Microsoft 365 Certified: Administrator Expert — Practice Set 1

Question 1

You are a Microsoft 365 administrator. You need to monitor the health of Microsoft 365 services and receive email notifications when a service incident occurs. Which feature in the Microsoft 365 admin center should you use?

Accepted Answer

The Service Health dashboard in the Microsoft 365 admin center allows administrators to view current service status, active incidents, and configure email notifications for service health events. Microsoft Secure Score measures security posture, Network connectivity insights evaluates network performance, and usage reports track adoption metrics.

Question 2

Your organization needs to assign Microsoft 365 licenses to a large group of users based on their department membership in Microsoft Entra ID. You want to automate license assignment so that when a user joins the department group, they automatically receive the appropriate license. Which licensing method should you implement?

Accepted Answer

Group-based licensing in Microsoft Entra ID automates license assignment based on group membership. When a user is added to or removed from a licensed group, licenses are automatically assigned or removed. This is the recommended approach for scalable, automated license management in Microsoft 365.

Question 3

Your organization has recently acquired a subsidiary company. You need to add the subsidiary's custom domain to your Microsoft 365 tenant and ensure email flows correctly to the new domain. After adding the domain in the Microsoft 365 admin center, which DNS record type is required to verify domain ownership?

Accepted Answer

Microsoft requires a TXT record to be added to your public DNS zone to verify domain ownership before it can be used in Microsoft 365. The TXT record contains a unique verification code provided by the Microsoft 365 admin center. MX records route email, CNAME records create aliases, and SRV records define service locations.

Question 4

You are a Microsoft 365 administrator. You need to perform bulk user creation for 500 new employees. Which two methods can you use to create users in bulk in Microsoft Entra ID? Choose 2.

Accepted Answer

Bulk user creation can be performed using the CSV import (bulk create) feature in the Microsoft Entra admin center, which accepts a CSV template with user attributes. Microsoft Graph PowerShell also supports bulk user creation by iterating through a CSV file using New-MgUser. Microsoft Entra PowerShell is a separate module but is not the primary recommended approach for bulk operations at scale — Graph PowerShell is preferred. Creating users one at a time is not bulk creation.

Question 5

Your organization wants to delegate administration of a specific set of users in one regional office to a local IT administrator without giving them global admin permissions over the entire tenant. Which Microsoft Entra ID feature should you use?

Accepted Answer

Administrative units in Microsoft Entra ID allow you to scope administrative permissions to a subset of users, groups, or devices. This enables delegation of specific admin roles (such as User Administrator) to only the members of a particular administrative unit, preventing over-privileged access to the entire tenant.

Question 6

You are a Microsoft 365 administrator. You need to configure Microsoft Entra Privileged Identity Management (PIM) so that the Global Administrator role requires justification and multi-factor authentication when activated. You also need activations to be reviewed and approved by another administrator. Which PIM setting should you configure?

Accepted Answer

In Microsoft Entra PIM, role settings allow you to configure activation requirements including: requiring approval (and designating approvers), requiring MFA on activation, and requiring a justification to be provided. These settings are configured in the PIM role settings for each eligible role assignment. Conditional Access MFA is a different control and does not provide the approval workflow. Access reviews verify ongoing access but do not gate activation.

Question 7

Your organization uses Microsoft 365 Backup to protect content in SharePoint Online, OneDrive, and Exchange Online. You need to understand which administrator role is required to configure Microsoft 365 Backup. Which role has the minimum required permissions?

Accepted Answer

The Microsoft 365 Backup Administrator role provides the minimum permissions required to configure and manage Microsoft 365 Backup. While Global Administrators also have access, the principle of least privilege recommends using the dedicated Backup Administrator role. SharePoint Administrator and Exchange Administrator roles only cover their respective workloads and cannot configure the unified Backup solution.

Question 8

Your organization is preparing to implement Microsoft Entra Connect Sync to synchronize on-premises Active Directory with Microsoft Entra ID. Before running the installation, you need to identify and fix issues with user objects in Active Directory that may cause synchronization errors. Which tool should you use?

Accepted Answer

IdFix is a tool provided by Microsoft specifically to identify and fix directory synchronization issues in on-premises Active Directory before implementing Microsoft Entra Connect Sync. It detects errors in attributes such as UPN, proxyAddresses, and displayName that would prevent successful synchronization. Microsoft Entra Connect Health monitors the health of an existing sync environment, not pre-deployment cleanup.

Question 9

Your organization has a hybrid identity environment using Microsoft Entra Connect Sync. Users report they can sign in to on-premises resources but cannot authenticate to Microsoft 365 services. You need to diagnose the issue. You check the Synchronization Service Manager and notice that the connector for Microsoft Entra ID shows several export errors. Which tool should you use to get detailed health and alerting information about the synchronization service?

Accepted Answer

Microsoft Entra Connect Health provides monitoring, alerting, and detailed analytics for Microsoft Entra Connect Sync (and Cloud Sync). It displays health status, synchronization errors, performance metrics, and sends alerts when sync issues occur. IdFix is used pre-deployment for data cleanup. Sign-in logs show authentication events but not sync health. Secure Score measures security posture.

Question 10

Your organization wants to allow users to reset their own passwords without contacting the IT helpdesk, but only after verifying their identity through two authentication methods. Which feature should you configure in Microsoft Entra ID?

Accepted Answer

Self-service password reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords. The SSPR settings allow administrators to require one or two authentication methods for verification before allowing a reset. Requiring two methods increases security. Microsoft Entra Password Protection prevents weak passwords but does not enable self-service reset. Identity Protection risk policies can require password changes but are triggered by detected risk, not self-service.

Question 11

You are designing a Conditional Access policy to protect access to Microsoft 365 services. The policy must block access from legacy authentication protocols and require compliant devices for all cloud apps. Which two conditions should you configure in the Conditional Access policy? Choose 2.

Accepted Answer

To block legacy authentication, configure the Client apps condition to include 'Exchange ActiveSync clients' and 'Other clients' (which represent legacy protocols like IMAP, POP, SMTP AUTH, etc.) and set the grant to Block. To require compliant devices, configure the Grant control to 'Require device to be marked as compliant', which enforces Microsoft Intune compliance policies. Sign-in and user risk conditions are used for risk-based policies, not legacy auth blocking or device compliance enforcement.

Question 12

Your organization's security team wants to automatically respond to risky user sign-ins. You need to configure a policy that blocks access when Microsoft Entra ID detects a high-risk sign-in, while allowing low-risk sign-ins with MFA. Which feature should you configure?

Accepted Answer

Microsoft Entra Identity Protection sign-in risk policy allows you to configure automated responses based on detected sign-in risk levels. You can configure it to require MFA for medium-risk sign-ins and block access for high-risk sign-ins. Microsoft Entra Password Protection prevents weak passwords. Microsoft Defender for Identity focuses on on-premises identity threats. Smart Lockout protects against brute-force attacks but does not provide risk-based access control.

Question 13

Your organization wants to prevent users from using common passwords and passwords that contain the organization's name. Which feature in Microsoft Entra ID should you configure?

Accepted Answer

Microsoft Entra Password Protection includes a global banned password list maintained by Microsoft and allows administrators to configure a custom banned password list. The custom list can include organization-specific terms like company names, products, or locations. Identity Protection risk policies respond to detected risks, not password policy enforcement. Conditional Access does not enforce password complexity rules.

Question 14

You are a Microsoft 365 administrator. A user reports they are unable to sign in to Microsoft 365. You need to investigate the sign-in failure and determine the reason. Where in the Microsoft Entra admin center can you find detailed sign-in logs for this user?

Accepted Answer

Microsoft Entra ID Sign-in logs (found under Monitoring & health in the Microsoft Entra admin center) provide detailed information about each sign-in attempt, including the user, application, IP address, location, sign-in result, error code, and failure reason. Audit logs track administrative actions, not individual sign-in events. Microsoft 365 usage reports show aggregate adoption data, not individual authentication failures.

Question 15

Your organization wants to measure its current security configuration across Microsoft 365 workloads and receive actionable recommendations to improve it. Which feature in Microsoft Defender XDR should you use?

Accepted Answer

Microsoft Secure Score in Microsoft Defender XDR measures an organization's security posture with a numerical score and provides prioritized, actionable recommendations to improve security across Microsoft 365 workloads. Security Exposure Management provides broader attack surface insights. Threat Intelligence provides information about active threat actors. Attack Simulation Training simulates phishing and other attacks for user training.

Question 16

Your organization has received reports of users receiving phishing emails. You need to investigate whether users have clicked on malicious links in these emails. You also need to understand the full scope of the attack across the organization. Which capability in Microsoft Defender XDR should you use to hunt for evidence of user interactions with malicious URLs?

Accepted Answer

Advanced hunting in Microsoft Defender XDR allows security administrators to proactively query data across all protected workloads using Kusto Query Language (KQL). It enables searching for evidence of users clicking malicious links across email, endpoints, and identities in a single query interface. Threat Explorer focuses specifically on email threats. Defender for Endpoint device timeline shows endpoint activity. Purview Audit log tracks Microsoft 365 administrative and user actions but is not optimized for cross-workload threat hunting.

Question 17

You are configuring Microsoft Defender for Office 365 to protect your organization against email threats. You need to protect against zero-day malware in email attachments and ensure that malicious URLs in emails are checked at the time of click. Which two features should you enable? Choose 2.

Accepted Answer

Safe Attachments in Microsoft Defender for Office 365 opens email attachments in a virtual environment (detonation) to detect zero-day and unknown malware before delivering them to users. Safe Links rewrites URLs in emails and checks them at the time of click against a real-time threat database, protecting users from malicious links even if the URL was safe at the time of email delivery. Anti-spam and anti-phishing policies provide additional protection but do not specifically address zero-day attachment scanning or click-time URL checking.

Question 18

Your organization wants to train users to recognize and avoid phishing attacks. You need to send simulated phishing emails to users and enroll those who click on the links in security awareness training. Which feature in Microsoft Defender for Office 365 should you use?

Accepted Answer

Attack Simulation Training in Microsoft Defender for Office 365 allows administrators to run simulated phishing campaigns targeting their users. Users who click on simulated phishing links can be automatically enrolled in training courses. This helps measure and improve organizational phishing awareness. Safe Links protects against real malicious URLs. Threat Explorer is an investigation tool. Restricted entities shows blocked senders or users.

Question 19

Your organization uses Microsoft Defender for Endpoint to protect devices. You need to onboard Windows 10 devices that are already enrolled in Microsoft Intune. Which onboarding method should you use?

Accepted Answer

For devices already managed by Microsoft Intune, the recommended and most efficient onboarding method for Microsoft Defender for Endpoint is through Microsoft Intune (Microsoft Endpoint Manager). This allows the Defender for Endpoint onboarding configuration package to be deployed via an Intune device configuration profile or endpoint security policy. Local scripts are suitable for individual machines or testing. Group Policy is used for Active Directory-joined devices. Configuration Manager is used for on-premises managed environments.

Question 20

You are a Microsoft 365 administrator. Your security team has discovered that an employee's account was compromised and the attacker used it to send large volumes of spam email. Microsoft has automatically restricted the account from sending email. You need to remove the restriction so the employee can send email again after the account has been secured. Where should you go to remove the sending restriction?

Accepted Answer

When Microsoft detects that an account has been used to send spam, it automatically adds the user to the Restricted entities list in Microsoft Defender XDR. To remove the restriction after securing the account, administrators must go to Microsoft Defender XDR > Email & collaboration > Review > Restricted entities and unblock the user. This is the specific location for managing restricted senders — not the Exchange admin center rules or the Microsoft 365 admin center user properties.

Question 21

You are configuring Microsoft Defender for Cloud Apps for your organization's Microsoft 365 tenant. You need to monitor user activities in Microsoft 365 apps and create an alert when a user downloads an unusually large amount of data. Which two steps are required? Choose 2.

Accepted Answer

To monitor Microsoft 365 activity in Defender for Cloud Apps, you must first configure the Microsoft 365 app connector which provides API-based access to Microsoft 365 activity data. Then, you create an activity policy to define the alert conditions — such as detecting when a user downloads more than a threshold amount of files. Cloud App Discovery identifies shadow IT but is not required for monitoring connected Microsoft 365 apps. Safe Attachments and DLP policies serve different security purposes.

Question 22

Your organization's security team wants to understand the tactics, techniques, and procedures (TTPs) used by a specific threat actor that has been targeting your industry. You need to access structured threat intelligence reports that include indicators of compromise (IOCs) and MITRE ATT&CK mapping. Which feature in Microsoft Defender XDR provides this capability?

Accepted Answer

Microsoft Defender Threat Intelligence provides curated, in-depth intelligence on threat actors, malware families, and vulnerabilities, including IOCs, MITRE ATT&CK mapping, and analyst reports. This helps security teams understand specific threats targeting their industry. Microsoft Secure Score measures security posture. Advanced hunting is for proactive querying of your own environment's data. Security Exposure Management focuses on your organization's attack surface.

Question 23

Your organization needs to automatically retain emails related to legal matters for 7 years, after which they should be automatically deleted. You need to implement this using Microsoft Purview. Which feature should you use?

Accepted Answer

Retention policies in Microsoft Purview allow administrators to specify how long content should be retained and what happens at the end of the retention period (delete, review, or nothing). A retention policy can be configured to retain Exchange email for 7 years and then automatically delete it. Sensitivity labels control access and protection of content. DLP policies prevent sharing of sensitive data. Communication compliance monitors communications for policy violations.

Question 24

Your organization processes payment card data and needs to prevent employees from sharing credit card numbers via email or Microsoft Teams. You need to automatically detect and block messages containing credit card numbers. Which Microsoft Purview feature should you configure?

Accepted Answer

A Microsoft Purview data loss prevention (DLP) policy using the built-in 'Credit Card Number' sensitive information type can automatically detect and block or warn users when they attempt to share credit card numbers via Exchange Online or Microsoft Teams. DLP policies can be configured to block sending, show policy tips, or notify administrators. Sensitivity labels protect documents but don't automatically detect and block specific content patterns in messages. Retention policies manage data lifecycle. Communication compliance monitors for policy violations but doesn't block in real-time.

Question 25

Your organization wants to classify and protect documents containing sensitive financial information. You need to apply a label that automatically encrypts the document and restricts printing when users save files with the label. After deploying the labels, you want to monitor which labels are being applied and to which content across your Microsoft 365 environment. Which tool in Microsoft Purview provides visibility into label usage?

Accepted Answer

Content explorer in Microsoft Purview allows administrators to view a snapshot of labeled and sensitive content across Microsoft 365 locations including SharePoint Online, OneDrive, Exchange Online, and Teams. It shows which sensitivity labels and sensitive information types are applied to specific files. Activity explorer shows labeling activity over time. DLP reports focus on policy matches, not label coverage. Defender for Cloud Apps and Entra audit logs do not provide sensitivity label inventory views.

MS-102 — Microsoft 365 Certified: Administrator Expert