Question 1

An administrator reviews the group-based licensing report and finds several users showing 'Errors and issues' for a license assigned through a security group. One specific error states the user cannot be assigned the license because of a conflicting service plan. What is the FIRST step the administrator should take to resolve this?

Accepted Answer

Correct answer: C. When group-based licensing encounters a conflicting service plan error, the resolution path is: navigate to Billing, then Licenses in the Microsoft 365 admin center, select the affected product license, locate the group, view users in error state, and review the specific error type. A conflicting service plan error means two service plans from different licenses cannot be simultaneously enabled for the same user. The administrator must identify and resolve the conflict - for example by removing one conflicting service plan from the assignment - then reprocess the affected users.

Question 2

An administrator assigns the User Administrator role to a scoped admin for an administrative unit (AU) that contains a security group. The group itself is added as a member of the AU. A new employee joins and is added to that group. Can the scoped admin reset that new employee's password?

Accepted Answer

Correct answer: B. A critical AU scoping rule: adding a group to an administrative unit places the GROUP OBJECT in scope, but NOT the group's individual members. A User Administrator scoped to the AU can manage the group's name and membership, but cannot reset passwords or manage user properties of individual group members unless those users are also added directly to the administrative unit as members.

Question 3

A tenant-wide sign-in problem prevents all your admins from signing in to the Microsoft 365 admin center, so you can't open the Service health page. What is the recommended way to check whether Microsoft is aware of a broad outage?

Accepted Answer

Correct answer: B. When the admin portals themselves are unreachable, Microsoft publishes status on the unauthenticated Service health status page at status.cloud.microsoft, which doesn't require signing in - exactly for the 'can't sign in' scenario.

Question 4

An analyst used Threat Explorer's Take action wizard to propose a soft-delete on a cluster of malicious emails, selecting 'Create new' (two-step approval). Where in the Microsoft Defender portal does an authorized admin go to approve or reject that pending remediation and review its history?

Accepted Answer

Correct answer: D. Manual remediations proposed with two-step approval, along with pending automated investigation and response (AIR) actions, are approved or rejected in the unified Action center (Actions & submissions, then Action center) on the Pending tab. After approval, they move to the History tab, which shows remediation actions for the past 30 days.

Question 5

You grant a help-desk agent Full Access to 30 shared mailboxes but do NOT want all 30 to auto-load in their Outlook profile. How do you grant Full Access without automapping?

Accepted Answer

Correct answer: A. Automapping (which auto-loads the mailbox in Outlook via Autodiscover) is on by default when Full Access is granted. Running Add-MailboxPermission with -AutoMapping $false grants Full Access without auto-loading the mailboxes (assigning Full Access to a mail-enabled security group also avoids automapping).

Question 6

An administrator adds the custom domain contoso.com to Microsoft 365 and starts to enable DKIM signing. On the DKIM tab in the Microsoft Defender portal the domain status shows CnameMissing. To publish DKIM in DNS at the registrar, what records must the administrator create?

Accepted Answer

Correct answer: A. When DKIM is enabled for a custom domain, Microsoft 365 generates two key pairs and requires two CNAME records, selector1._domainkey and selector2._domainkey, which point to Microsoft-hosted public keys. Only one selector is active at a time; the second becomes active only after a future key rotation. DKIM uses CNAME records, unlike SPF and DMARC, which are TXT records.

Question 7

A new admin was told to open the Microsoft Purview compliance portal at compliance.microsoft.com to manage DLP and sensitivity labels, but that portal has been retired. Where do these compliance solutions now live, and what happened to the Classification area?

Accepted Answer

Correct answer: C. Microsoft Learn refers to 'the retired Microsoft Purview compliance portal' and directs admins to the unified Microsoft Purview portal at purview.microsoft.com. Among the relocated features, Learn notes 'Classification is renamed to Classifiers and moved to the left-navigation area for each solution.'

Question 8

A non-IT change-management lead needs to view ONLY the tenant-level and group-level Adoption Score aggregates - no individual reports and no other admin data. Which single role best follows the principle of least privilege?

Accepted Answer

Correct answer: A. The Usage Summary Reports Reader role can see only tenant-level aggregates and group-level aggregates in Microsoft 365 usage analytics and Adoption Score. That is the narrowest role that satisfies the requirement.

Question 9

A content designer must be able to build phishing payloads for later Attack simulation training campaigns, but must NOT be able to launch or manage simulations. Which role assignment follows the principle of least privilege?

Accepted Answer

Correct answer: C. The Attack Payload Author role lets a user create attack payloads that an admin can initiate later, without granting the ability to launch simulations. Attack Simulation Administrator can create and manage all aspects of campaigns (including launching), and Security Administrator is far broader, so both violate least privilege.

Question 10

An analyst opens Activity explorer to investigate a sensitivity-label downgrade a user says happened 45 days ago, but the event does not appear even after widening the date filter. What is the most likely reason?

Accepted Answer

Correct answer: D. Microsoft Learn states that 'Activity explorer reports on up to 30 days worth of data.' A 45-day-old event falls outside that window. For older look-back, the analyst should use the audit log search, which has its own, longer retention.

Question 11

A team lead should be able to assign and remove Microsoft 365 licenses for users and edit their usage location, but must not be able to create or delete user accounts or reset passwords. Which single role follows least privilege?

Accepted Answer

Correct answer: B. License Administrator can assign/remove licenses, edit usage location, and reprocess or assign group-based licenses - but can't create/delete users or reset passwords, which matches the requirement exactly.

Question 12

Your organization still manages authentication methods in the legacy multifactor authentication policy and the legacy SSPR Authentication methods policy. Which statement about these legacy policies is accurate?

Accepted Answer

Correct answer: C. Microsoft announced deprecation of managing authentication methods in the legacy MFA and SSPR policies. Beginning September 30, 2025, methods can no longer be managed in those legacy policies, and organizations should migrate method management to the converged Authentication methods policy (a migration wizard is available to help).

Question 13

In Exchange Online PowerShell, which cmdlet searches message trace data across the last 90 days, returns at most 10 days of data per query, and returns only the last 48 hours if run with no parameters?

Accepted Answer

Correct answer: A. Get-MessageTraceV2 is the current cmdlet for interactive message trace: it searches up to 90 days of data, limits each query to a 10-day window, and defaults to the last 48 hours when run without parameters.

Question 14

A custom quarantine policy that grants Full access (including the release permission) is assigned to the high confidence phishing verdict in an anti-spam policy. A user opens a message that was quarantined as high confidence phishing and tries to release it. What happens?

Accepted Answer

Correct answer: A. As part of secure by default, recipients can never release their own messages quarantined as high confidence phishing by anti-spam policies (also malware by anti-malware policies, or malware/phishing by Safe Attachments), regardless of how the quarantine policy is configured. If the policy allows releasing, users can only request release, which requires admin approval.

Question 15

Following a divestiture, an administrator tries to remove the custom domain fabrikam.com from the Microsoft 365 tenant, but the removal fails with an error. Which set of conditions must be true before Microsoft 365 will allow the domain to be removed?

Accepted Answer

Correct answer: A. Microsoft's remove-a-domain documentation lists the preconditions: the domain must not be the default domain; no users, shared mailboxes, resource mailboxes, or contacts may use it; no Microsoft 365 groups, distribution lists, or teams may use it; and it must not be used for sign-in by any admin account. Every remaining reference blocks removal. Once cleared, removal can take as little as five minutes for a lightly referenced domain, or up to a day when many references existed. When a domain is removed, affected accounts revert to the .onmicrosoft.com fallback address as their primary SMTP/UPN. For tenants with hundreds or thousands of users, Learn recommends moving users with PowerShell (Update-MgUser) rather than the UI, because a single missed account blocks the removal.

Question 16

Legal needs a 20-GB, currently unlicensed shared mailbox placed on Litigation Hold. What is required to do this?

Accepted Answer

Correct answer: C. A shared mailbox needs no license for basic storage up to 50 GB, but placing it on Litigation Hold requires an Exchange Online Plan 2 license, or an Exchange Online Plan 1 license with the Exchange Online Archiving add-on.

Question 17

A user belongs to two Microsoft Entra groups. Group one is targeted by the Cloud Policy configuration 'Sales-Baseline' (priority 3), which sets an Office security setting to Disabled. Group two is targeted by 'Security-Strict' (priority 1), which sets the same setting to Enabled. A domain Group Policy Object on the user's Windows PC also configures the same setting with a third value. Which value applies when the user opens Excel?

Accepted Answer

Correct answer: A. Two precedence rules from the Cloud Policy documentation resolve this. First, when a user is in multiple Microsoft Entra groups with conflicting policy settings, priority determines which setting applies: the highest priority wins, and 0 is the highest priority you can assign - so 'Security-Strict' at priority 1 beats 'Sales-Baseline' at priority 3. Priorities are managed with Reorder priority on the Policy configurations page. Second, policy settings implemented through Cloud Policy take precedence over settings implemented by Group Policy on Windows Server, and over preference or locally applied settings - so the GPO's value loses regardless. The user gets the 'Security-Strict' Enabled value.

Question 18

An admin has added contoso.com in the Microsoft 365 admin center and must prove the organization owns the domain before it can be used. An external registrar hosts the DNS. Which DNS record does Microsoft 365 have the admin create to verify ownership?

Accepted Answer

Correct answer: B. Domain ownership is verified by adding the TXT record Microsoft supplies (value MS=ms########) at the root/@. This TXT method is the default and doesn't affect mail flow; once verified you add the service records (MX, CNAME, etc.).

Question 19

An enterprise plans a Microsoft 365 multitenant organization (MTO) to unify collaboration across several of its Microsoft Entra tenants. What is the supported maximum number of active tenants (including the owner tenant), and which license is required?

Accepted Answer

Correct answer: C. A multitenant organization supports a maximum of 100 active tenants, including the owner tenant. It requires Microsoft Entra ID P1 (one P1 per employee per MTO, and at least one P1 per tenant). To exceed 100 tenants you must submit a support request.

Question 20

A Microsoft Defender for Office 365 Plan 1 admin wants to investigate email from three weeks ago and then use the Take action wizard to soft-delete malicious messages that were already delivered. They can view detections but cannot perform post-delivery remediation. Why?

Accepted Answer

Correct answer: D. Real-time detections (Plan 1) surfaces detections at the time of delivery only and lacks the Take action remediation wizard. Threat Explorer (Plan 2) adds post-delivery views and remediation actions such as soft delete and hard delete, which also require the Search and Purge role.

Question 21

A messaging specialist must manage Exchange Online mail flow (transport) rules, mailbox settings, and Microsoft 365 group mail settings, but must not manage SharePoint, Teams, or user accounts. A colleague who holds only the Teams Administrator role finds they cannot edit transport rules at all. Following least privilege, which single role best fits the messaging specialist?

Accepted Answer

Correct answer: A. The Exchange Administrator role maps to the Organization Management role group in Exchange Online, granting full management of mail flow (transport) rules, mailbox settings, and group mail settings, without SharePoint, Teams, or user rights. Service-admin roles are siloed - a Teams Administrator maps to no Exchange Online role group, which is why they cannot edit transport rules.

Question 22

Group A and Group B are both assigned the same Microsoft 365 E5 license through group-based licensing. You must move a user from Group A to Group B with no interruption to their licensed services. What is the correct order of operations?

Accepted Answer

Correct answer: C. Microsoft's documented method is to add the user to the destination group first, confirm the inherited license has applied, and only then remove them from the source group. Removing from the source first leaves the user unlicensed until group-based licensing finishes processing the new assignment - a gap that can be longer in large tenants.

Question 23

A vendor engineer needs to view Service health, open and manage service requests (support tickets), and read and share Message center posts - but must not be able to reset passwords or change any other settings. Following least privilege, which single role should you assign?

Accepted Answer

Correct answer: B. The Service Support Administrator role is scoped exactly to opening and managing service requests, viewing and sharing Message center posts, and monitoring Service health, without password-reset or configuration rights - the least-privileged fit for this task.

Question 24

An administrator must stop group owners from adding any NEW guests to Microsoft 365 Groups, while ensuring guests already in existing groups keep their current access. In the Microsoft 365 admin center, at Settings, then Org settings, then Services, then Microsoft 365 Groups, which configuration achieves this?

Accepted Answer

Correct answer: A. The Microsoft 365 Groups service exposes two guest toggles: AllowToAddGuests ('Let group owners add people outside the organization to groups') and AllowGuestsToAccessGroups ('Let people outside the organization access group content'). Turning off AllowToAddGuests blocks adding new guests, while leaving AllowGuestsToAccessGroups on lets existing guests keep accessing group content.

Question 25

You configure a Conditional Access policy that requires multifactor authentication for all users accessing SharePoint Online, and you set the policy's Enable state to Report-only. In the Sign-in logs, a user who signed in from an unmanaged browser using only a password shows the policy result 'Report-only: User action required.' What does this result indicate?

Accepted Answer

Correct answer: B. In report-only mode, the platform evaluates every configured condition but never enforces interactive grant controls. Because MFA is interactive and the user is never actually prompted, Microsoft Entra cannot know whether the user would have passed, so it logs 'Report-only: User action required' rather than Success or Failure.

Question 26

A Microsoft Entra Connect Sync administrator needs to install the tool. The server that will run Connect Sync has a read-only domain controller (RODC) as its only accessible domain controller. What should the administrator know about this configuration?

Accepted Answer

Correct answer: D. Microsoft's prerequisites documentation for Microsoft Entra Connect explicitly states that the domain controller used by Microsoft Entra ID must be writable, and that using a read-only domain controller (RODC) is not supported. Microsoft Entra Connect does not follow write redirects from an RODC to a writable DC. The administrator must ensure Connect Sync can reach a writable domain controller.

Question 27

A company is undergoing an acquisition. The acquired company has an Active Directory forest that is completely disconnected from the parent company's forest, with no forest trust or network connectivity between them. The parent company wants to synchronize users from both forests into a single Microsoft Entra tenant as quickly as possible. Which synchronization approach supports this scenario natively?

Accepted Answer

Correct answer: A. Microsoft Entra Cloud Sync natively supports synchronization from multiple disconnected Active Directory forests to a single Microsoft Entra tenant without requiring forest consolidation or trust relationships. Lightweight provisioning agents are deployed in each forest independently, and the cloud-based provisioning service orchestrates the synchronization. This is an explicitly stated advantage of Cloud Sync over Connect Sync, which requires forest trusts or separate complex configurations for disconnected forests.

Question 28

Before you deploy a Conditional Access Sign-in frequency policy that forces reauthentication every 8 hours, Microsoft documentation recommends first disabling a legacy tenant setting that can otherwise cause users to be prompted unexpectedly. Which setting should you disable?

Accepted Answer

Correct answer: C. 'Remember multifactor authentication on trusted devices' is the legacy setting that collides with Sign-in frequency. Microsoft's Conditional Access session-lifetime guidance says to disable it before deploying a Sign-in frequency policy, because running both at once can prompt users at unexpected intervals.

Question 29

An auditor discovers that a user whose on-premises Active Directory password expired three weeks ago can still sign in to Microsoft 365 using that expired password. The environment uses Microsoft Entra Connect Sync with password hash synchronization. Why is this happening, and what is the supported way to change the behavior?

Accepted Answer

Correct answer: A. Microsoft's PHS documentation states that if a user is in scope of password hash synchronization, the cloud password is set to Never Expire by default - Connect stamps DisablePasswordExpiration into the user's PasswordPolicies attribute every time a hash syncs. The user can continue signing in to cloud services with a password that has expired on-premises, until they change it on-premises and the new hash synchronizes. To enforce expiration in the cloud, the tenant enables the CloudPasswordPolicyForPasswordSyncedUsersEnabled feature via Microsoft Graph PowerShell (Update-MgDirectoryOnPremiseSynchronization); Microsoft recommends enabling it before the initial hash sync so DisablePasswordExpiration is never stamped in the first place.

Question 30

Before deploying Microsoft Entra Connect Sync, an administrator wants to identify duplicate UPN values, formatting problems, and missing required attributes in the on-premises Active Directory that would prevent successful synchronization. Which tool should the administrator use?

Accepted Answer

Correct answer: B. IdFix is the purpose-built tool for scanning an on-premises Active Directory before enabling synchronization. It identifies errors such as duplicate values, formatting problems, and missing attributes (such as blank displayName) that would cause synchronization failures. Microsoft's prerequisites documentation specifically recommends running IdFix before synchronizing to Microsoft Entra ID.

Question 31

In the legacy multifactor authentication service settings, you configure the 'Trusted IPs' feature so that sign-ins from your corporate network bypass MFA prompts. Which statement about this legacy trusted IPs feature is correct?

Accepted Answer

Correct answer: C. The legacy MFA trusted IPs feature accepts only IPv4 ranges (public ranges for cloud MFA; private ranges only with MFA Server), allows up to 50 IP ranges, and requires Microsoft Entra ID P1. Microsoft recommends named locations instead, largely because they add IPv6 support.

Question 32

You are creating IP-based named locations for Conditional Access. Which of the following configurations is NOT allowed by Microsoft Entra named location limits?

Accepted Answer

Correct answer: B. IP-based named locations are limited to no more than 195 named locations per tenant, no more than 2,000 IP ranges per named location, and CIDR masks greater than /8. A 196th named location exceeds the 195-location cap.

Question 33

A junior administrator needs to turn on security defaults in the Microsoft Entra admin center under Entra ID, then Overview, then Properties, then Manage security defaults. Following least privilege, what is the minimum role that can configure the security defaults setting?

Accepted Answer

Correct answer: D. Microsoft documents that you must be assigned at least the Conditional Access Administrator role to configure security defaults. Although Global Administrator can also do it, Conditional Access Administrator is the least-privileged option.

Question 34

A user's per-user MFA state is set to 'Enabled,' but the user has never registered any authentication methods. What happens the next time the user signs in using modern authentication in a web browser?

Accepted Answer

Correct answer: D. In the Enabled state, a user with no registered methods is prompted to register the next time they sign in with modern authentication. Completing registration automatically promotes the user from Enabled to Enforced.

Question 35

Your security policy requires that employees on personal, unmanaged Windows PCs be able to open and read files in SharePoint Online and OneDrive through a web browser, but must not be able to download, print, or sync them. Managed (Intune-compliant or Entra hybrid-joined) devices must keep full access. Which configuration meets this requirement?

Accepted Answer

Correct answer: D. The SharePoint admin center's 'Allow limited, web-only access' control for unmanaged devices gives those users browser-only access with no ability to download, print, or sync files, while managed devices keep full access. Behind the scenes it provisions a Microsoft Entra Conditional Access policy that applies app-enforced restrictions.

Question 36

After tagging your CEO and CFO as priority accounts, you want them to receive the differentiated protection with executive-tuned heuristics that priority account protection provides. What is required for this differentiated protection to apply?

Accepted Answer

Correct answer: C. Priority account protection - the differentiated, executive-tuned heuristics - is a Defender for Office 365 Plan 2 capability and is turned on by default. The tag alone isn't enough without Plan 2.

Question 37

The group 'Contoso Executives' is included in both the Strict preset security policy and a custom anti-spam policy that you set to priority 0 (the highest custom priority). A bulk email arrives for a member of that group. Which policy's anti-spam settings are actually applied?

Accepted Answer

Correct answer: B. Preset security policies always take precedence over custom and default policies. The order of precedence is Strict preset, then Standard preset, then custom policies (by priority), then the Built-in protection preset and default policies. So the Strict preset settings win regardless of the custom policy's priority value.

Question 38

Legitimate mail from a business partner is landing in quarantine. The partner sends through a third-party service, so the Authentication-Results header shows spf=pass and dkim=pass for the service's own domain, but dmarc=fail (no alignment with the From-header domain) and compauth=fail. Spoof intelligence is flagging the sender as spoofed. What is the recommended remediation to reliably allow the partner's mail?

Accepted Answer

Correct answer: D. The targeted fix for a spoof-intelligence false positive is a spoof allow entry for the spoofed-user/sending-infrastructure domain pair on the Spoofed senders tab of the Tenant Allow/Block List (New-TenantAllowBlockListSpoofItems). The trap is the passing SPF and DKIM: they authenticate the third-party service's own domain, not the partner's From-header domain, so DMARC fails on alignment, composite authentication fails (compauth=fail), and spoof intelligence flags the mail as spoofed. Spoofed-sender allow entries account for intra-org, cross-org, and DMARC spoofing, and they never expire.

Question 39

Your organization wants to protect 420 named executives and VIPs from user (sender) impersonation using a single anti-phishing policy in Microsoft Defender for Office 365. When you try to add all of them to user impersonation protection, you cannot. What is the limitation and the correct remedy?

Accepted Answer

Correct answer: B. Each anti-phishing policy in Defender for Office 365 supports a maximum of 350 users for user impersonation protection. To protect more than 350 named users, distribute them across multiple anti-phishing policies (accounting for the order of precedence between those policies).

Question 40

A user reports that an internal SharePoint URL your team added to the 'Do not rewrite the following URLs' list in a custom Safe Links policy is still blocked when the user clicks it inside a Microsoft Teams chat. Clicking the same URL in an Outlook email works fine. What is the most likely reason?

Accepted Answer

Correct answer: B. The 'Do not rewrite the following URLs' list is honored during mail flow for email, but Microsoft Teams and Office web apps don't recognize the list and can still block the URL at time of click based on Safe Links scanning results. A truly universal allow (everywhere) requires an allow entry in the Tenant Allow/Block List.

Question 41

In the Microsoft Defender portal (security.microsoft.com), under which top-level section do you find Threat Explorer / Real-time detections, Threat policies (Safe Links, Safe Attachments, anti-phishing), and email quarantine?

Accepted Answer

Correct answer: C. Email and collaboration security features (Threat Explorer/Real-time detections, Threat policies under Policies & rules, quarantine, and submissions) are located under the Email & collaboration section of the unified Microsoft Defender portal.

Question 42

You use custom threat policies and want to audit how their settings have changed over time and see whether each change raised or lowered your overall security posture. Which tab of the Configuration analyzer provides this?

Accepted Answer

Correct answer: A. The Configuration analyzer has three tabs: Standard recommendations, Strict recommendations, and Configuration drift analysis and history. The Configuration drift analysis and history tab audits and tracks threat-policy changes over a selected timeframe and shows whether each change increased or decreased your posture.

Question 43

You create a fingerprint-based sensitive information type from a Word template. Which of the following documents will document fingerprinting successfully detect?

Accepted Answer

Correct answer: C. Document fingerprinting matches files that are text-based, not password protected, contain all the text from the original form, and are 4 MB or smaller. A 1 MB .docx that retains all the original form text meets every condition, so it's detected.

Question 44

Your organization wants to onboard Windows client devices for Endpoint DLP in Microsoft Purview. What is the minimum Windows 10 version supported for Endpoint DLP?

Accepted Answer

Correct answer: C. Endpoint DLP supports Windows 10 version 1809 and later, Windows 11, and Windows Server 2019 and later (x64), plus the three latest released major versions of macOS.

Question 45

You are preparing seed content to train a custom trainable classifier in Microsoft Purview. What is the minimum number of positive and negative samples required to train the classifier?

Accepted Answer

Correct answer: D. A custom trainable classifier requires at least 50 positive samples (up to 500) and at least 150 negative samples (up to 1,500). Only text-based files count; image files and image-only PDFs aren't supported, and the classifier processes up to the 2,000 most recently created samples.

Question 46

You must prevent users from copying documents that contain sensitive information types to USB drives on managed Windows 11 endpoints, using Microsoft Purview Endpoint DLP. Your tenant is licensed for Microsoft 365 E3. What is the minimum licensing change required?

Accepted Answer

Correct answer: C. The trap is assuming E3's DLP coverage extends to devices. Microsoft Learn's licensing guidance draws the line clearly: DLP for Exchange, SharePoint, and OneDrive is available at E3, but Endpoint DLP (activity detection/protection for items on Windows and macOS devices) requires Microsoft 365 E5/A5/G5, E5 Compliance, or E5 Information Protection & Governance.

Question 47

You configure an Endpoint DLP policy that uses an Exact Data Match SIT and a trainable classifier as conditions, but it never matches on your onboarded Windows devices, even though the same policy matches in Exchange and SharePoint. Which endpoint setting must you enable?

Accepted Answer

Correct answer: B. On devices, EDM, document fingerprinting, trainable classifiers, and named entities are evaluated only when Advanced classification scanning and protection is turned on in the Endpoint DLP settings. Without it, these advanced classifiers won't match locally even though they work service-side.

Question 48

You are exporting a sensitive information source table to build an Exact Data Match (EDM) sensitive information type. What is the maximum number of columns (fields) allowed per data source?

Accepted Answer

Correct answer: C. An EDM sensitive information source table can contain up to 100 million rows of data and up to 32 columns (fields) per data source, of which up to 10 columns can be marked as searchable. The number of columns in the source table must match the number of fields in the schema.

Question 49

You are configuring multi-stage disposition review on a retention label in Microsoft Purview records management. What is the maximum number of consecutive disposition review stages you can configure?

Accepted Answer

Correct answer: A. A retention label supports up to five consecutive disposition review stages. Each stage can have up to 10 reviewers, specified as individual users or mail-enabled security groups (Microsoft 365 Groups aren't supported as reviewers).

Question 50

You create an adaptive user scope with the attribute Country or region 'is equal to' Europe. Your users have values such as France, Germany, and Spain in that attribute. After a day, the scope shows zero members. What is the most likely cause?

Accepted Answer

Correct answer: C. Adaptive scope queries run once daily against Entra ID and match the exact attribute value you specify. Because the query doesn't run immediately, there's no validation that you typed a valid value. 'Europe' is not a value stored in the Country or region attribute (accounts hold specific countries like France), so nothing matches. You'd use grouped country values or an advanced OPATH query instead.

Question 51

A contract in SharePoint has a retention label that marks items as a record, configured to unlock records by default, and record versioning is enabled for the tenant. A user needs to edit the contract while keeping the prior version preserved as a record. Which statement correctly describes record versioning behavior?

Accepted Answer

Correct answer: A. With record versioning (SharePoint/OneDrive only), a record's status toggles between Locked and Unlocked. When Unlocked, the record can be edited; a new version is retained as a record only when the record is set back to Locked. This lock/unlock toggle avoids retaining unnecessary versions. Editing is blocked while Locked. Record versioning isn't supported for regulatory records (which block editing) or for Exchange items.

Question 52

You need a single Microsoft Purview retention policy that targets both Teams channel messages and Viva Engage community messages, and the membership must update automatically as employees change departments. Which scope configuration meets the requirement with the fewest policies?

Accepted Answer

Correct answer: B. Teams channel messages (standard/shared/private post-migration) and Viva Engage community messages are targeted through the Microsoft 365 Groups adaptive-scope type. A key advantage of adaptive scopes is that a single policy can include locations for both Microsoft Teams and Viva Engage, whereas without an adaptive scope each location requires its own policy. The dynamic query runs daily against Entra ID, so membership updates automatically.

Question 53

Your organization declares certain SEC-regulated documents as regulatory records using a retention label. Two years into a 7-year retention period, a Global Administrator is asked to remove the label from one document and to shorten the retention period on the label. What can the Global Administrator do?

Accepted Answer

Correct answer: C. The defining trait of a regulatory record is irreversibility: after the label is applied, no one (including a Global Administrator) can remove it, and the label's retention period can only be lengthened, never shortened. (Standard records, by contrast, can have their label changed or removed by a container admin.) Because of this, the regulatory-records option must first be enabled via PowerShell and used deliberately.

Question 54

In the current Microsoft Purview portal, an administrator needs to create a retention policy that retains Exchange email for five years. Under which solution do they find Policies, then Retention policies, and what was that solution previously named?

Accepted Answer

Correct answer: B. Retention policies are created under Solutions, then Data Lifecycle Management, then Policies, then Retention policies in the Microsoft Purview portal. Data Lifecycle Management is the current name for the solution formerly called Information Governance. Records Management is an adjacent solution for high-value items/records and file plan; baseline retention policies live under Data Lifecycle Management.

Question 55

You create a Microsoft Purview Insider Risk Management policy from the 'Data theft by departing users' template to catch employees exfiltrating data around their exit, but the policy is not scoring any users. Which triggering event does this template require?

Accepted Answer

Correct answer: D. Microsoft Learn's policy-template table lists the 'Data theft by departing users' triggering event as a 'Resignation or termination date indicator from HR connector or Microsoft Entra account deletion.' The HR connector is optional if you instead select the 'User account deleted from Microsoft Entra' trigger. Without a triggering event, in-scope users aren't scored.

Question 56

You are configuring a Microsoft Purview Insider Risk Management policy using the Data leaks template to detect users who exfiltrate sensitive data. During setup, the policy reports no triggering event configured. Which prerequisite does the Data leaks template specifically require?

Accepted Answer

Correct answer: D. The Data leaks template triggers on DLP policy activity that creates a High severity alert (or on built-in exfiltration events / customized triggering indicators). Its prerequisite is a DLP policy configured for High severity alerts across Exchange Online, SharePoint Online, or OneDrive. Without a qualifying trigger, in-scope users aren't evaluated. The HR connector is the prerequisite for departing-user and risky-user templates; Defender for Endpoint is for security-violation templates.

Question 57

In Microsoft Purview Insider Risk Management, a triage analyst must review and investigate alerts and cases, but your privacy policy forbids them from viewing the underlying source content in Content Explorer. Following least privilege, which built-in role group should you assign?

Accepted Answer

Correct answer: B. Insider Risk Management Analysts can access and investigate alerts, cases, and notice templates but cannot access the insider risk Content Explorer (source content), which matches the requirement exactly. Investigators can access alerts/cases plus Content Explorer and forensic evidence, so they'd exceed the constraint. Admins configure policies and settings but can't investigate alerts/cases. Auditors can only view the insider risk audit log.

Question 58

A sensitivity label is configured with a footer and a watermark. You add it to a service-side auto-labeling policy for SharePoint. After the policy runs, the label is applied to documents but the footer and watermark are missing. What explains this behavior?

Accepted Answer

Correct answer: C. When a label configured with visual markings (headers, footers, watermarks) is applied through an auto-labeling policy, those markings aren't applied to the documents. Visual markings are inserted by the Office apps when the label is applied client-side, not by the service-side auto-labeling engine.

Question 59

Your organization already lets users manually apply sensitivity labels under Microsoft 365 E3. Now you want a service-side auto-labeling policy to automatically apply a sensitivity label to documents at rest in SharePoint that contain credit card numbers. What licensing is required?

Accepted Answer

Correct answer: B. Microsoft Learn's service description states manual sensitivity labeling is available at E3, but sensitivity labeling that is automatic or policy-based requires a Microsoft 365 E5 license (or Microsoft 365 Information Protection and Governance / E5 Compliance). Service-side auto-labeling of SharePoint content is therefore an E5 capability.

Question 60

You want a service-side auto-labeling policy to apply an encryption-enabled sensitivity label to existing files in SharePoint and OneDrive. Which encryption configuration must the label use so it can be selected for the SharePoint/OneDrive locations?

Accepted Answer

Correct answer: D. When an auto-labeling policy includes SharePoint or OneDrive locations, the label must be configured with Assign permissions now and User access to content expires must be set to Never. The user-assigns-permissions options (Do Not Forward / Encrypt-Only) are allowed only for Exchange-only auto-labeling policies, and S/MIME-configured labels can't be auto-applied at all.

Question 61

You previously enabled co-authoring for files with sensitivity labels for your tenant. You then discover a legacy business tool that reads labeling metadata from the old custom-properties location and is now misbehaving. How do you turn co-authoring off?

Accepted Answer

Correct answer: D. Once co-authoring for files with sensitivity labels is enabled, it can't be disabled from the Microsoft Purview portal. You must use the Set-PolicyConfig cmdlet with -EnableLabelCoauth:$false in Security & Compliance PowerShell. Be aware that disabling it can cause labeling metadata written in the new location for unencrypted files to be lost.

Question 62

After you enable co-authoring for files with sensitivity labels, users report they still can't co-author or use AutoSave on documents that carry one specific label. Which label configuration causes this?

Accepted Answer

Correct answer: D. Co-authoring and AutoSave aren't supported for documents whose label encryption sets 'User access to content expires' to any value other than Never, or that use Double Key Encryption. Those labels still appear in Office, but users are warned that co-authoring and AutoSave won't be available.

Question 63

In Compliance Manager, an improvement action is set to Automatic testing. An admin manually uploads evidence files and sets the test status on that action. What happens to automatic testing for the action?

Accepted Answer

Correct answer: A. When you bring your own testing data or evidence into an improvement action, Compliance Manager automatically turns off automatic testing for that action so it doesn't overwrite your data. You can choose to turn automatic testing back on later.

Question 64

A compliance lead wants to prioritize the improvement actions that raise the compliance score the most per action. In Compliance Manager's scoring model, which single action type is assigned the highest point value?

Accepted Answer

Correct answer: B. Compliance Manager scores each improvement action on two axes: mandatory vs discretionary, and preventative/detective/corrective. Preventative + mandatory carries the highest value at 27 points. The full model is: Preventative mandatory 27, Preventative discretionary 9, Detective mandatory 3, Detective discretionary 1, Corrective mandatory 3, Corrective discretionary 1. So preventative/mandatory actions move the score most.

MS-102 practice questions, with full explanations

The MS-102 bookshelf

Work the 75 questions, one topic at a time

Microsoft 365 Tenant Administration (24 questions)