HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You create a Conditional Access policy named Policy1 and assign Policy1 to all users.You need to configure Policy1 to enforce multi-factor authentication (MFA) if the user risk level is high.Which two settings should you configure in Policy1? To answer, select the appropriate settings in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: ConditionsCommon Conditional Access policy: Sign-in risk-based multifactor authenticationMost users have a normal behavior that can be tracked, when they fall outside of this norm it could be risky to allow them to just sign in. You may want to block that user or maybe just ask them to perform multifactor authentication to prove that they're really who they say they are.Enable with Conditional Access policy1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.2. Browse to Protection > Conditional Access.3. Select Create new policy.4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.Under Assignments, select Users or workload identities. Under Include, select All users. (Already selected here)Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.6. Under Target resources > Cloud apps > Include, select All cloud apps.Under Conditions > Sign-in risk, set Configure to Yes. Under Select the sign-in risk level this policy will apply to. (Box 1)Select High and Medium. Select Done.Under Access controls > Grant. (Box2)Select Grant access, Require multifactor authentication. Select Select.Under Session. Select Sign-in frequency.Ensure Every time is selected. Select Select.10. Confirm your settings and set Enable policy to Report-only.11. Select Create to create to enable your policy.Box 2: Grant
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk
Your network contains an Active Directory domain.You have a Microsoft Entra tenant that has Security defaults disabled.Microsoft Entra Connect Sync is configured for directory synchronization. Password hash synchronization and pass-through authentication are disabled.You need to enable Microsoft Entra ID Protection to detect leaked credentials. What should you do first?
Microsoft Entra ID Protection [user identities]Compromised credentials (e.g. via phishing mail(s) or website compromise via hacking like SQL injection, see example below) that are available publicly (e.g. on the dark web or other public resources) are gathered and verified by Microsoft against the actual Microsoft Entra credentials.If the username and the password hash is a match (requires Microsoft Entra Connect password hash sync), a High risk alert is raised in Microsoft Entra ID Protection called Leaked Credentials.
https://derkvanderwoude.medium.com/leaked-credentials-for-workload-identities-3248b1936368
Your network contains an on-premises Active Directory domain. You have a Microsoft 365 subscription.You implement a directory synchronization solution that uses pass-through authentication. You configure Microsoft Entra Password protection as shown in the following exhibit.You discover that Active Directory users can use the passwords in the custom banned passwords list. You need to ensure that banned passwords are banned for all users.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.
Answer(s): A,D,E
AD: Install the Microsoft Entra password protection proxy and domain controller agents in your on-premises environment.Download the agents from the download center and use the instructions in the password protection deployment guide. Both the domain controller agent and the proxy agent support silent installation which can be leveraged using various deployment mechanisms like SCCM.E: We see Mode: Audit Change it to Enforced.Note: Customize your settings1. Set your custom smart lockout threshold (number of failures until the first lockout) and duration (how long the lockout period lasts)Enter the banned password strings for your organization in the textbox provided (one string per line) andturn on enforcement of your custom list3. Extend banned password protection to Windows Server Active Directory by enabling password protection in Active Directory. Start with the audit mode, which gives you the opportunity to evaluate the current state in your organization. Once an action plan is finalized, flip the mode to Enforced to start protecting users by preventing any weak passwords being used.Incorrect:Not F: Enforce custom list is already set to Yes.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-configure-custom-password- protectionhttps://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-password-protection-and- smart-lockout-are-now-in-public/ba-p/245423
Your network contains an Active Directory domain and a Microsoft Entra tenant. The network uses a firewall that contains a list of allowed outbound domains.You begin to implement directory synchronization.You discover that the firewall configuration contains only the following domain names in the list of allowed domains:*.microsoft.com*.office.comDirectory synchronization fails.You need to ensure that directory synchronization completes successfully.What is the best approach to achieve the goal? More than one answer choice may achieve the goal. Select the BEST answer.
Microsoft Entra Connect needs to be able to connect to various Microsoft domains such as login.microsoftonline.com. Therefore, you need to modify the list of allowed outbound domains on the firewall.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-ports
You have a Microsoft 365 E5 subscription that contains users in the United States, Europe, and Asia. You use Microsoft Entra ID Protection.You have a virtual desktop infrastructure (VDI). All VDI servers are located in the United States. Users connect to Microsoft 365 from laptops and the VDI.Some VDI users report that they are blocked from signing in to Microsoft 365 due to a high sign-in risk.You need to reduce the likelihood that the VDI users will be erroneously blocked from signing in to Microsoft365. The solution must ensure that sign-ins from the VDI environment are protected by using Identity Protection.What should you configure?
Answer(s): B
Using the location condition in a Conditional Access policyConditional Access policies are at their most basic an if-then statement combining signals, to make decisions, and enforce organization policies. One of those signals is location.Organizations can use these locations for common tasks like:Requiring multifactor authentication for users accessing a service when they're off the corporate network. Blocking access for users accessing a service from specific countries or regions your organization never operates from.The location found using the public IP address a client provides to Microsoft Entra ID or GPS coordinates provided by the Microsoft Authenticator app.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.