Microsoft MS-102 Exam Dumps, Practice Test Questions

Run IdFix against the source directory and correct flagged duplicate or invalid attributes. is directed at a separate task: An enterprise is synchronizing decades-old on-premises directory accounts that have malformed proxy addresses. It does not produce the required configuration outcome: On-premises test user changes appear in Entra for included organizational units.

Create emergency administrative identities directly in Entra with no matching synchronized source. implements a different mechanism for: An organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. It does not configure the mechanism needed here: Use Microsoft Entra Connect Sync when its supported sync features fit the hybrid design.

Inspect identity protection risk detections and the relevant user and sign-in risk levels. is directed at a separate task: The organization must distinguish risk that a user account is compromised from risk attached to one specific login. It does not produce the required configuration outcome: On-premises test user changes appear in Entra for included organizational units.

A designated employee has a single intended Entra user identity across joined forests. would assess a different control. In this case it does not rule out the specific failure: A new hire in an excluded OU never reaches Microsoft Entra ID.

An unhealthy connector or synchronization service produces a corresponding health signal. is evidence of another system state: Administrators want health warnings for the existing Microsoft Entra Connect Sync deployment. The acceptance evidence here instead is: On-premises test user changes appear in Entra for included organizational units.

An invited external user satisfies the intended guest controls without changing internal staff policy. would assess a different control. In this case it does not rule out the specific failure: A new hire in an excluded OU never reaches Microsoft Entra ID.

The filter conditions did not exclude the service account's actual attributes. would fit a different circumstance involving: A business needs different attribute filtering rules for hybrid service accounts and employees. Here the actual symptom is: A new hire in an excluded OU never reaches Microsoft Entra ID.

Cloud editing was attempted on an attribute managed by on-premises synchronization. is a plausible failure in another case: An administrator attempts to edit a synchronized field directly in the cloud and receives a restriction. It does not explain the current incident: A new hire in an excluded OU never reaches Microsoft Entra ID.

The access policy used a stale manual user list instead of role targeting. would fit a different circumstance involving: A Conditional Access policy must apply to administrator roles even when group membership changes. Here the actual symptom is: A new hire in an excluded OU never reaches Microsoft Entra ID.

Use IdFix to identify and remediate supported AD attribute issues before Entra synchronization. can be useful when an enterprise is synchronizing decades-old on-premises directory accounts that have malformed proxy addresses. However, it does not specifically achieve: In-scope Active Directory users provision through the Cloud Sync agent service.

Choose the authentication method based on the actual sign-in dependency and operational constraints. addresses another administrative need: A sign-in architecture review compares cloud password hash sync against pass-through authentication. This question instead requires the outcome: In-scope Active Directory users provision through the Cloud Sync agent service.

Deploy Microsoft Entra Password Protection agents for on-premises Active Directory. can be useful when an organization extends cloud password protection to on-premises AD Domain Services. However, it does not specifically achieve: In-scope Active Directory users provision through the Cloud Sync agent service.

Install and configure a supported Entra Connect Sync deployment and select intended synchronization scope. is directed at a separate task: An organization needs synchronized Microsoft Entra identities with the broad features of an on-premises Connect Sync server. It does not produce the required configuration outcome: In-scope Active Directory users provision through the Cloud Sync agent service.

Modify the authoritative Active Directory attribute and run normal sync. implements a different mechanism for: A directory team wants to understand why an Entra user attribute is read-only in cloud admin center. It does not configure the mechanism needed here: Use Microsoft Entra Cloud Sync when its feature and topology support meets the requirement.

Inspect the user's registered method and perform a fresh supported passwordless sign-in test. is directed at a separate task: A passwordless rollout requires administrators to distinguish a new registration from a completed successful sign-in. It does not produce the required configuration outcome: In-scope Active Directory users provision through the Cloud Sync agent service.

Cloud sign-ins authenticate through the selected pass-through path while redundant agents are healthy. would assess a different control. In this case it does not rule out the specific failure: The Cloud Sync agent is unhealthy and all new identity provisioning stops.

An intended cloud sign-in follows the federated authentication path. is evidence of another system state: A hybrid organization wants users to authenticate against its on-premises identity provider with an explicitly managed federation design. The acceptance evidence here instead is: In-scope Active Directory users provision through the Cloud Sync agent service.

The policy distinguishes corporate egress addresses from unknown public IPs. would assess a different control. In this case it does not rule out the specific failure: The Cloud Sync agent is unhealthy and all new identity provisioning stops.

The organizational unit was excluded by the Connect Sync filtering configuration. would fit a different circumstance involving: An organization needs synchronized Microsoft Entra identities with the broad features of an on-premises Connect Sync server. Here the actual symptom is: The Cloud Sync agent is unhealthy and all new identity provisioning stops.

The fault was not isolated using connector or provisioning-stage diagnostics. is a plausible failure in another case: The administrator restarts agents repeatedly without locating the failed export. It does not explain the current incident: The Cloud Sync agent is unhealthy and all new identity provisioning stops.

Account disablement was mistaken for an expired or wrong password. would fit a different circumstance involving: A cloud-only user says her password expired but the help desk needs to differentiate expiry from blocked account status. Here the actual symptom is: The Cloud Sync agent is unhealthy and all new identity provisioning stops.

Plan an eligible multi-forest Entra synchronization topology. can be useful when an organization has multiple AD forests containing employees but wants one Microsoft Entra tenant. However, it does not specifically achieve: Included OU users appear in Entra and excluded OU identities do not.

Respect the on-premises source of authority for synchronized attributes. addresses another administrative need: A directory team wants to understand why an Entra user attribute is read-only in cloud admin center. This question instead requires the outcome: Included OU users appear in Entra and excluded OU identities do not.

Apply a targeted Conditional Access grant requiring multifactor authentication. can be useful when the identity team wants to require MFA for a specific sensitive cloud application rather than every app. However, it does not specifically achieve: Included OU users appear in Entra and excluded OU identities do not.

Modify the authoritative Active Directory attribute and run normal sync. is directed at a separate task: A directory team wants to understand why an Entra user attribute is read-only in cloud admin center. It does not produce the required configuration outcome: Included OU users appear in Entra and excluded OU identities do not.

Enable pass-through authentication and deploy supported agents with redundancy. implements a different mechanism for: A hybrid company wants cloud authentication while applying certain on-premises policies through pass-through authentication agents. It does not configure the mechanism needed here: Apply supported OU-based scoping rather than synchronizing the whole forest.

Configure and verify the option to unlock an account without changing the password in the supported identity environment. is directed at a separate task: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. It does not produce the required configuration outcome: Included OU users appear in Entra and excluded OU identities do not.

An unhealthy connector or synchronization service produces a corresponding health signal. would assess a different control. In this case it does not rule out the specific failure: Users from an unauthorized organizational unit are present in Entra.

The cloud-only emergency identity is not controlled by sync deletion of an on-premises account. is evidence of another system state: An organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. The acceptance evidence here instead is: Included OU users appear in Entra and excluded OU identities do not.

An eligible user completes password recovery using registered verification methods. would assess a different control. In this case it does not rule out the specific failure: Users from an unauthorized organizational unit are present in Entra.

Forest account matching or source-object joins were not designed for the multi-forest topology. would fit a different circumstance involving: An organization has multiple AD forests containing employees but wants one Microsoft Entra tenant. Here the actual symptom is: Users from an unauthorized organizational unit are present in Entra.

The fault was not isolated using connector or provisioning-stage diagnostics. is a plausible failure in another case: The administrator restarts agents repeatedly without locating the failed export. It does not explain the current incident: Users from an unauthorized organizational unit are present in Entra.

The SSPR reset-method threshold was configured too low. would fit a different circumstance involving: The organization requires two recovery methods before a user can reset their own password. Here the actual symptom is: Users from an unauthorized organizational unit are present in Entra.