Free MS-102 Exam Flashcards

A TXT record with the value MS=msNNNNNNNN at the domain root; if the registrar cannot host TXT records, Microsoft accepts a special verification MX record instead. Microsoft 365 queries that record to confirm you control the DNS zone. The mail-routing MX, autodiscover CNAME, and SPF records added afterwards configure services; they do not prove ownership.

Every tenant is created with an onmicrosoft.com initial domain such as contoso.onmicrosoft.com. It cannot be deleted or renamed. Adding a verified custom domain and making it the default changes the addresses new users receive, but the onmicrosoft.com domain remains permanently as a fallback.

Service health shows incidents and advisories affecting your tenant right now, including which services are degraded. Message center announces planned changes, new features, and deprecations before they ship. Service health answers whether something is broken; Message center answers what is about to change.

It samples real client traffic to score how well each office location reaches Microsoft 365, reporting latency, egress location, and whether traffic is backhauled instead of broken out locally. You must define office locations for results to be attributed correctly. It grades network design, not service availability.

It backs up and restores Exchange Online mailboxes, OneDrive accounts, and SharePoint sites inside your own tenant with fast point-in-time restore. It is a pay-as-you-go service billed through a linked Azure subscription, so you must attach an Azure subscription before you can enable it.

A deleted user stays in the Deleted users container for 30 days and can be restored with its licenses, group memberships, and mailbox intact. After 30 days the object is permanently purged and cannot be recovered, so you would have to create a new account from scratch.

A shared mailbox is free up to 50 GB. It requires a license once it exceeds 50 GB, or when you want to place it on litigation hold or enable an in-place archive. Licensing is driven by capacity and hold features, never by how many people open it.

You assign product licenses to a security group, mail-enabled group, or Microsoft 365 group and Microsoft Entra ID applies them to every direct member automatically, including new members. Removing a user from the group removes the inherited license. Nested groups are not supported: only first-level members are licensed.

Connect-MgGraph starts the session, and you list the permission scopes you need with the Scopes parameter, for example Connect-MgGraph -Scopes 'User.ReadWrite.All'. Consent is granted per scope. Cmdlets such as Get-MgUser and New-MgGroup then run inside that session.

Only a Microsoft 365 group. It creates a shared mailbox, calendar, SharePoint site, and Planner plan for its members. Security groups grant access to resources, distribution groups only relay mail to members, and mail-enabled security groups do both but provision nothing.

An administrative unit is a container of users, groups, or devices that scopes a role assignment to just that subset. A Helpdesk Administrator scoped to the Seattle unit can reset passwords only for Seattle members. It narrows an existing role's reach and never grants new permissions.

An active assignment grants the role immediately with no activation step, either permanently or between start and end dates. An eligible assignment grants nothing until the user activates it, optionally requiring multifactor authentication, a justification, approval, and a ticket number, and the activation expires after the maximum duration you set. Eligible assignments deliver just-in-time admin access. PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance.

Global Reader. It reads everything a Global Administrator can across the Microsoft 365 admin center, Exchange, SharePoint, Teams, the Defender portal, and the Azure portal but cannot change anything. Assigning Global Administrator for read-only work breaks least privilege. Known gaps: Global Reader cannot see Secure Score or run content search in the Defender portal, and Microsoft Purview does not support the role.

A locked-out Global Administrator's password can only be reset by another Global Administrator or by a Privileged Authentication Administrator. Keeping that role assigned preserves a recovery path without inflating the number of Global Administrators, which Microsoft advises keeping as low as possible.

IdFix scans on-premises Active Directory for object errors that would break directory synchronization, such as duplicate proxy addresses or user principal names, invalid characters, and blank required attributes, and proposes edits. Run it before the first sync and after any bulk change, so data is cleaned at the source.

Microsoft Entra Cloud Sync. Each lightweight provisioning agent talks to its own forest and all of them report to the same cloud provisioning service, so no trust or network path between forests is needed. Entra Connect Sync requires every forest to be reachable from one sync server.

Cloud Sync keeps all scoping rules and attribute mappings in the cloud, managed from the Microsoft Entra admin center, with on-premises agents acting only as bridges. Entra Connect Sync stores its sync rules on the on-premises server, so changes need access to that specific server.

It reports the health of hybrid identity infrastructure: sync service status, sync errors and latency, AD FS sign-in volume and failures, and AD DS domain controller health. It is a monitoring and alerting layer only, never a synchronization engine, and it requires agents on the servers it watches.

Microsoft Entra ID accepts only a user principal name whose suffix is a verified custom domain in the tenant. An unroutable suffix such as contoso.local is rewritten to the onmicrosoft.com domain, so the user signs in with an unexpected name. Add the routable suffix in AD Domains and Trusts first.

Password hash sync copies a hash of the on-premises password hash into Microsoft Entra ID, so Entra validates sign-ins itself and keeps working when on-premises Active Directory is unreachable. Pass-through authentication stores no password in the cloud and validates every sign-in against a domain controller through an agent.

Password writeback pushes a password that a hybrid user changed or reset in the cloud back into on-premises Active Directory, so both directories stay in step and self-service password reset works for synced accounts. It requires Microsoft Entra ID P1 or P2, or Microsoft 365 Business Premium, plus writeback enabled in Entra Connect Sync or Cloud Sync.

It holds a maximum of 1,000 terms. Add only organization-specific base terms such as brand names, product names, and the headquarters city. Entra normalizes passwords and uses fuzzy matching, so variants and combinations are blocked automatically; listing spellings like Contoso!1 simply wastes entries.

The global banned password list applies to every tenant with Microsoft Entra ID Free for cloud-only users and cannot be disabled. The custom banned password list requires Microsoft Entra ID P1 or P2. Extending either list to users synchronized from on-premises AD DS also requires P1 or P2.

A proxy service on a domain-joined server that relays policy down from Microsoft Entra ID, and a DC agent installed on every writable domain controller that enforces it. The modes are Audit, which only logs what would have been blocked, and Enforced, which actually rejects weak passwords.

Assignments define who and what the policy targets: users and groups, target resources, network location, device platform, client app, and risk conditions. Access controls define the outcome: grant with requirements such as multifactor authentication or a compliant device, block outright, or apply session controls.

The policy is evaluated on every matching sign-in and the result is written to the sign-in logs, but grant and block controls are never enforced. It lets you measure the blast radius before turning a policy on. Pair it with the What If tool to test a hypothetical sign-in.

Sign-in risk scores one authentication attempt using signals such as anonymous IP address, atypical travel, or an unfamiliar sign-in property. User risk scores the account itself, driven mainly by leaked credentials or confirmed compromise. The usual responses are multifactor authentication for sign-in risk and a secure password change for user risk.

Conditional Access applies multifactor authentication conditionally by user, application, network, device state, and risk, and supports report-only rollout plus named-location and break-glass exclusions. Legacy per-user MFA is an all-or-nothing flag on the account with no context. Conditional Access requires Microsoft Entra ID P1.

It scores your configured security posture across identity, devices, apps, and data, awarding points as you adopt recommended controls and comparing your score to the achievable maximum. It measures configuration only. Whether you were actually attacked is answered by incidents and alerts elsewhere in the Defender portal.

It unifies exposure data across assets into attack surface maps and attack paths, showing how an attacker could chain weaknesses to reach critical assets, and tracks progress through initiatives and exposure metrics. Secure Score rates control adoption; Exposure Management shows which routes to your crown jewels remain open.

An alert is a single detection from one Defender workload. Defender XDR correlates related alerts across email, endpoints, identities, and cloud apps into one incident with a shared timeline and evidence graph, so analysts triage one attack story instead of dozens of disconnected alerts.

Up to 30 days of raw data, queried with Kusto Query Language. A single query returns at most 100,000 rows, times out after 10 minutes, and is capped at 64 MB of results. Onboarding a Microsoft Sentinel workspace extends retention beyond the 30-day window.

Save it as a custom detection rule. The rule runs on a schedule, raises an alert or incident whenever the query returns results, and can apply response actions such as isolating a device or disabling a user. The query must return the entity columns the rule needs to act on.

Off, which skips detonation entirely and is the default in a new custom policy; Monitor, which delivers the message and tracks what happens; Block, which quarantines the message and is the value used by Built-in protection and the Standard and Strict presets; and Dynamic Delivery, which delivers the body immediately with attachment placeholders until scanning finishes.

Everyone. There is no default Safe Attachments policy, but the Built-in protection preset security policy applies Safe Attachments to all recipients who are not already covered by the Standard preset, the Strict preset, or a custom policy. Custom policies take precedence over Built-in protection.

It works only for Exchange Online mailboxes. Recipients whose mailboxes remain on-premises get no attachment placeholders, and it also cannot replace attachments in public folder messages or messages that rules move out of the mailbox. Choose Block instead when recipients are not fully in Exchange Online.

It rewrites URLs and re-checks them at the moment of click, so a link that was clean at delivery but weaponized hours later is still blocked. Anti-phishing evaluates the message when it arrives. Safe Links also protects clicks in Teams, Office apps, and links inside supported attachments.

Built-in protection is the baseline that covers everyone, then Standard, then Strict, which is the most aggressive. When a recipient matches more than one policy, the order applied is Strict, then Standard, then custom policies by priority number, and only then Built-in protection or the default policies. Custom policies therefore beat Built-in protection but lose to Standard and Strict.

ZAP retroactively moves already-delivered messages to quarantine or the Junk Email folder when Microsoft later reclassifies the content as malware, phishing, or spam, using the action set in your anti-malware and anti-spam policies. It works only in Exchange Online cloud mailboxes, not on-premises mailboxes, looks back 48 hours, and can act on messages in other folders including Deleted Items.

It sends benign simulated phishing to your own users, measures who clicks a link or submits credentials, and automatically assigns targeted training to those who fail. It is a Defender for Office 365 Plan 2 feature. Use it to measure human risk, not to test whether the mail filters work.

The local onboarding script is supported for up to 10 devices. Beyond that use Microsoft Intune or another MDM, Microsoft Configuration Manager, Group Policy, or the VDI scripts. Every onboarding package is downloaded from Settings, then Endpoints, then Onboarding in the Microsoft Defender portal.

It continuously inventories software and configurations on onboarded devices, ranks weaknesses by real exposure and breach likelihood rather than raw severity, and lets you send a remediation request straight to Microsoft Intune as a task for the IT team. It connects findings to owners and actions.

Cloud Discovery parses firewall and proxy traffic logs, or telemetry from Defender for Endpoint, and matches them against a catalog that scores each app on more than 90 risk indicators. App connectors instead use the vendor's own APIs to look inside a sanctioned app at its files, accounts, and activities.

It routes the user's session through Defender for Cloud Apps as a reverse proxy, so you can inspect and control actions inside the live session: block downloads to unmanaged devices, block cut, copy, and paste, or apply a sensitivity label on download. Conditional Access alone only decides at sign-in.

A primary element such as a regular expression, optionally with a checksum or date validator, a keyword list, a keyword dictionary, or a function; optional supporting elements such as nearby keywords that corroborate the match; a character proximity window; and a confidence level for the pattern. Requiring corroborating evidence close to the primary match is what keeps false positives under control.

A retention policy is applied to locations such as all Exchange mailboxes or all SharePoint sites and implicitly covers everything in them. A retention label is applied to an individual item, manually or automatically, and travels with that item. An item can carry only one retention label at a time.

Retention wins over deletion; the longest retention period wins; explicit wins over implicit for deletions, so a retention label's delete action beats any retention policy's; and the shortest deletion period wins. Each principle acts as the tie-breaker for conflicts the one above it could not resolve.

At the bottom. Order sets priority, and the label lowest in the list carries the highest priority and the highest order number. That ordering is what lets Purview recognize a downgrade and prompt for justification, and it decides the winner when auto-labeling matches more than one label.

Content explorer shows the current state: which items right now carry a given sensitivity label, retention label, or sensitive information type, and where they live. Activity explorer shows history: labels applied, changed, downgraded, or removed, and data loss prevention matches, over time.

The device must be onboarded to Microsoft Purview, using the same onboarding as Microsoft Defender for Endpoint, and the user must be signed in with a work or school account. Only then can the policy audit or block actions such as copying a file to USB, printing, or uploading to an unapproved site.