.You plan to implement a directory synchronization solution that will use password hash synchronization. From the Microsoft 365 admin center, you successfully verify the contoso.com domain name.You need to prepare the environment for the planned directory synchronization solution. What should you do first?
The on-premise Active Directory domain is named contoso.local. Therefore, all the domain users accounts will have a UPN suffix of contoso.local by default.To enable directory synchronization that will use password hash synchronization, you need to configure the domain user accounts to have the same UPN suffix as the verified domain (contoso.com in this case). Before you can change the UPN suffix of the domain user accounts to contoso.com, you need to add contoso.com as a UPN suffix in the domain.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-userprincipalname
You have a Microsoft 365 E5 subscription.On Monday, you create a new user named User1.On Tuesday, User1 signs in for the first time and perform the following actions:Signs in to Microsoft Exchange Online from an anonymous IP address. Signs in to Microsoft SharePoint Online from a device in New York City.Establishes Remote Desktop connections to hosts in Berlin and Hong Kong, and then signs in to SharePoint Online from the Remote Desktop connections.Which types of sign-in risks will Microsoft Entra ID Protection detect for User1?
Answer(s): B
Incorrect:Not A, Not C, not E:Atypical travelCalculated offline. This risk detection type identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. The algorithm takes into account multiple factors including the time between the two sign-ins and the time it would have taken for the user to travel from the first location to the second. This risk may indicate that a different user is using the same credentials.The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.Not C, not E:Unfamiliar sign-in propertiesCalculated in real-time. This risk detection type considers past sign-in history to look for anomalous sign-ins. The system stores information about previous sign-ins, and triggers a risk detection when a sign-in occurs with properties that are unfamiliar to the user. These properties can include IP, ASN, location, device, browser, and tenant IP subnet. Newly created users are in "learning mode" period where the unfamiliar sign-in properties risk detection is turned off while our algorithms learn the user's behavior. The learning mode duration is dynamic and depends on how much time it takes the algorithm to gather enough information about the user's sign-in patterns. The minimum duration is five days. A user can go back into learning mode after a long period of inactivity.
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription that contains the users shown in the following table.You have the named locations shown in the following table.You create a conditional access policy that has the following configurations: Users:- Include: Group1Exclude: Group2Target resources: Include all cloud apps Conditions:- Include: Any location- Exclude: MontrealAccess control: Grant access, Require multi-factor authentication User1 is on the multi-factor authentication (MFA) blocked users list.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
The Blocked User list is used to block specific users from being able to receive Multi-Factor Authentication requests. Any authentication attempts for blocked users are automatically denied. Users remain blocked for 90 days from the time that they are blocked.Box 1: Yes133.107.10.20 is in the Montreal named location. The conditional access policy excludes Montreal so the policy does not apply. Therefore, User1 can access Microsoft Office 365.Box 2: No193.77.10.15 is in the Toronto named location. The conditional access policy applies to Group1 which User1 is a member of and all locations except for Montreal. Therefore, the conditional access policy applies in this case. The policy requires MFA but User1 is on the MFA blocked list so he is unable to use MFA. Therefore, User1 cannot access Microsoft 365.Box 3: YesUser2 is in Group1 and Group2. The conditional access policy applies to Group1 but excludes Group2. Therefore, the conditional access policy does not apply in this case so User2 can access Microsoft Office 365.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.