HOTSPOT (Drag and Drop is not supported)You have an on-premises server named Server1 that runs Windows Server. Server1 is used to access a software as a service (SaaS) app named App1.You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps, Microsoft Defender XDR, Microsoft Defender for Endpoint, and Microsoft Defender for Identity. You configure Cloud Discovery for App1 and Server1.You need to meet the following requirements: Tag Server1 as a high-value device.Ensure that an alert is triggered when App1 is accessed.What should you do for each requirement? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Create a critical asset classification in Microsoft Defender XDR Tag Server1 as a high-value device.Classifying assetsAfter business critical assets are defined and identified, asset criticality appears with your asset information. Asset criticality is integrated into other experiences in the Defender portal, such as in advanced hunting, the device inventory, and in attack paths that involve critical assets.Note: Working with asset classificationsYou can work with critical asset settings as follows:* Create custom classifications: You can create new critical asset classifications for devices, identities, and cloud resources, tailored to your organization.* You use the query builder to define a new classification. For example, you might build a query to define devices with a specific naming convention as critical.* Creating critical asset classification queries is also useful for limited cases where not all assets of interest are identified.Add assets to classifications: You can manually add assets to critical asset classifications.Modify criticality levels: You can choose to edit criticality levels according to your organization's risk profile. Edit custom classifications: You can edit, delete, and turn off custom classifications. Predefined classifications can't be modified.Incorrect:* Tag the device in Defender for EndpointTag the device in Defender for Identity What's Microsoft Defender for identity?Microsoft Defender for Identity is designed to protect your on-premises Active Directory (AD) and Active Directory Federation Services (ADFS). Microsoft Defender for Identity can perform the following:Monitor user and entity behavior/activities with intelligent analytics. Protect user identities and reduces the attack surface.Identify and investigate suspicious user activities to find advanced attacks throughout your environment. Use the Microsoft 365 portal to monitor and respond to investigate alerts and user activity.Box 2: Add an indicator for IP addresses to Defender for Endpoint Ensure that an alert is triggered when App1 is accessed.Defender for Cloud Apps IndicatorsIf your organization has enabled integration between Defender for Endpoint and Defender for Cloud Apps, block indicators are created in Defender for Endpoint for all unsanctioned cloud applications. If an application is put in monitor mode, warn indicators (bypassable block) are created for the URLs associated with the application. Allow indicators can't be created for sanctioned applications at this time. Indicators created by Defender for Cloud Apps follow the same policy conflict handling described in the previous section.Incorrect:* Tag the device in Defender for Cloud Apps.Tag the device in Defender for Identity
https://learn.microsoft.com/en-us/security-exposure-management/critical-asset-management https://learn.microsoft.com/en-us/defender-endpoint/indicator-ip-domain
You have a Microsoft 365 subscription that contains a Microsoft Entra tenant named contoso.com. The tenant includes a user named User1.You plan to use Microsoft Entra ID Protection.You need to ensure that User1 can review the list in Microsoft Entra ID Protection of users flagged for risk. The solution must use the principle of least privilege.To which role should you add User1?
Correct:* Global Administrator (Most privilege, least preferable)* Security AdministratorSecurity Reader (Least privilege, most preferable)Incorrect:* Compliance Administrator* Reports Reader* Service Administrator.User AdministratorNote: The risky sign-ins reports are available to users in the following roles: Security AdministratorGlobal Administrator Security ReaderOf the three roles listed above, the Security Reader role has the least privilege.
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risky-sign-in
DRAG DROP (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains two security groups named Group1 and Group2. You need to recommend an authentication solution to meet the following requirements:Administrators must be able to generate a time-limited code to allow the members of Group1 to authenticate without using their password.The members of Group2 must be able to authenticate by confirming a two-digit code on their mobile device.Which authentication method should you recommend for each group? To answer, drag the appropriate methods to the correct groups. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Box 1: A Temporary Access PassAdministrators must be able to generate a time-limited code to allow the members of Group1 to authenticate without using their password.Configure Temporary Access Pass to register passwordless authentication methodsPasswordless authentication methods like a passkey (FIDO2) let users sign in securely without a password. Users can bootstrap passwordless methods in one of two ways:* Use existing Microsoft Entra multifactor authentication methods*-> Use a Temporary Access PassA Temporary Access Pass (TAP) is a time-limited passcode that can be configured for single use or multiple sign-ins. Users can sign in with a TAP to onboard other passwordless authentication methods. A TAP also makes recovery easier when a user loses or forgets a strong authentication method.Box 2: Microsoft AuthenticatorThe members of Group2 must be able to authenticate by confirming a two-digit code on their mobile device.Set up an authenticator app as a two-step verification methodYou can set up an authenticator app to send a notification to your mobile device or to send you a verification code as your security verification method.
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass https://support.microsoft.com/en-us/account-billing/set-up-an-authenticator-app-as-a-two-step-verification- method-2db39828-15e1-4614-b825-6e2b524e7c95
Your network contains two on-premises Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com that are connected by using a forest trust.You have a Microsoft 365 E5 subscription.You need to sync a subset of users from both forests to Microsoft Entra. The solution must support device objects and device writeback.What should you use?
Answer(s): C
Microsoft Entra Connect Sync server. An on-premises computer that runs the Microsoft Entra Connect sync service. This service synchronizes information held in the on-premises Active Directory to Microsoft Entra ID.Microsoft Entra Connect Sync supports writeback features, including device writeback, as well as device object synchronization. Specifically, device writeback allows devices registered in Entra ID to be synced back to the on-premises Active Directory, enabling them for conditional access and other functionalities. However, Microsoft Entra Cloud Sync, the successor to Entra Connect, also supports group writeback and device writeback, making it a more modern solution with features that Entra Connect Sync may no longer support.
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-topologies
Your company has offices in Seattle and Denver. You have a Microsoft 365 subscription.You plan to create a Conditional Access policy named Policy1 that will enforce multifactor authentication (MFA).You need to ensure that users at the Seattle office are excluded from MFA. Users at the Denver office must always be prompted for MFA.What should you configure for Policy1?
To enforce MFA while excluding a specific office IP range in a Conditional Access policy, you'll need to configure a Named Location for your office IP range and then create a Conditional Access policy that includes all users and resources while excluding the named location. This allows MFA to be enforced globally, but those accessing from your office IP range will not be subject to it.
https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.