Microsoft MS-102 Exam Dumps, Practice Test Questions

Configure the required federation trust and validate the sign-in endpoint availability. is directed at a separate task: A hybrid organization wants users to authenticate against its on-premises identity provider with an explicitly managed federation design. It does not produce the required configuration outcome: The mapped attribute is exported and the cloud display name updates.

Install or enable the applicable monitoring agents and inspect Connect Health alerts. implements a different mechanism for: Administrators want health warnings for the existing Microsoft Entra Connect Sync deployment. It does not configure the mechanism needed here: Inspect synchronization connector state and attribute flow rather than recreating the user.

Configure and verify the option to unlock an account without changing the password in the supported identity environment. is directed at a separate task: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. It does not produce the required configuration outcome: The mapped attribute is exported and the cloud display name updates.

An intended cloud sign-in follows the federated authentication path. would assess a different control. In this case it does not rule out the specific failure: The user remains stale although local Active Directory has the new value.

Included OU users appear in Entra and excluded OU identities do not. is evidence of another system state: Only employees in two Active Directory OUs should be synchronized to Microsoft Entra ID. The acceptance evidence here instead is: The mapped attribute is exported and the cloud display name updates.

A prohibited company-themed password is rejected during a test change. would assess a different control. In this case it does not rule out the specific failure: The user remains stale although local Active Directory has the new value.

The chosen authentication method's infrastructure dependency was misunderstood. would fit a different circumstance involving: A sign-in architecture review compares cloud password hash sync against pass-through authentication. Here the actual symptom is: The user remains stale although local Active Directory has the new value.

The synchronization scope included an unintended OU. is a plausible failure in another case: Users from an unauthorized organizational unit are present in Entra. It does not explain the current incident: The user remains stale although local Active Directory has the new value.

Custom banned password policy does not include or enforce the weak phrase. would fit a different circumstance involving: Administrators want to reject a known list of weak company-themed passwords at password change. Here the actual symptom is: The user remains stale although local Active Directory has the new value.

Implement supported password writeback in the hybrid identity environment. can be useful when a password writeback project must permit eligible SSPR resets to update the source AD password. However, it does not specifically achieve: One intended on-premises identity is linked to its existing cloud user.

Use IdFix to identify and remediate supported AD attribute issues before Entra synchronization. addresses another administrative need: An enterprise is synchronizing decades-old on-premises directory accounts that have malformed proxy addresses. This question instead requires the outcome: One intended on-premises identity is linked to its existing cloud user.

Review user risk and sign-in risk as separate Entra Identity Protection signals. can be useful when the organization must distinguish risk that a user account is compromised from risk attached to one specific login. However, it does not specifically achieve: One intended on-premises identity is linked to its existing cloud user.

Install or enable the applicable monitoring agents and inspect Connect Health alerts. is directed at a separate task: Administrators want health warnings for the existing Microsoft Entra Connect Sync deployment. It does not produce the required configuration outcome: One intended on-premises identity is linked to its existing cloud user.

Enable the appropriate password writeback configuration and grant required on-premises permissions. implements a different mechanism for: A password writeback project must permit eligible SSPR resets to update the source AD password. It does not configure the mechanism needed here: Plan source-anchor and object-matching behavior before joining hybrid accounts.

Define named IP locations then apply them to a properly scoped access policy. is directed at a separate task: Users inside an approved corporate network must get different access treatment than employees connecting from unknown public Internet. It does not produce the required configuration outcome: One intended on-premises identity is linked to its existing cloud user.

A designated employee has a single intended Entra user identity across joined forests. would assess a different control. In this case it does not rule out the specific failure: A second cloud user appears for an employee who already has a licensed cloud account.

Only the designated active server exports changes while the standby is prepared. is evidence of another system state: Two hybrid sync servers cannot both actively export the same set of objects to one tenant in the intended design. The acceptance evidence here instead is: One intended on-premises identity is linked to its existing cloud user.

Logs show the would-be policy impact while actual access remains unchanged. would assess a different control. In this case it does not rule out the specific failure: A second cloud user appears for an employee who already has a licensed cloud account.

The organizational unit was excluded by the Connect Sync filtering configuration. would fit a different circumstance involving: An organization needs synchronized Microsoft Entra identities with the broad features of an on-premises Connect Sync server. Here the actual symptom is: A second cloud user appears for an employee who already has a licensed cloud account.

Sync health monitoring or alert coverage was never established. is a plausible failure in another case: Sync failures continue unnoticed while the admin only reviews a daily user list. It does not explain the current incident: A second cloud user appears for an employee who already has a licensed cloud account.

The authentication strength is not configured or scoped to the privileged action. would fit a different circumstance involving: Security wants phishing-resistant MFA for administrators performing sensitive role activation. Here the actual symptom is: A second cloud user appears for an employee who already has a licensed cloud account.

Keep cloud-only accounts outside on-premises-sourced synchronization ownership. can be useful when an organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. However, it does not specifically achieve: The synced user has an intended routable sign-in name in the verified domain.

Configure password hash synchronization through the supported Entra sync method. addresses another administrative need: Help desk wants changed on-premises passwords usable for Microsoft 365 sign-in with password hash synchronization. This question instead requires the outcome: The synced user has an intended routable sign-in name in the verified domain.

Use approved phishing-resistant authentication methods such as FIDO2 security keys where supported. can be useful when employees must register a phishing-resistant sign-in factor instead of relying on SMS codes. However, it does not specifically achieve: The synced user has an intended routable sign-in name in the verified domain.

Create emergency administrative identities directly in Entra with no matching synchronized source. is directed at a separate task: An organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. It does not produce the required configuration outcome: The synced user has an intended routable sign-in name in the verified domain.

Enable the appropriate password writeback configuration and grant required on-premises permissions. implements a different mechanism for: A password writeback project must permit eligible SSPR resets to update the source AD password. It does not configure the mechanism needed here: Verify the sign-in domain and plan a supported UPN mapping for hybrid identities.

Configure Conditional Access conditions to block legacy client authentication where supported. is directed at a separate task: A security team needs users to move away from an older legacy authentication mechanism. It does not produce the required configuration outcome: The synced user has an intended routable sign-in name in the verified domain.

The cloud-only emergency identity is not controlled by sync deletion of an on-premises account. would assess a different control. In this case it does not rule out the specific failure: Synced users appear with an unexpected alternate suffix.

Cloud sign-ins authenticate through the selected pass-through path while redundant agents are healthy. is evidence of another system state: A hybrid company wants cloud authentication while applying certain on-premises policies through pass-through authentication agents. The acceptance evidence here instead is: The synced user has an intended routable sign-in name in the verified domain.

A new sensitive-app sign-in shows a satisfied MFA grant control. would assess a different control. In this case it does not rule out the specific failure: Synced users appear with an unexpected alternate suffix.

Password hash synchronization is disabled or its sync path is failing. would fit a different circumstance involving: Help desk wants changed on-premises passwords usable for Microsoft 365 sign-in with password hash synchronization. Here the actual symptom is: Synced users appear with an unexpected alternate suffix.

The fault was not isolated using connector or provisioning-stage diagnostics. is a plausible failure in another case: The administrator restarts agents repeatedly without locating the failed export. It does not explain the current incident: Synced users appear with an unexpected alternate suffix.

The device-platform policy condition or app targeting was omitted or misclassified. would fit a different circumstance involving: A finance application is not approved on mobile operating systems, even when users have valid authentication credentials. Here the actual symptom is: Synced users appear with an unexpected alternate suffix.