Microsoft MS-102 Exam Dumps, Practice Test Questions

Configure and verify the option to unlock an account without changing the password in the supported identity environment. is directed at a separate task: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. It does not produce the required configuration outcome: User authentication method registration shows Authenticator available and usable.

Revoke sign-in sessions, reset credentials and investigate the specific risk event. implements a different mechanism for: A protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. It does not configure the mechanism needed here: Enable Microsoft Authenticator in the authentication methods policy.

Select Require device to be marked as compliant for the applicable users and apps. is directed at a separate task: The business wants to enforce accepted device compliance rather than merely check if the user owns a registered device. It does not produce the required configuration outcome: User authentication method registration shows Authenticator available and usable.

A prohibited company-themed password is rejected during a test change. would assess a different control. In this case it does not rule out the specific failure: Registration is blocked even though the user installed the app.

The employee unlocks access and can use the existing valid password. is evidence of another system state: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. The acceptance evidence here instead is: User authentication method registration shows Authenticator available and usable.

One intended on-premises identity is linked to its existing cloud user. would assess a different control. In this case it does not rule out the specific failure: Registration is blocked even though the user installed the app.

The response never revoked sessions or remediated credentials. would fit a different circumstance involving: A protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. Here the actual symptom is: Registration is blocked even though the user installed the app.

Custom banned password policy does not include or enforce the weak phrase. is a plausible failure in another case: New users can select a published weak company keyword as their password. It does not explain the current incident: Registration is blocked even though the user installed the app.

The attribute flow or connector export path is not propagating the source update. would fit a different circumstance involving: A user changes their on-premises display name but Entra never reflects the update. Here the actual symptom is: Registration is blocked even though the user installed the app.

Pilot authentication method policy with a supported target group. can be useful when the security team wants to avoid requiring every user to enroll in a sign-in method not yet supported on their devices. However, it does not specifically achieve: An eligible user completes password recovery using registered verification methods.

Use approved phishing-resistant authentication methods such as FIDO2 security keys where supported. addresses another administrative need: Employees must register a phishing-resistant sign-in factor instead of relying on SMS codes. This question instead requires the outcome: An eligible user completes password recovery using registered verification methods.

Plan an eligible multi-forest Entra synchronization topology. can be useful when an organization has multiple AD forests containing employees but wants one Microsoft Entra tenant. However, it does not specifically achieve: An eligible user completes password recovery using registered verification methods.

Revoke sign-in sessions, reset credentials and investigate the specific risk event. is directed at a separate task: A protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. It does not produce the required configuration outcome: An eligible user completes password recovery using registered verification methods.

Create a permitted Temporary Access Pass for an eligible user and constrain its activation period. implements a different mechanism for: A business wants to know whether a temporary authentication method will be valid only during an enrollment window. It does not configure the mechanism needed here: Enable self-service password reset for the intended users.

Verify the custom domain in Microsoft Entra and align source UPN suffixes before syncing. is directed at a separate task: A user has a UPN suffix in Active Directory that has not been verified in the cloud tenant. It does not produce the required configuration outcome: An eligible user completes password recovery using registered verification methods.

Pilot users complete the intended registration and sign-in without a broad outage. would assess a different control. In this case it does not rule out the specific failure: A licensed user cannot reset their password because SSPR is disabled for the group.

The temporary code works in its valid window and expires afterward. is evidence of another system state: A business wants to know whether a temporary authentication method will be valid only during an enrollment window. The acceptance evidence here instead is: An eligible user completes password recovery using registered verification methods.

On-premises test user changes appear in Entra for included organizational units. would assess a different control. In this case it does not rule out the specific failure: A licensed user cannot reset their password because SSPR is disabled for the group.

Method policy targeting or registration prerequisites do not match the intended user. would fit a different circumstance involving: Privileged staff should use an approved security-key method but standard employees may use other allowed factors. Here the actual symptom is: A licensed user cannot reset their password because SSPR is disabled for the group.

The Temporary Access Pass lifetime or one-time-use setting was not constrained. is a plausible failure in another case: A temporary enrollment code remains reusable beyond the approved period. It does not explain the current incident: A licensed user cannot reset their password because SSPR is disabled for the group.

The named location IP ranges do not match the organization's actual egress. would fit a different circumstance involving: Users inside an approved corporate network must get different access treatment than employees connecting from unknown public Internet. Here the actual symptom is: A licensed user cannot reset their password because SSPR is disabled for the group.

Deploy Microsoft Entra Password Protection agents for on-premises Active Directory. can be useful when an organization extends cloud password protection to on-premises AD Domain Services. However, it does not specifically achieve: The recovery flow demands two approved verification methods.

Enable self-service password reset for the intended users. addresses another administrative need: Employees who forget passwords should recover access without contacting the help desk. This question instead requires the outcome: The recovery flow demands two approved verification methods.

Evaluate all applicable Conditional Access policies and their combined grants. can be useful when a tenant wants to enforce MFA only after accounting for combined controls that may apply to each user. However, it does not specifically achieve: The recovery flow demands two approved verification methods.

Revoke sign-in sessions, reset credentials and investigate the specific risk event. is directed at a separate task: A protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. It does not produce the required configuration outcome: The recovery flow demands two approved verification methods.

Create a permitted Temporary Access Pass for an eligible user and constrain its activation period. implements a different mechanism for: A business wants to know whether a temporary authentication method will be valid only during an enrollment window. It does not configure the mechanism needed here: Set the SSPR requirement for two authentication methods.

Create a Conditional Access policy for finance app access with compliant-device requirements where supported. is directed at a separate task: Users accessing a finance app from unmanaged devices must pass a policy condition rather than receive unrestricted access. It does not produce the required configuration outcome: The recovery flow demands two approved verification methods.

The on-premises domain controller enforces configured banned-password controls. would assess a different control. In this case it does not rule out the specific failure: A user resets their password with one method despite a two-method requirement.

An eligible user completes password recovery using registered verification methods. is evidence of another system state: Employees who forget passwords should recover access without contacting the help desk. The acceptance evidence here instead is: The recovery flow demands two approved verification methods.

Administrators with the targeted role are challenged under the policy. would assess a different control. In this case it does not rule out the specific failure: A user resets their password with one method despite a two-method requirement.

Custom banned password policy does not include or enforce the weak phrase. would fit a different circumstance involving: Administrators want to reject a known list of weak company-themed passwords at password change. Here the actual symptom is: A user resets their password with one method despite a two-method requirement.

The response never revoked sessions or remediated credentials. is a plausible failure in another case: An attacker retains a session token after the team only changes a display name. It does not explain the current incident: A user resets their password with one method despite a two-method requirement.

The evaluator ignored another applicable Conditional Access policy or actual membership. would fit a different circumstance involving: A new Conditional Access design is blocking employees who should be outside the pilot group. Here the actual symptom is: A user resets their password with one method despite a two-method requirement.