Associate-level certification covering deployment and management of a Microsoft 365 tenant, identity and access, threat protection with Defender XDR, and compliance with Microsoft Purview, with a worked explanation on every practice question.
Free sample questions
No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleImplement and Manage Identity and Accessmedium
You need to turn on self-service password reset for a pilot group in the Microsoft Entra admin center. Which role grants the least privilege required to complete the configuration on the Password reset blade?
- AAssign the Authentication Policy Administrator role to the operator.check_circle Correct
- BAssign the Authentication Administrator role to the SSPR operator.
- CAssign the User Administrator role to the SSPR pilot operator.
- DAssign the Global Administrator role to the SSPR pilot operator.
Authentication Policy Administrator is the minimum role to enable SSPR via the Microsoft Entra admin center. The enable-SSPR tutorial states the configuring account needs at least the Authentication Policy Administrator role. That role can open Entra ID > Password reset and change Properties, Authentication methods, Registration, Notifications, and Customization without granting broader directory or user-management rights.
Why A is correct: Correct. The enable-SSPR tutorial states the configuring account needs at least the Authentication Policy Administrator role.
Why B is wrong: This role manages user authentication methods and credentials but does not own the tenant SSPR configuration on the Password reset blade.
Why C is wrong: User Administrator can manage users and reset passwords, but the SSPR enablement steps call out Authentication Policy Administrator as the minimum role.
Why D is wrong: Global Administrator works, but it is not the least-privileged role; the tutorial explicitly names Authentication Policy Administrator as the minimum.
lock_openFree sampleImplement and Manage Identity and Accesshard
A compliance lead asks you to weaken the administrator SSPR policy so admins can use one method and security questions like end users. Configuring the SSPR Authentication methods page can relax the strong two-gate admin policy for your tenant. Is this statement correct?
- AYes
- BNocheck_circle Correct
The two-gate admin SSPR policy cannot be changed; admin SSPR can only be disabled wholesale via AllowedToUseSspr. The strong two-gate administrator policy enforces two pieces of authentication data and prohibits security questions, and the documentation states this policy cannot be changed. The user-facing Authentication methods page does not relax it.
Why A is wrong: Tenants that want admins out of SSPR entirely must set the AllowedToUseSspr tenant authorization-policy flag to false; that disables admin SSPR but still does not loosen the two-gate rules while they apply.
Why B is correct: Correct. The strong two-gate administrator policy enforces two pieces of authentication data and prohibits security questions, and the documentation states this policy cannot be changed.
lock_openFree sampleImplement and Manage Identity and Accessmedium
You are scoping SSPR to a pilot via Entra ID > Password reset > Properties with Self service password reset enabled set to Selected. Your pilot spans three Microsoft Entra security groups. Which approach matches the platform's behaviour in the admin center?
- ANest the three pilot groups inside one parent group and select that parent group for SSPR.check_circle Correct
- BAdd all three groups directly on the Properties page using the multi-group picker.
- CSwitch Self service password reset enabled to All, then exclude every non-pilot account.
- DRun the configuration three times in sequence, picking a different group on each save.
Only one group can be scoped for SSPR via the admin center, but nested groups are supported. The tutorial documents that only one Microsoft Entra group can be enabled for SSPR via the Microsoft Entra admin center, but nested groups are supported. Wrapping the three pilot groups in a single parent group satisfies both constraints.
Why A is correct: Correct. The tutorial documents that only one Microsoft Entra group can be enabled for SSPR via the Microsoft Entra admin center, but nested groups are supported.
Why B is wrong: Only one Microsoft Entra group can be enabled for SSPR via the admin center, so the picker does not accept three peer groups.
Why C is wrong: The Properties page exposes None, Selected, or All; there is no per-user exclusion list when All is chosen.
Why D is wrong: Saving a new group replaces the previously selected group; only one group remains scoped at any time.
Frequently asked questions
- How many questions are on the MS-102 exam?
- The Microsoft 365 Administrator (MS-102) (MS-102) exam has Typically 40 to 60 questions questions and runs for 120 minutes. The format is multiple choice, multiple response, and case studies, at a pearson vue testing center or online proctored.
- What score do I need to pass MS-102?
- The pass mark is 700 / 1000. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the MS-102 exam cost?
- The exam costs 165 USD to sit. Practising on Examworthy is free to start, with a worked explanation on every question.
- How does Examworthy help me prepare for MS-102?
- Every practice question carries a worked explanation and a per-distractor rationale, mapped to the official blueprint domains. You learn why each answer is right or wrong, not just the letter.
- Is Examworthy affiliated with Microsoft?
- No. Examworthy is not affiliated with or endorsed by Microsoft. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. MS-102 and related marks belong to their respective owners.
