HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription and a Microsoft Entra tenant named contoso.com.All users have computers that run Windows 11, are joined to contoso.com, and are protected by using BitLocker Drive Encryption (BitLocker).You plan to create a user named Admin1 that will perform following tasks: View BitLocker recovery keys.Configure the usage location for the users in contoso.com.You need to assign roles to Admin to meet the requirements. The solution must use the principle of least privilege.Which two roles should you assign? To answer, select the appropriate options in the answer area.Hot Area:03CDC095F9FEFF732D90886CB388BC30
Answer(s): A
03CDC095F9FEFF732D90886CB388BC3003CDC095F9FEFF732D90886CB388BC30Box 1: Helpdesk Administrator View BitLocker recovery keys.The Helpdesk Administrator can read bitlocker metadata and key on devices. Box 2: License AdministratorConfigure the usage location for the users in contoso.com.A License Administrator can update usage location of users.Users in this role can add, remove, and update license assignments on users, groups (using group-based licensing), and manage the usage location on users. The role does not grant the ability to purchase or manage subscriptions, create or manage groups, or create or manage users beyond the usage location. This role has no access to view, create, or manage support tickets.
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#helpdesk-administrator https://techcommunity.microsoft.com/t5/microsoft-intune/what-admin-role-grans-permission-to-view-devices- bitlocker/m-p/1587597
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 Enterprise E5 subscription.You add a cloud-based app named App1 to the Microsoft Entra enterprise applications list.You need to ensure that two-step verification is enforced for all user accounts the next time they connect to App1.Which three settings should you configure from the policy? To answer, select the appropriate settings in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Cloup apps or actions, No cloud apps, actions, or authentication contexts selectedIn the Cloud Apps section, you need to select the name of the app (App1) that the policy will apply to.Box 2: Grant, 0 controls selectedIn the Grant section under Access Controls, there is a checkbox named “Require Multi-factor Authentication”. That checkbox needs to be ticked.Box 3: Enable policy, On
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/best-practices https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Conditional-Access-now-in-the-new-Azure- portal/ba-p/250060
You have a Microsoft 365 E5 subscription.You create a Conditional Access policy that blocks access to an app named App1 when users trigger a high- risk sign-in event.You need to reduce false positives for impossible travel when the users sign in from the corporate network. What should you configure?
Answer(s): C
With the location condition in Conditional Access, you can control access to your cloud apps based on the network location of a user.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy- location
You have a Microsoft 365 E5 subscription. You need to create a mail-enabled contact. Which portal should you use?
If you use directory synchronization to manage your recipients, you can still add and manage users in the Microsoft 365 admin center.Note: Manage mail users in Exchange OnlineUse directory synchronization to manage mail usersIn Exchange Online organizations, mail users are similar to mail contacts. Both have external email addresses and both contain information about people outside your Exchange Online organization that can be displayed in the shared address book and other address lists. However, unlike a mail contact, a mail user has sign in credentials in your Microsoft 365 organization and can access resources.For this question:Correct answers include:* the Exchange admin centerthe Microsoft 365 admin centerIncorrect answers include:* the Intune admin center* the Microsoft Defender portal* the Microsoft Purview compliance portal* the Microsoft Teams admin center* the SharePoint admin center
https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-mail-users
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant that contains the users shown in the following table.You enable self-service password reset for all users. You set Number of methods required to reset to 1, and you set Methods available to users to Security questions only.What information must be configured for each user before the user can perform a self-service password reset? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Phone number and email addressMicrosoft enforces a strong default two-gate password reset policy for any Azure administrator role. This policy may be different from the one you have defined for your users and cannot be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned.With a two-gate policy, administrators don't have the ability to use security questions.The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number.Box 2: Phone number and email address Box 3: Security questions onlyUser3 is not assigned to an Administrative role so the configured method of Security questions only applies to User3.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-password-policy-differences
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.