Pass the Microsoft Microsoft 365 Certified: Enterprise Administrator Expert MS-102 Questions and answers with CertsForce

User1: Yes

User2: No

Group3: Yes

Microsoft Entra Cloud Sync scoping can be configured by using selected Active Directory security groups or selected organizational units. Microsoft states that Cloud Sync scoping filters define which objects appear in Microsoft Entra ID, and that for security groups and OUs, the administrator supplies the distinguished name. In this case, the distinguished name points to Group1, so Group1 is the scoping group. Objects that are direct members of Group1 are in scope.

User1 syncs because User1 is a direct member of Group1. The user’s OU does not block synchronization here because the configured scope is the Group1 DN, not an OU-only filter. User2 does not sync because User2 is a member of Group2, and Group2 is a member of Group1. That is nested group membership. Microsoft explicitly states that nested groups cannot be used with group scoping and that nested objects beyond the first level are not included when scoping by security groups.

Group3 syncs because Group3 itself is a direct member of Group1. The fact that Group3 has no members is irrelevant; the group object is still directly in scope. Reference topics: Microsoft Entra Cloud Sync scoping filters, selected security groups, distinguished names, and nested group limitations.

Box 1: Yes

User1 is member of Group1.

User1 has MFA registered method of Microsoft Authenticater app (push notification)

The Microsoft Authenticator authentication method policy is configured for Group1, registration is optional, authentication method is any.

Note: Microsoft Authenticator can be used to sign in to any Microsoft Entra ID account without using a password. Microsoft Authenticator uses key-based authentication to enable a user credential that is tied to a device, where the device uses a PIN or biometric. Windows Hello for Business uses a similar technology.

This authentication technology can be used on any device platform, including mobile. This technology can also be used with any app or website that integrates with Microsoft Authentication Libraries.

Box 2: No

User2 is member of Group2.

The Microsoft Authenticator authentication method policy is configured for Group1, not for Group2.

Box 3: No

User3 is member of Group1.

User3 has no MFA method registered.

User3 must choose an authentication method.

Note: Enable passwordless phone sign-in authentication methods

Microsoft Entra ID lets you choose which authentication methods can be used during the sign-in process. Users then register for the methods they ' d like to use.

NO

No

Yes

In the Content contains condition, Microsoft Purview DLP lets you combine conditions using logical operators:

“Any of these” = logical OR

“All of these” = logical AND

From the exhibit, the rule is effectively:

Group1 (All of these / AND)

Credit Card Number: 1 to 5 instances

SWIFT Code: 1 to 2 instances

OR

Group2 (Any of these)

Credit Card Number: 10 to Any instances

So the rule matches if:

(Credit Card is 1–5 AND SWIFT is 1–2) OR (Credit Card is ≥10).

Evaluate each document against the rule

Document1: Credit Card = 3, SWIFT = 3

Group1 requires SWIFT 1–2, but Document1 has 3 → Group1 = false

Group2 requires Credit Card ≥10, but Document1 has 3 → Group2 = false Result: DLP1 does NOT apply → No

Document2: Credit Card = 7, SWIFT = 2

Group1 requires Credit Card 1–5, but Document2 has 7 → Group1 = false

Group2 requires Credit Card ≥10, but Document2 has 7 → Group2 = false Result: DLP1 does NOT apply → No

Document3: Credit Card = 15, SWIFT = 0

Group2 requires Credit Card ≥10, and Document3 has 15 → Group2 = true Result: DLP1 DOES apply → Yes

Statement

Answer

User1 must correctly answer “In which city was your first job?” to reset their password.

No

User2 must correctly answer “What is your favorite food?” to reset their password.

No

User3 must correctly answer “What was the name of your first pet?” to reset their password.

Yes

Microsoft Entra SSPR applies a different reset policy to accounts assigned Azure/Microsoft Entra administrator roles. Microsoft states that administrator accounts use a strong default two-gate password reset policy, that this policy cannot be changed, and that the policy prohibits security questions. Microsoft’s affected administrator-role list explicitly includes Security Administrator and Directory Writers, so User1 and User2 cannot reset their passwords by answering security questions. Therefore, the statements for User1 and User2 are No, even though security questions are enabled for regular users.

User3 has the Reports Reader role, which is not listed in Microsoft’s affected administrator-role list for the two-gate administrator SSPR policy. User3 therefore follows the configured user SSPR policy. The tenant requires one authentication method, the only available method is security questions, and the configuration requires three questions to reset. Since exactly three security questions are enabled, User3 must answer all three enabled questions, including “What was the name of your first pet?” Microsoft confirms that SSPR checks whether the user has the required authentication methods according to the administrator-configured policy before allowing password reset.