A company has enabled Microsoft Entra Identity Protection and wants to automatically block sign-ins that are flagged as high risk. They also want to require MFA for medium-risk sign-ins. Which Conditional Access policy configuration should you use?

Create two policies: one that blocks high-risk sign-ins and another that requires MFA for medium-risk sign-ins.

Configure Identity Protection to automatically block high-risk sign-ins and require MFA for medium-risk sign-ins.

Create a policy that requires MFA for all sign-ins and blocks high-risk sign-ins.

Create a single policy that blocks high-risk sign-ins and requires MFA for medium-risk sign-ins.

Your organization uses Microsoft Entra MFA. You want to ensure that users who are required to use MFA cannot bypass it by using legacy authentication protocols. What should you configure?

Disable legacy authentication in Microsoft Entra.

Require MFA for all users in the MFA settings.

Use Identity Protection to block legacy authentication.

Create a Conditional Access policy that blocks legacy authentication.

A company has enabled MFA for all users. They now want to ensure that users cannot register new MFA methods without administrative approval. What should they do?

Configure the Authentication methods policy to restrict registration to approved methods.

Disable MFA for all users and require them to contact IT to enable it.

Set the MFA registration policy to require a ticket for each registration.

Use Conditional Access to require an administrator to approve MFA registration.

When planning MFA within Conditional Access, which of the following is a key consideration?

Target MFA requirements based on user risk and access scenarios

Avoid using MFA for privileged roles to reduce friction

Use MFA only for external users, not internal employees

Require MFA for all users, including break-glass accounts

Microsoft 365 Certified:Administrator Expert

Domain 2Objective 3

Implement and Manage Secure Access MS-102 Practice Questions (Page 1)

Part of the Implement and manage Microsoft Entra identity and access domain, which accounts for 25–30% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~10–20 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

25–30%of the exam

Questions 1–5

1application · medium
A company has enabled Microsoft Entra Identity Protection and wants to automatically block sign-ins that are flagged as high risk. They also want to require MFA for medium-risk sign-ins. Which Conditional Access policy configuration should you use?
Select an answer first
2application · medium
Your organization uses Microsoft Entra MFA. You want to ensure that users who are required to use MFA cannot bypass it by using legacy authentication protocols. What should you configure?
Select an answer first
3application · medium
A company has enabled MFA for all users. They now want to ensure that users cannot register new MFA methods without administrative approval. What should they do?
Select an answer first
4foundation · easy
When planning MFA within Conditional Access, which of the following is a key consideration?
Select an answer first
5foundation · easy
Which Microsoft Entra Identity Protection policy allows administrators to automatically block users when a specified risk level is detected?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.