Free Practice Questions for Microsoft MS-102 Exam

Box 1: only on-premises

In the exhibit, seamless single sign-on (SSO) is disabled. Therefore, as SSO is disabled in the cloud, the Sales department users can access only on-premises applications by using SSO.

In the exhibit, directory synchronization is enabled and active. This means that the on-premises Active Directory user accounts are synchronized to Microsoft Entra ID user accounts. If the on-premises Active Directory becomes unavailable, the users can access resources in the cloud by authenticating to Microsoft Entra ID. They will not be able to access resources on-premises if the on-premises Active Directory becomes unavailable as they will not be able to authenticate to the on-premises Active Directory.

Box 2: in the cloud only

Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.

Project2: After the successful completion of Project1, Microsoft Teams & Skype for Business will be enabled in Microsoft 365 for the sales department users.

After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.

Fabrikam does NOT plan to implement identity federation.

After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.

You need to enable password hash synchronization to enable the users to continue to authenticate to their mailbox and to SharePoint sites by using their UPN.

You need to enable SSO to enable all users to be signed in to on-premises and cloud-based applications automatically.

Setting

Correct selection

Authentication strength

Phishing-resistant MFA

Named location

IP ranges

The correct authentication strength is Phishing-resistant MFA . Microsoft Entra authentication strengths let administrators control which authentication methods satisfy a Conditional Access policy. The built-in phishing-resistant MFA strength is designed for methods such as FIDO2/passkeys , Windows Hello for Business , and certificate-based authentication , which matches the requirement exactly. Regular “Multifactor authentication” would allow broader MFA methods such as push notification, SMS, voice, or OTP, so it is too permissive. “Passwordless MFA” is also not exact because passwordless methods can include methods that are not necessarily the same phishing-resistant set required here.

The correct named location type is IP ranges . To mark a physical office such as London as trusted, you define the office’s public egress IP addresses as a Conditional Access named location and mark that IP range as trusted. Microsoft’s Conditional Access location guidance states that named locations can be created as countries/regions or IP ranges , and that when you select IP ranges, you can optionally Mark as trusted location .

Therefore, configure Policy1 with Phishing-resistant MFA and exclude a trusted named location created from the London office IP ranges .

When you add a custom domain to Office 365, you need to verify that you own the domain. You can do this by adding either an MX record or a TXT record to the DNS for that domain.

Note:

There are several versions of this question in the exam. The question has two possible correct answers:

Text (TXT)

Mail exchanger (MX)

incorrect answer options you may see on the exam include the following:

alias (CNAME)

Host (A)

host (AAA)

Pointer (PTR)

Name Server (NS)

host information (HINFO)

pointer (PTR)