A company wants to require MFA for all users accessing Microsoft 365 from outside the corporate network. They have a hybrid environment with Active Directory Federation Services (AD FS). What is the recommended way to enforce MFA?

Use Azure AD Identity Protection to require MFA for external access.

Create a Conditional Access policy that requires MFA for all external access.

Enable MFA in Microsoft Entra and disable AD FS.

Configure MFA in AD FS and rely on the on-premises MFA provider.

In a Conditional Access policy, which access control can be used to require a specific authentication strength?

Require device to be marked as compliant

Grant access requiring multifactor authentication

When managing Conditional Access policies, what is the purpose of the 'Report-only' mode?

To evaluate the impact of a policy without enforcing it

To block all access for users included in the policy

To automatically disable a policy if it fails

To generate a report of all sign-ins in the tenant

A company has a Conditional Access policy that requires MFA for all users. They recently acquired a new subsidiary and need to onboard their users. The subsidiary's users are in a different country and will access Microsoft 365 from that country. What should you consider when updating your Conditional Access policies?

Create a new policy that blocks access from the subsidiary's country.

Update the existing policy to include the subsidiary's users and ensure the policy's location condition is configured correctly.

Create a separate policy for the subsidiary's users that requires MFA only when they are outside their country.

Exclude the subsidiary's users from the existing MFA policy.

Your organization uses Microsoft Entra Identity Protection. You want to receive alerts when a user is flagged as high risk. What should you configure?

Configure Identity Protection to send email alerts for high-risk users.

Use Microsoft Sentinel to monitor risk detections.

Create a Conditional Access policy that blocks high-risk sign-ins.

Set up a log analytics workspace to query risk detections.

Microsoft 365 Certified:Administrator Expert

Domain 2Objective 3

Implement and Manage Secure Access MS-102 Practice Questions (Page 5)

Part of the Implement and manage Microsoft Entra identity and access domain, which accounts for 25–30% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~10–20 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

25–30%of the exam

Questions 21–25

21application · medium
A company wants to require MFA for all users accessing Microsoft 365 from outside the corporate network. They have a hybrid environment with Active Directory Federation Services (AD FS). What is the recommended way to enforce MFA?
Select an answer first
22foundation · easy
In a Conditional Access policy, which access control can be used to require a specific authentication strength?
Select an answer first
23foundation · easy
When managing Conditional Access policies, what is the purpose of the 'Report-only' mode?
Select an answer first
24application · medium
A company has a Conditional Access policy that requires MFA for all users. They recently acquired a new subsidiary and need to onboard their users. The subsidiary's users are in a different country and will access Microsoft 365 from that country. What should you consider when updating your Conditional Access policies?
Select an answer first
25application · medium
Your organization uses Microsoft Entra Identity Protection. You want to receive alerts when a user is flagged as high risk. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.