MS-102 · Sample questions

MS-102 sample questions with answers and explanations

6 real questions from the CertifyDeck MS-102 bank, spread across the domains of the official Microsoft 365 Administrator skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Manage Microsoft Entra identities and roles for Microsoft 365Medium

   A tenant wants new employees to be able to sign in for the first time and register their passwordless authentication methods before ever knowing a traditional password. Which capability supports this onboarding flow?

   • B.Manually emailing the employee their plaintext password in an unencrypted message
   • A.Issuing a Temporary Access Pass to the new employee for their first sign-in and method registration
   • C.Disabling Conditional Access entirely for new hires
   • D.Requiring the employee to physically visit the datacenter
   Show answer and explanation

   Correct answer: A. Issuing a Temporary Access Pass to the new employee for their first sign-in and method registration

   Explanation

   A Temporary Access Pass is purpose-built for exactly this scenario: it lets a new or recovering user sign in without a traditional password and complete registration of passwordless methods like Authenticator, FIDO2, or Windows Hello for Business. Emailing a plaintext password (B) is a serious security anti-pattern, disabling Conditional Access (C) is an unnecessary and risky overreaction, and requiring physical datacenter access (D) is impractical and unrelated to identity onboarding.

   Official references

   • Configure a Temporary Access Pass in Microsoft Entra ID
   • Official MS-102 study guide
2. Question 2Domain: Manage Microsoft Entra identities and roles for Microsoft 365Easy

   Which of the following best describes a "named location" defined as a trusted IP range in Conditional Access?

   • B.A list of physical office street addresses used for shipping purposes
   • C.A configuration for Exchange Online transport rules
   • A.A configured set of IP address ranges (such as an organization's office network egress IPs) that can be referenced in Conditional Access policies to apply different treatment to sign-ins originating from that range
   • D.A setting that controls the time zone displayed in Outlook
   Show answer and explanation

   Correct answer: A. A configured set of IP address ranges (such as an organization's office network egress IPs) that can be referenced in Conditional Access policies to apply different treatment to sign-ins originating from that range

   Explanation

   A named location defined by IP ranges lets administrators reference known network boundaries (like corporate office egress IPs) within Conditional Access policies, enabling differentiated treatment (such as relaxed or stricter requirements) based on whether a sign-in originates from that trusted range. It has nothing to do with physical shipping addresses (B), Exchange transport rules (C), or Outlook time zone display settings (D).

   Official references

   • Conditional Access: Location condition
   • Official MS-102 study guide
3. Question 3Domain: Manage security and threats using Microsoft 365 DefenderMedium

   A company notices that legitimate newsletters from a partner organization are consistently being marked as spam. The admin wants to ensure mail from that specific sender domain always skips spam filtering without disabling malware or phishing checks. What should be configured?

   • B.Disable the anti-spam policy for the whole organization
   • C.Add the domain to the safe attachments policy exclusion list
   • D.Turn off zero-hour auto purge (ZAP) tenant-wide
   • A.Add the domain to the allowed sender list in the anti-spam policy
   Show answer and explanation

   Correct answer: A. Add the domain to the allowed sender list in the anti-spam policy

   Explanation

   Adding a trusted domain to the allowed senders/domains list within the anti-spam inbound policy causes mail from that domain to bypass spam filtering specifically, while malware and phishing filters still apply. Disabling anti-spam entirely removes protection for all mail, not just the trusted sender. Safe Attachments exclusions only affect attachment detonation, not spam scoring. Disabling ZAP tenant-wide removes a post-delivery protection mechanism for everyone, which is unrelated and overly broad.

   Official references

   • Configure anti-spam policies in EOP
   • Official MS-102 study guide
4. Question 4Domain: Manage compliance in Microsoft 365Easy

   Which statement about sensitivity label order (position) in the list is correct?

   • B.Label order is purely cosmetic and has no effect on any functionality
   • C.Labels must be ordered alphabetically and cannot be manually reordered
   • D.Only sublabels can be reordered; parent labels have a fixed order
   • A.Labels must be ordered from least sensitive at the top to most sensitive at the bottom, since this order also drives auto-labeling and default label upgrade behavior
   Show answer and explanation

   Correct answer: A. Labels must be ordered from least sensitive at the top to most sensitive at the bottom, since this order also drives auto-labeling and default label upgrade behavior

   Explanation

   Label order in the Purview compliance portal reflects sensitivity level from least to most sensitive, top to bottom. This ordering matters functionally: for example, when multiple auto-labeling conditions match, or when a user tries to apply a lower label than one already assigned, the relative order determines behaviors like requiring justification for a "downgrade." Order can be changed by an admin and is not purely cosmetic or alphabetical.

   Official references

   • Label priority (order matters)
   • Official MS-102 study guide
5. Question 5Domain: Deploy Microsoft 365Medium

   A company wants employees to be able to create their own Microsoft 365 groups from Outlook, but wants IT to review naming conventions and prevent uncontrolled proliferation of groups. Which feature should the administrator configure?

   • B.Conditional Access policy that blocks Outlook
   • C.Retention policy applied to all groups
   • A.Group naming policy with a prefix/suffix and a blocked words list
   • D.Sensitivity label applied to the tenant
   Show answer and explanation

   Correct answer: A. Group naming policy with a prefix/suffix and a blocked words list

   Explanation

   A group naming policy lets administrators enforce a consistent prefix/suffix (for example, department codes) and block specific words, giving IT governance over self-service group creation without disabling it. A Conditional Access policy blocking Outlook (B) would prevent group creation entirely and break normal email use. A retention policy (C) controls content lifecycle, not naming. A sensitivity label on the tenant (D) is not a concept that exists this way and does not govern naming.

   Official references

   • Microsoft 365 groups naming policy
   • Official MS-102 study guide
6. Question 6Domain: Deploy Microsoft 365Easy

   Which admin role, at minimum, is typically required to update organization profile settings such as the company name and address in the Microsoft 365 admin center?

   • A.Global Administrator
   • B.Message Center Reader
   • C.Reports Reader
   • D.Guest Inviter
   Show answer and explanation

   Correct answer: A. Global Administrator

   Explanation

   Global Administrator has full rights to manage all tenant-wide settings, including the organization profile. Message Center Reader (B) can only monitor and share Message Center posts, with no settings write access. Reports Reader (C) can only view usage reports. Guest Inviter (D) is scoped narrowly to inviting external guests and has no organization profile permissions.

   Official references

   • Organization profile settings
   • Official MS-102 study guide