Microsoft MS-102 Exam Dumps, Practice Test Questions

Role separation and least-privilege administrative delegation were not applied. would fit a different circumstance involving: A Microsoft 365 team requires separate responsibilities for tenant licensing, identity management and security. Here the actual symptom is: The employee can still activate a role after its business justification ended.

The administrative role was overprivileged rather than scoped to a password support task. is a plausible failure in another case: The help desk is granted Global Administrator for routine password assistance. It does not explain the current incident: The employee can still activate a role after its business justification ended.

A person's sign-in identity was incorrectly made the permanent dependency of a service integration. would fit a different circumstance involving: An account used for service integration should not depend on the departure of a named employee. Here the actual symptom is: The employee can still activate a role after its business justification ended.

Use the least-privileged password reset role appropriate to the affected user type. can be useful when a help desk operator must reset standard user passwords but must not administer tenant-wide security policy. However, it does not specifically achieve: A tested emergency account remains usable when the normal identity provider path is disrupted.

Use Microsoft Entra Privileged Identity Management eligible role activation. addresses another administrative need: A high-privilege identity should receive directory administration rights only when a task is approved. This question instead requires the outcome: A tested emergency account remains usable when the normal identity provider path is disrupted.

Use an Exchange distribution group for one-to-many message delivery. can be useful when a small project team wants a distribution address that delivers notifications to each subscriber rather than storing a collaborative mailbox. However, it does not specifically achieve: A tested emergency account remains usable when the normal identity provider path is disrupted.

Assign the scoped User Administrator role to the support operator. is directed at a separate task: A support team needs to manage user accounts but must not change Conditional Access policies. It does not produce the required configuration outcome: A tested emergency account remains usable when the normal identity provider path is disrupted.

Set the Global Administrator role's PIM activation requirements and approvers. implements a different mechanism for: A tenant must require a justification and approval before a Global Administrator can activate privileges. It does not configure the mechanism needed here: Maintain separately controlled emergency access accounts with appropriate monitoring.

Inspect direct and group-based license assignments and relevant disabled service plans. is directed at a separate task: The help desk must determine why a user cannot launch licensed Microsoft 365 Apps. It does not produce the required configuration outcome: A tested emergency account remains usable when the normal identity provider path is disrupted.

The operator can perform approved security configuration but cannot edit unrelated tenant settings. would assess a different control. In this case it does not rule out the specific failure: Every admin loses access during an authentication policy outage.

Activation requests enforce the intended reason and approval controls. is evidence of another system state: A tenant must require a justification and approval before a Global Administrator can activate privileges. The acceptance evidence here instead is: A tested emergency account remains usable when the normal identity provider path is disrupted.

A test message from a permitted external sender reaches the group mailbox. would assess a different control. In this case it does not rule out the specific failure: Every admin loses access during an authentication policy outage.

A privileged role-management grant was unnecessarily given to a read-only role reviewer. would fit a different circumstance involving: A Microsoft 365 help desk should view role memberships for troubleshooting but never alter role assignments. Here the actual symptom is: Every admin loses access during an authentication policy outage.

The earlier eligible PIM assignment was left in place after the transfer. is a plausible failure in another case: The employee can still activate a role after its business justification ended. It does not explain the current incident: Every admin loses access during an authentication policy outage.

The reviewer ignored report latency and time-window semantics. would fit a different circumstance involving: A user reports that the Microsoft 365 admin center lacks the latest organizational usage data. Here the actual symptom is: Every admin loses access during an authentication policy outage.

Use the supported staging-server approach for Connect Sync resilience. can be useful when two hybrid sync servers cannot both actively export the same set of objects to one tenant in the intended design. However, it does not specifically achieve: The pre-sync validation no longer reports the invalid mail attribute.

Use Microsoft Entra Cloud Sync when its feature and topology support meets the requirement. addresses another administrative need: A branch wants lightweight cloud-managed synchronization agents instead of a full dedicated Connect Sync server. This question instead requires the outcome: The pre-sync validation no longer reports the invalid mail attribute.

Use Temporary Access Pass with explicit lifetime and usage restrictions. can be useful when a business wants to know whether a temporary authentication method will be valid only during an enrollment window. However, it does not specifically achieve: The pre-sync validation no longer reports the invalid mail attribute.

Enable the supported password hash synchronization option and confirm required agents and connectivity. is directed at a separate task: Help desk wants changed on-premises passwords usable for Microsoft 365 sign-in with password hash synchronization. It does not produce the required configuration outcome: The pre-sync validation no longer reports the invalid mail attribute.

Enable pass-through authentication and deploy supported agents with redundancy. implements a different mechanism for: A hybrid company wants cloud authentication while applying certain on-premises policies through pass-through authentication agents. It does not configure the mechanism needed here: Use IdFix to identify and remediate supported AD attribute issues before Entra synchronization.

Create a Conditional Access policy scoped to the selected app and group, requiring MFA. is directed at a separate task: The identity team wants to require MFA for a specific sensitive cloud application rather than every app. It does not produce the required configuration outcome: The pre-sync validation no longer reports the invalid mail attribute.

The cloud attribute updates from the on-premises authoritative source. would assess a different control. In this case it does not rule out the specific failure: New cloud identities are rejected because two source objects use the same proxy address.

Only the designated active server exports changes while the standby is prepared. is evidence of another system state: Two hybrid sync servers cannot both actively export the same set of objects to one tenant in the intended design. The acceptance evidence here instead is: The pre-sync validation no longer reports the invalid mail attribute.

The contributing policy and matched user condition explain the block. would assess a different control. In this case it does not rule out the specific failure: New cloud identities are rejected because two source objects use the same proxy address.

Sync health monitoring or alert coverage was never established. would fit a different circumstance involving: Administrators want health warnings for the existing Microsoft Entra Connect Sync deployment. Here the actual symptom is: New cloud identities are rejected because two source objects use the same proxy address.

The on-premises UPN suffix was not valid or verified for the Entra tenant. is a plausible failure in another case: Synced users appear with an unexpected alternate suffix. It does not explain the current incident: New cloud identities are rejected because two source objects use the same proxy address.

The selected sign-in method does not meet the phishing-resistance requirement. would fit a different circumstance involving: Employees must register a phishing-resistant sign-in factor instead of relying on SMS codes. Here the actual symptom is: New cloud identities are rejected because two source objects use the same proxy address.

Choose the authentication method based on the actual sign-in dependency and operational constraints. can be useful when a sign-in architecture review compares cloud password hash sync against pass-through authentication. However, it does not specifically achieve: On-premises test user changes appear in Entra for included organizational units.

Verify the sign-in domain and plan a supported UPN mapping for hybrid identities. addresses another administrative need: A user has a UPN suffix in Active Directory that has not been verified in the cloud tenant. This question instead requires the outcome: On-premises test user changes appear in Entra for included organizational units.

Use an appropriate Conditional Access authentication strength for that privileged scenario. can be useful when security wants phishing-resistant MFA for administrators performing sensitive role activation. However, it does not specifically achieve: On-premises test user changes appear in Entra for included organizational units.

Run IdFix against the source directory and correct flagged duplicate or invalid attributes. is directed at a separate task: An enterprise is synchronizing decades-old on-premises directory accounts that have malformed proxy addresses. It does not produce the required configuration outcome: On-premises test user changes appear in Entra for included organizational units.

Create emergency administrative identities directly in Entra with no matching synchronized source. implements a different mechanism for: An organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. It does not configure the mechanism needed here: Use Microsoft Entra Connect Sync when its supported sync features fit the hybrid design.

Inspect identity protection risk detections and the relevant user and sign-in risk levels. is directed at a separate task: The organization must distinguish risk that a user account is compromised from risk attached to one specific login. It does not produce the required configuration outcome: On-premises test user changes appear in Entra for included organizational units.