Exam MS-101: Microsoft 365 Mobility and Security Practice Test
MS-101 centers on managing Microsoft 365 mobility and security across users, devices, applications, and organizational data. The practice bank’s scenarios use tasks such as controlling cloud-app sign-in, protecting mobile app data, provisioning Windows devices, responding to a lost phone, and investigating configuration changes or possible data loss.
Exam overview
About the Exam MS-101: Microsoft 365 Mobility and Security Exam
The work represented in these scenarios connects identity controls with endpoint and information protection. You may need to distinguish single sign-on from multifactor authentication, use Microsoft Entra ID settings to shape password and location-based access, and consider how sign-in policies affect users across cloud services. Device-management decisions include applying Intune app protection, configuring Windows enrollment and setup, and choosing a device action that removes organizational data or resets a lost device. Data-security tasks include identifying potential inappropriate sharing through Microsoft Purview and examining audit records to establish who changed a setting and when. Security posture review also involves locating recommendations and improvement actions for Microsoft 365 configurations. These concepts are useful for administrators who translate security needs into access, device, and data controls, then investigate whether those controls are working as intended.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A company wants employees to use a single work account to access Microsoft 365 and several compatible third-party cloud apps. What capability supports this sign-in experience?
Show answer
Correct answer: ASingle sign-on lets users authenticate once with their organizational identity and access multiple integrated applications without repeatedly entering credentials. The exact experience depends on the apps and identity configuration.
An organization wants to prevent employees from signing in with a password that is known to be commonly used or compromised. Which Microsoft Entra capability can help enforce stronger password choices?
Show answer
Correct answer: AMicrosoft Entra Password Protection can block commonly used and organization-specific banned passwords. Its protections can be applied to cloud accounts and, with appropriate deployment, on-premises Active Directory accounts.
An organization wants to block sign-ins from a network location it considers untrusted, while allowing sign-ins from its known office network under the same policy conditions. What can an administrator define in Microsoft Entra ID to identify the office network?
Show answer
Correct answer: ANamed locations represent network locations, often using public IP ranges or countries/regions, and can be referenced by Conditional Access policies. The other options are unrelated to identifying sign-in network locations.
Which Microsoft Purview feature helps administrators detect and investigate potential data loss, such as sensitive information being shared improperly?
Show answer
Correct answer: ADLP policies can identify sensitive information in supported locations and apply actions or alerts to help prevent inappropriate sharing or transmission.
A security team needs to see how Microsoft 365 services are configured against recommended security practices and identify improvement actions. Which resource is designed for this purpose?
Show answer
Correct answer: AMicrosoft Secure Score provides an assessment of an organization's security posture and recommends actions that can help improve it. Usage reports, message trace, and sign-in logs serve different operational or investigative purposes.
An administrator must remove a lost organization-owned phone from management and erase its organizational data. Which Intune action is generally intended to restore the device to factory settings?
Show answer
Correct answer: AThe Intune wipe action resets a supported device to its factory settings, removing data and settings. Retire generally removes organizational data and management while leaving personal data intact; sync and rename do not erase the device.
What is the main purpose of an app protection policy in Microsoft Intune?
Show answer
Correct answer: AApp protection policies help protect organizational data within supported applications, including on devices that may not be fully enrolled in mobile device management.
How to use this practice test
The free US Practice Tests practice session draws up to 20 random questions from the published MS-101 bank. Work through each scenario by identifying the administrative goal and matching it to the relevant identity, Intune, Purview, or audit capability. Results appear after the session, so use them to pinpoint concepts that need another pass.
Preparation tips
- For identity scenarios, separate authentication methods such as MFA from access conditions such as trusted network locations, and note what each control changes.
- Compare Intune app protection, device enrollment, and remote device actions; identify whether a scenario concerns app data, initial provisioning, or a lost-device response.
- For information-protection questions, distinguish detecting potential data loss with Purview from reviewing audit records to trace configuration changes.
- Practice mapping Microsoft 365 security recommendations to the configuration area they address, then identify the improvement action the recommendation supports.