Microsoft - MS-102: Microsoft 365 Administrator
Sample Questions
Question: 554
Measured Skill: Implement and manage Microsoft Entra identity and access (25-30%)
You have a Microsoft 365 E5 subscription.
You invite an external partner named Guest1 as a guest user.
After Guest1 signs in, you discover that Guest1 has invited additional guest users.
You need to ensure that Guest1 can collaborate with internal users by using Microsoft Teams channels but cannot invite other guest users. The solution must follow the principle of least privilege.
What should you do?| A | From the Microsoft Teams admin center, configure guest access. |
| B | From the Microsoft Entra admin center, configure the External collaboration settings. |
| C | From the Microsoft Teams admin center, configure the Global (Org-wide default) policy for guest access. |
| D | From the Microsoft Entra admin center, modify the sponsor of Guest1. |
Correct answer: BExplanation:
Microsoft Entra External collaboration settings control who can invite external users to your organization.
By configuring guest invitation restrictions, you can prevent Guest1 from inviting additional guest users while allowing Guest1 to continue collaborating with internal users through Microsoft Teams.
Recommended Configuration
Navigate to:
Microsoft Entra admin center → Entra ID → External Identities → External collaboration settings
Under Guest invite settings, select:
Only users assigned to specific admin roles can invite guest users.
This configuration:
- Prevents ordinary guest users, including Guest1, from inviting additional guests.
- Allows authorized administrators to invite external users.
- Preserves Guest1's ability to collaborate through Microsoft Teams channels.
- Follows the principle of least privilege.
References:
Configure external collaboration settings for B2B in Microsoft Entra External ID
What is Microsoft Entra B2B collaboration?
Guest access in Microsoft Teams
Question: 555
Measured Skill: Manage security and threats by using Microsoft Defender XDR (30–35%)
You have a Microsoft 365 E5 subscription.
You plan to ingest threat indicators into Microsoft Defender XDR.
What can you do in Microsoft Defender XDR after you ingest the indicators?| A | Classify the indicators as either accurate, a false positive, or benign. View the indicators in Microsoft Defender Threat Intelligence (Defender TI). |
| B | Configure automatic remediation actions for the indicators. Generate User activity reports related to the indicators. |
| C | Export all the indicators to Microsoft Purview for a compliance review. Link each indicator directly to an advanced hunting query. |
| D | View the indicators used during the last 30 days. Create a Tenant Allow/Block List. |
Correct answer: DExplanation:
Microsoft Defender XDR supports ingesting and managing threat indicators, also known as indicators of compromise (IoCs).
After ingesting threat indicators, security analysts can:
- Classify indicators: Determine whether an indicator represents a genuine threat, a false positive, or benign activity.
- Investigate indicators: Use Microsoft Defender Threat Intelligence (Defender TI) to examine indicators and obtain additional threat context.
These capabilities help security teams investigate threats and improve detection accuracy.
References:
Overview of indicators in Microsoft Defender for Endpoint
Threat intelligence in Microsoft Defender
Question: 556
Measured Skill: Manage security and threats by using Microsoft Defender XDR (30–35%)
You have a Microsoft 365 E5 subscription that contains Windows 11 devices.
You need to use Microsoft Defender for Endpoint to monitor the devices' security state against predefined security benchmarks.
Which two actions should you perform?
(Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.)| A | Enable Microsoft Intune connection. |
| B | Create a security baselines assessment profile. |
| C | Enroll the devices in Microsoft Intune. |
| D | Create an Endpoint security policy. |
| E | Onboard the devices to Defender for Endpoint. |
Correct answer: B, EExplanation:
Microsoft Defender for Endpoint includes Security Baselines Assessment, which evaluates device security configurations against predefined security benchmarks.
To monitor Windows 11 devices against these benchmarks, you must perform two actions.
Onboard the devices to Defender for Endpoint
Devices must be onboarded to Microsoft Defender for Endpoint to collect security configuration information.
Onboarding enables Defender for Endpoint to:
- Collect device security configuration data.
- Identify security misconfigurations.
- Evaluate devices against security benchmarks.
- Provide security recommendations.
Create a security baselines assessment profile
A security baselines assessment profile defines the benchmark against which device configurations are evaluated.
You can use predefined benchmarks, such as those from the Center for Internet Security (CIS).
The assessment identifies deviations from recommended security configurations and helps administrators improve device security.
References:
Security baselines assessment
Onboard Windows client devices to Microsoft Defender for Endpoint
What is Microsoft Defender Vulnerability Management
Question: 557
Measured Skill: Manage security and threats by using Microsoft Defender XDR (30–35%)
You have a Microsoft 365 subscription.
You need to view detailed information about a specific threat actor by using Microsoft Defender Threat Intelligence (Defender TI).
What should you use?| A | Intel profiles |
| B | Intel explorer |
| C | Threat analytics |
| D | Intel projects |
Correct answer: AExplanation:
Intel profiles in Microsoft Defender Threat Intelligence (Defender TI) provide detailed information about specific threat actors, their activities, and associated threats.
Intel profiles help security analysts understand:
- Threat actor profiles: Information about known threat actors, including their motivations, objectives, and activities.
- Tactics, techniques, and procedures (TTPs): Methods used by threat actors to conduct attacks.
- Indicators of compromise (IoCs): IP addresses, domains, and other indicators associated with threat actors.
- Associated malware: Malware families and tools used by threat actors.
- Threat intelligence reports: Research and analysis related to specific threat actors.
References:
Threat intelligence in Microsoft Defender
Threat analytics in Microsoft Defender
Question: 558
Measured Skill: Implement and manage Microsoft Entra identity and access (25-30%)
You have a Microsoft 365 subscription that uses Microsoft Entra group-based licensing and contains the users shown in the following table.
You create a Microsoft Entra group named Group1 that has the following configurations:
- Membership type: Assigned
- Members: User1, User2, User3, and User4
You plan to assign Microsoft 365 E5 licenses to Group1.
You need to identify which users will be granted a Microsoft 365 E5 license automatically. The solution must follow the principle of least privilege.
Which users should you identify?| A | User2 only |
| B | User2 and User3 only |
| C | User2, User3, and User4 only |
| D | User1, User2, User3, and User4 |
Correct answer: DExplanation:
Microsoft Entra group-based licensing automatically assigns licenses to all eligible members of a licensed group, including users who already have another Microsoft 365 license.
When you assign Microsoft 365 E5 licenses to Group1, all four users can receive the license.
License Assignment Evaluation
User1: Already has a Microsoft 365 E3 license. Group-based licensing can assign Microsoft 365 E5 in addition to the existing E3 license.
User2: Has no usage location configured. For group-based licensing, Microsoft Entra ID inherits the tenant's location when a user's usage location is unspecified.
User3: Has a valid usage location and no existing license. The E5 license is assigned automatically.
User4: Has France as the usage location. Microsoft 365 E5 is available in France, so the license can be assigned.
Important Considerations
- Group-based licensing assigns licenses to all group members.
- An existing Microsoft 365 E3 license does not prevent assignment of Microsoft 365 E5.
- Users without an
Reference: Assign or unassign licenses to a group in the Microsoft 365 admin center