Manage Roles and Role Groups MS-102 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   You need to create a custom role in Microsoft Entra ID that grants permission to manage application registrations. What must you do first?

   • ACreate a new role group in the Microsoft 365 admin center.
   • BUse Microsoft Entra admin center to create a new custom role and assign permissions.
   • CUse PowerShell to create a new role in Exchange Online.
   • DAssign the Global Administrator role to the user who will manage the custom role.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   You need to grant a user the ability to manage user accounts in Microsoft 365. Which action should you take?

   • AAdd the user to the local Administrators group on the Microsoft 365 tenant.
   • BAssign the Global Administrator role to the user in Microsoft Entra ID.
   • CAssign the User Administrator role to the user in Microsoft Entra ID.
   • DCreate a new role group in the Microsoft 365 admin center and add the user to it.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   Contoso has a global IT helpdesk that supports users across all departments. The security team wants to delegate password reset and MFA re-registration for users in the Finance department only, to a group of junior helpdesk technicians. The technicians should not have any other administrative rights. You need to implement the delegation with the least privilege. What should you do?

   • ACreate an administrative unit for Finance users, add the technicians to a role-assignable group, and assign the Helpdesk Administrator role scoped to that administrative unit.
   • BCreate a security group for Finance users and assign the Helpdesk Administrator role to that group, then add the technicians as members.
   • CAdd the technicians to the Global Administrator role and then create a custom role that denies access to non-Finance users.
   • DAssign the Password Administrator role to the technicians and scope it to the Finance department using dynamic groups.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A university uses Microsoft 365. The IT department wants to delegate the ability to manage Exchange Online mailboxes for the faculty and staff, but not for students. They also want the delegated administrators to be able to reset passwords for faculty and staff only. You need to implement this delegation with the least privilege. What should you do?

   • ACreate two administrative units: one for faculty/staff and one for students. Assign the Exchange Administrator role scoped to the faculty/staff administrative unit, and assign the Password Administrator role scoped to the same administrative unit.
   • BCreate a custom role in Exchange Online that includes mailbox management and password reset, and assign it to the delegated administrators.
   • CUse Microsoft Entra ID role-based access control to assign the User Administrator role scoped to the faculty/staff administrative unit.
   • DAssign the Exchange Administrator role and the Password Administrator role to the delegated administrators without any scoping.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   Your organization uses Microsoft 365 and has a team of helpdesk staff who need to manage user mailboxes and distribution groups, but they should not have access to other user attributes like job titles or department. You need to grant the appropriate permissions. What should you do?

   • AAssign the Global Administrator role to the helpdesk staff and then remove their access to user profile settings.
   • BCreate a custom role in Exchange Online that includes only the permissions to manage recipients and distribution groups, and assign it to the helpdesk staff.
   • CAdd the helpdesk staff to the User Administrator role and then use administrative units to limit their access to specific users.
   • DAssign the Exchange Administrator role to the helpdesk staff in Microsoft Entra ID.
   Reveal Solution Discussion Select an answer first