HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains the users shown in the following table.Each user has an Android device with the Microsoft Authenticator app installed and has set up phone sign-in. The subscription has the following Conditional Access policy:Name: Policy1 AssignmentsUsers and groups: Group1, Group2Cloud apps or actions: All cloud apps Access controls- Grant: Require multi-factor authentication Enable policy: OnFrom Microsoft Authenticator settings for the subscription, the Enable and Target settings are configured as shown in the exhibit. (Click the Exhibit tab.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: YesUser1 is member of Group1.User1 is setup for Microsoft Authenticator app. Policy1 is assigned to Group1.Authentication mode for Group1 is Passwordless.Box 2: NoUser2 is member of Group2.User2 is setup for Microsoft Authenticator app. Policy1 is assigned to Group2.Authentication mode for Group2 is Passwordless.Box 3: NoUser3 is not setup for the Microsoft Authenticator app.Note: How number matching works in multifactor authentication (MFA) push notifications for Authenticator - Authentication methods policyThis topic covers how number matching in Microsoft Authenticator push notifications improves user sign-in security. Number matching is a key security upgrade to traditional second factor notifications in Authenticator.Beginning May 8, 2023, number matching is enabled for all Authenticator push notifications. As relevant services deploy, users worldwide who are enabled for Authenticator push notifications will begin to see number matching in their approval requests. Users can be enabled for Authenticator push notifications either in the Authentication methods policy or the legacy multifactor authentication policy if Notifications through mobile app is enabledNote 2: Microsoft offers the following three passwordless authentication options that integrate with Microsoft Entra ID:Microsoft Authenticator - turns any iOS or Android phone into a strong, passwordless credential by allowing users to sign into any platform or browser.FIDO2-compliant security keys - useful for users who sign in to shared machines like kiosks, in situations where use of phones is restricted, and for highly privileged identities.Windows Hello for Business
https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless- deployment
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription that uses a Microsoft Entra tenant named contoso.com. The tenant contains the users shown in the following table.From the Sign-ins blade of the Microsoft Entra admin center, for which users can User1 and User2 view the sign-ins? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: User1, User2, User3 and User4 Who can access the activity reports data?Users in the Security Administrator, Security Reader, Global Reader, and Report Reader roles Global AdministratorsAny user (non-admins) can access their own sign-ins Box 2: User1 and User2 only
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins
You have a Microsoft 365 subscription that contains a Microsoft Entra tenant named contoso.com. Corporate policy states that user passwords must not include the word Contoso.What should you do to implement the corporate policy?
Answer(s): B
The Password protection settings allows you to specify a banned password list of phrases that users cannot use as part of their passwords.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises- operationshttps://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-configure https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad#custom- banned-password-list
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your network contains an Active Directory forest. You deploy Microsoft 365.You plan to implement directory synchronization.You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.User passwords must be 10 characters or more.Solution: Implement pass-through authentication and modify the password settings from the Default Domain Policy in Active Directory.Does this meet the goal?
This solution does not meet the following requirement:Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.This is because with pass-through authentication, the authentication is performed by the on-premise Active Directory.This solution does meet the following requirement:User passwords must be 10 characters or more.Configuring the Default Domain Policy in the on-premise Active Directory meets the requirement.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your network contains an Active Directory forest. You deploy Microsoft 365.You plan to implement directory synchronization.You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.User passwords must be 10 characters or more.Solution: Implement password hash synchronization and configure password protection in the Microsoft Entra tenant.Does this meet the goal?
This solution meets the following requirement:Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. (this is because the authentication is performed by Microsoft Entra ID).This solution does not meet the following requirement:User passwords must be 10 characters or more.To meet this requirement, you would need to configure the Default Domain Policy in the on-premise Active Directory.Azure Password Protection can prevent users from using passwords from a ‘banned password’ list but it cannot be configured to require that passwords must be 10 characters or more.
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.