12 real MS-102 sample questions, each with an explanation of why every option is right or wrong. No account, no card. This is the reasoning the MS-102 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real MS-102 is Typically 40 to 60 questions questions in 120 minutes, pass mark 700 / 1000. For a domain-by-domain breakdown and a study plan, read the MS-102 study guide. The full bank has 199 questions.
lock_openFree sampleDeploy and Manage a Microsoft 365 Tenantmedium
A new administrator wants to add the contoso.com custom domain to your Microsoft 365 tenant. Which directory role grants the minimum permissions required to add, modify, or remove a domain?
- AUser Administrator role in the Microsoft 365 admin center
- BDomain Name Administrator role in the Microsoft 365 admin centercheck_circle Correct
- CService Support Administrator role in the Microsoft 365 admin center
- DHelpdesk Administrator role in the Microsoft 365 admin center
Adding or removing a Microsoft 365 domain requires the Domain Name Administrator role, not generic helpdesk or user roles. Microsoft Learn explicitly requires the Domain Name Administrator role to add, modify, or remove a domain because the change affects the whole tenant. Customized administrators or regular users cannot make this change.
Why A is wrong: User Administrator manages user accounts and licenses but cannot add tenant-scoped domains.
Why B is correct: Correct. Microsoft Learn explicitly requires the Domain Name Administrator role to add, modify, or remove a domain because the change affects the whole tenant.
Why C is wrong: Service Support Administrator views service health and creates service requests, not domain configuration.
Why D is wrong: Helpdesk Administrator resets passwords and views service health but cannot manage domains.
lock_openFree sampleDeploy and Manage a Microsoft 365 Tenanteasy
From which navigation path in the Microsoft 365 admin center do you configure release preferences for the tenant?
- ASetup > Sign-in and security > Manage feature updates page
- BSettings > Org settings > Organization profile > Release preferencescheck_circle Correct
- CHealth > Message center > Preferences > Release ring selector
- DSettings > Integrated apps > Release preferences page for tenant
Release preferences live under Settings > Org settings > Organization profile in the Microsoft 365 admin center. The release ring selector lives on the Organization profile tab under Settings > Org settings, where you choose Standard release, Targeted release for everyone, or Targeted release for selected users.
Why A is wrong: Setup hosts wizards for security and onboarding tasks, not the release ring selector.
Why B is correct: Correct. The release ring selector lives on the Organization profile tab under Settings > Org settings, where you choose Standard release, Targeted release for everyone, or Targeted release for selected users.
Why C is wrong: Message center preferences control digest emails, not which release ring the tenant is on.
Why D is wrong: Integrated apps manages third-party app deployment, not the Microsoft 365 release schedule.
lock_openFree sampleDeploy and Manage a Microsoft 365 Tenantmedium
An administrator must configure office locations and LAN subnets on the Network connectivity page in the Microsoft 365 admin center. Which role is documented as required to configure these elements?
- AReports Reader role assigned at the tenant scope
- BService Support Administrator role assigned at the tenant scopecheck_circle Correct
- CHelpdesk Administrator role assigned at the tenant scope
- DBilling Administrator role assigned at the tenant scope
Configuring office locations on Network connectivity requires Service Support Administrator; Report Reader only grants read access. Microsoft Learn states that to configure locations and other elements of network connectivity, an administrator must have the Service Support Administrator role. The Report Reader role only grants read access to network insights.
Why A is wrong: Reports Reader can view aggregated reports but cannot configure locations.
Why B is correct: Correct. Microsoft Learn states that to configure locations and other elements of network connectivity, an administrator must have the Service Support Administrator role.
Why C is wrong: Helpdesk Administrator can read service health and reset passwords, not configure network connectivity.
Why D is wrong: Billing Administrator manages subscriptions and invoices, not network configuration.
lock_openFree sampleManage Security and Threats by Using Microsoft Defender XDRmedium
You sign in to the Microsoft Defender portal as a Defender for Office 365-only customer. Why do you not see device protection features or the Defender for Endpoint device inventory in the portal?
- AThe portal hides features for products you have not licensed and provisioned.check_circle Correct
- BDevice protection requires a separate browser session at the Endpoint portal.
- CDefender XDR has not been turned on for the tenant from the Settings page.
- DThe Microsoft Entra ID role assigned is missing the Endpoint operator scope.
Apply the documented Microsoft 365 / Microsoft Entra ID behaviour to the scenario. In the Microsoft Defender portal customers see only the security features their subscription includes. With Defender for Office 365 but no Defender for Endpoint license, device protection features are not surfaced.
Why A is correct: Correct. In the Microsoft Defender portal customers see only the security features their subscription includes.
Why B is wrong: There is no separate Endpoint portal; the Defender portal at security.microsoft.com is the unified surface.
Why C is wrong: Turning on Defender XDR does not provision Defender for Endpoint; licensing is the gating factor.
Why D is wrong: Roles control access to surfaced features, not whether unlicensed product features appear at all.
lock_openFree sampleManage Security and Threats by Using Microsoft Defender XDRmedium
A SOC analyst needs to view, but not modify, alert tuning rules and assigned incidents in the Microsoft Defender portal. Which Microsoft Entra ID built-in role grants the least privilege required?
- ASecurity Readercheck_circle Correct
- BSecurity Operator
- CSecurity Administrator
- DGlobal Reader
Apply the documented Microsoft 365 / Microsoft Entra ID behaviour to the scenario. Security Reader provides read-only access to security data and configuration in the Microsoft Defender portal, including viewing alert tuning rules and incident assignments.
Why A is correct: Correct. Security Reader provides read-only access to security data and configuration in the Microsoft Defender portal, including viewing alert tuning rules and incident assignments.
Why B is wrong: Security Operator allows acting on alerts and incidents; that exceeds read-only need.
Why C is wrong: Security Administrator can manage policies and is more than required for a viewer.
Why D is wrong: Global Reader is a broad cross-service read role and grants more than required for the Defender portal task.
lock_openFree sampleManage Security and Threats by Using Microsoft Defender XDRmedium
An analyst resolves an incident in the Microsoft Defender portal. What happens to the alerts that were linked to that incident?
- AAll linked active alerts are also resolved automatically.check_circle Correct
- BLinked alerts remain Active until each is closed manually.
- CLinked alerts are merged into a new resolved incident container.
- DOnly alerts from Defender for Office 365 in the incident are resolved.
Apply the documented Microsoft 365 / Microsoft Entra ID behaviour to the scenario. Resolving an incident also resolves all the linked and active alerts related to the incident.
Why A is correct: Correct. Resolving an incident also resolves all the linked and active alerts related to the incident.
Why B is wrong: Manual per-alert closure is not required; resolution cascades from incident to its alerts.
Why C is wrong: Resolution does not move alerts into a new container; they stay in the same incident.
Why D is wrong: The behaviour is not source-specific; all linked active alerts resolve regardless of source product.
lock_openFree sampleImplement and Manage Identity and Accessmedium
You need to turn on self-service password reset for a pilot group in the Microsoft Entra admin center. Which role grants the least privilege required to complete the configuration on the Password reset blade?
- AAssign the Authentication Policy Administrator role to the operator.check_circle Correct
- BAssign the Authentication Administrator role to the SSPR operator.
- CAssign the User Administrator role to the SSPR pilot operator.
- DAssign the Global Administrator role to the SSPR pilot operator.
Authentication Policy Administrator is the minimum role to enable SSPR via the Microsoft Entra admin center. The enable-SSPR tutorial states the configuring account needs at least the Authentication Policy Administrator role. That role can open Entra ID > Password reset and change Properties, Authentication methods, Registration, Notifications, and Customization without granting broader directory or user-management rights.
Why A is correct: Correct. The enable-SSPR tutorial states the configuring account needs at least the Authentication Policy Administrator role.
Why B is wrong: This role manages user authentication methods and credentials but does not own the tenant SSPR configuration on the Password reset blade.
Why C is wrong: User Administrator can manage users and reset passwords, but the SSPR enablement steps call out Authentication Policy Administrator as the minimum role.
Why D is wrong: Global Administrator works, but it is not the least-privileged role; the tutorial explicitly names Authentication Policy Administrator as the minimum.
lock_openFree sampleImplement and Manage Identity and Accesshard
A compliance lead asks you to weaken the administrator SSPR policy so admins can use one method and security questions like end users. Configuring the SSPR Authentication methods page can relax the strong two-gate admin policy for your tenant. Is this statement correct?
- AYes
- BNocheck_circle Correct
The two-gate admin SSPR policy cannot be changed; admin SSPR can only be disabled wholesale via AllowedToUseSspr. The strong two-gate administrator policy enforces two pieces of authentication data and prohibits security questions, and the documentation states this policy cannot be changed. The user-facing Authentication methods page does not relax it.
Why A is wrong: Tenants that want admins out of SSPR entirely must set the AllowedToUseSspr tenant authorization-policy flag to false; that disables admin SSPR but still does not loosen the two-gate rules while they apply.
Why B is correct: Correct. The strong two-gate administrator policy enforces two pieces of authentication data and prohibits security questions, and the documentation states this policy cannot be changed.
lock_openFree sampleImplement and Manage Identity and Accessmedium
You are scoping SSPR to a pilot via Entra ID > Password reset > Properties with Self service password reset enabled set to Selected. Your pilot spans three Microsoft Entra security groups. Which approach matches the platform's behaviour in the admin center?
- ANest the three pilot groups inside one parent group and select that parent group for SSPR.check_circle Correct
- BAdd all three groups directly on the Properties page using the multi-group picker.
- CSwitch Self service password reset enabled to All, then exclude every non-pilot account.
- DRun the configuration three times in sequence, picking a different group on each save.
Only one group can be scoped for SSPR via the admin center, but nested groups are supported. The tutorial documents that only one Microsoft Entra group can be enabled for SSPR via the Microsoft Entra admin center, but nested groups are supported. Wrapping the three pilot groups in a single parent group satisfies both constraints.
Why A is correct: Correct. The tutorial documents that only one Microsoft Entra group can be enabled for SSPR via the Microsoft Entra admin center, but nested groups are supported.
Why B is wrong: Only one Microsoft Entra group can be enabled for SSPR via the admin center, so the picker does not accept three peer groups.
Why C is wrong: The Properties page exposes None, Selected, or All; there is no per-user exclusion list when All is chosen.
Why D is wrong: Saving a new group replaces the previously selected group; only one group remains scoped at any time.
lock_openFree sampleManage Compliance by Using Microsoft Purviewmedium
Which forms can the Primary element of a custom sensitive information type pattern take? (Select 3 answers)
- ARegular expressioncheck_circle Correct
- BKeyword listcheck_circle Correct
- CKeyword dictionarycheck_circle Correct
- DTrainable classifier
- ESensitivity label
Apply the documented Microsoft 365 / Microsoft Entra ID behaviour to the scenario. Primary element options for a custom SIT pattern are: Regular expression, Keyword list, Keyword dictionary, or one of the preconfigured Functions. Trainable classifiers and sensitivity labels are separate Purview features.
Why A is correct: Correct. Regular expression is one of the keyed answers. Primary element options for a custom SIT pattern are: Regular expression, Keyword list, Keyword dictionary, or one of the preconfigured Functions.
Why B is correct: Correct. Keyword list is one of the keyed answers. Primary element options for a custom SIT pattern are: Regular expression, Keyword list, Keyword dictionary, or one of the preconfigured Functions.
Why C is correct: Correct. Keyword dictionary is one of the keyed answers. Primary element options for a custom SIT pattern are: Regular expression, Keyword list, Keyword dictionary, or one of the preconfigured Functions.
Why D is wrong: Trainable classifiers are a separate classification mechanism and cannot be the Primary element of a SIT pattern.
Why E is wrong: Sensitivity labels are applied as a result of classification; they do not define a SIT primary element.
lock_openFree sampleManage Compliance by Using Microsoft Purviewmedium
You are creating a custom sensitive information type in the Microsoft Purview portal to detect a proprietary employee ID format. You need to define the core element that triggers detection and an optional element that increases confidence when found nearby. Which two element categories must you configure?
- APrimary element and supporting elementcheck_circle Correct
- BDefault classifier and trainable classifier
- CAdaptive scope and policy filter
- DAuto-label condition and manual override
Apply the documented Microsoft 365 / Microsoft Entra ID behaviour to the scenario. When you create a custom SIT in Information Protection > Classifiers > Sensitive info types > Create sensitive info type, each pattern requires a Primary element and may include one or more Supporting elements, each with their own character proximity.
Why A is correct: Correct. When you create a custom SIT in Information Protection > Classifiers > Sensitive info types > Create sensitive info type, each pattern requires a Primary element and may include one or more Supporting elements, each with their own character proximity.
Why B is wrong: Trainable classifiers are a separate Purview content-classification mechanism; they are not components of a SIT pattern.
Why C is wrong: Adaptive scopes are used by retention and DLP policy targeting, not by SIT pattern definitions.
Why D is wrong: Auto-labelling consumes a SIT as a condition; it is not part of how the SIT itself is structured.
lock_openFree sampleManage Compliance by Using Microsoft Purviewhard
Which capabilities are available with retention labels but NOT with retention policies? (Select 3 answers)
- AStart the retention period when an item is labelled or on an eventcheck_circle Correct
- BMark labelled items as records or as regulatory recordscheck_circle Correct
- CTrigger a disposition review at the end of the retention periodcheck_circle Correct
- DApply retention settings across entire Exchange Online mailboxes
- EApply retention settings to Teams chat and channel messages
Apply the documented Microsoft 365 / Microsoft Entra ID behaviour to the scenario. Retention labels uniquely support: starting retention when labelled or on event, declaring items as records, disposition review, applying a different label at end of retention, and travelling with content when moved. Retention policies cover broader workloads (Teams, Viva Engage, Skype) that labels do not.
Why A is correct: Correct. Start the retention period when an item is labelled or on an event is one of the keyed answers. Retention labels uniquely support: starting retention when labelled or on event, declaring items as records, disposition review, applying a different label at end of retention, and travelling with content when moved.
Why B is correct: Correct. Mark labelled items as records or as regulatory records is one of the keyed answers. Retention labels uniquely support: starting retention when labelled or on event, declaring items as records, disposition review, applying a different label at end of retention, and travelling with content when moved.
Why C is correct: Correct. Trigger a disposition review at the end of the retention period is one of the keyed answers. Retention labels uniquely support: starting retention when labelled or on event, declaring items as records, disposition review, applying a different label at end of retention, and travelling with content when moved.
Why D is wrong: Mailbox-level retention is exactly what retention policies do; labels operate at the item level.
Why E is wrong: Teams messages support retention policies only; retention labels do not apply to Teams or Viva Engage messages.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. MS-102 and related marks belong to their respective owners.
