Microsoft MS-102 Exam Dumps, Practice Test Questions

Install or enable the applicable monitoring agents and inspect Connect Health alerts. is directed at a separate task: Administrators want health warnings for the existing Microsoft Entra Connect Sync deployment. It does not produce the required configuration outcome: Cloud sign-ins authenticate through the selected pass-through path while redundant agents are healthy.

Create emergency administrative identities directly in Entra with no matching synchronized source. implements a different mechanism for: An organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. It does not configure the mechanism needed here: Use pass-through authentication with resilient supported agents.

Configure the policy in report-only mode and analyze sign-in results before enabling it. is directed at a separate task: A company wants to pilot a restrictive Conditional Access policy without immediately blocking production users. It does not produce the required configuration outcome: Cloud sign-ins authenticate through the selected pass-through path while redundant agents are healthy.

Only the designated active server exports changes while the standby is prepared. would assess a different control. In this case it does not rule out the specific failure: Authentication fails when the only installed PTA agent host is offline.

The cloud attribute updates from the on-premises authoritative source. is evidence of another system state: A directory team wants to understand why an Entra user attribute is read-only in cloud admin center. The acceptance evidence here instead is: Cloud sign-ins authenticate through the selected pass-through path while redundant agents are healthy.

The audit record shows risk detection and the subsequent remediation state. would assess a different control. In this case it does not rule out the specific failure: Authentication fails when the only installed PTA agent host is offline.

Password writeback was not enabled or lacked necessary source-directory permissions. would fit a different circumstance involving: A password writeback project must permit eligible SSPR resets to update the source AD password. Here the actual symptom is: Authentication fails when the only installed PTA agent host is offline.

The fault was not isolated using connector or provisioning-stage diagnostics. is a plausible failure in another case: The administrator restarts agents repeatedly without locating the failed export. It does not explain the current incident: Authentication fails when the only installed PTA agent host is offline.

The intended user population was omitted from SSPR scope. would fit a different circumstance involving: Employees who forget passwords should recover access without contacting the help desk. Here the actual symptom is: Authentication fails when the only installed PTA agent host is offline.

Plan source-anchor and object-matching behavior before joining hybrid accounts. can be useful when a source Active Directory object has two possible cloud matches and a tenant fears duplicate identities. However, it does not specifically achieve: The test sign-in follows the expected validation path during the planned dependency test.

Use synchronization run and provisioning logs to locate the failing stage. addresses another administrative need: A provisioning operator must tell whether a user failed before import, during sync transformation or at cloud export. This question instead requires the outcome: The test sign-in follows the expected validation path during the planned dependency test.

Configure the SSPR registration experience and eligible registration prompts. can be useful when a tenant must require user registration of security information when access recovery is enabled. However, it does not specifically achieve: The test sign-in follows the expected validation path during the planned dependency test.

Restore or recover the intended source object and verify resynchronization and cloud restoration behavior. is directed at a separate task: After an accidental on-premises account deletion, a synchronized user disappears from the Microsoft 365 directory. It does not produce the required configuration outcome: The test sign-in follows the expected validation path during the planned dependency test.

Configure supported source forests and account matching in the chosen Connect Sync topology. implements a different mechanism for: An organization has multiple AD forests containing employees but wants one Microsoft Entra tenant. It does not configure the mechanism needed here: Choose the authentication method based on the actual sign-in dependency and operational constraints.

Define named IP locations then apply them to a properly scoped access policy. is directed at a separate task: Users inside an approved corporate network must get different access treatment than employees connecting from unknown public Internet. It does not produce the required configuration outcome: The test sign-in follows the expected validation path during the planned dependency test.

The exact failing stage and attributable object error are identified. would assess a different control. In this case it does not rule out the specific failure: The architecture claims independent cloud validation but still requires a live on-premises agent.

Only the designated active server exports changes while the standby is prepared. is evidence of another system state: Two hybrid sync servers cannot both actively export the same set of objects to one tenant in the intended design. The acceptance evidence here instead is: The test sign-in follows the expected validation path during the planned dependency test.

A finance sign-in from an unsupported platform is denied while approved platforms follow their normal access policy. would assess a different control. In this case it does not rule out the specific failure: The architecture claims independent cloud validation but still requires a live on-premises agent.

The synchronization scope included an unintended OU. would fit a different circumstance involving: Only employees in two Active Directory OUs should be synchronized to Microsoft Entra ID. Here the actual symptom is: The architecture claims independent cloud validation but still requires a live on-premises agent.

The filter conditions did not exclude the service account's actual attributes. is a plausible failure in another case: A privileged service identity is synchronized despite an exclusion requirement. It does not explain the current incident: The architecture claims independent cloud validation but still requires a live on-premises agent.

The named location IP ranges do not match the organization's actual egress. would fit a different circumstance involving: Users inside an approved corporate network must get different access treatment than employees connecting from unknown public Internet. Here the actual symptom is: The architecture claims independent cloud validation but still requires a live on-premises agent.

Use Microsoft Entra Connect Sync when its supported sync features fit the hybrid design. can be useful when an organization needs synchronized Microsoft Entra identities with the broad features of an on-premises Connect Sync server. However, it does not specifically achieve: The valid user is restored with the correct source linkage and licenses as applicable.

Apply supported OU-based scoping rather than synchronizing the whole forest. addresses another administrative need: Only employees in two Active Directory OUs should be synchronized to Microsoft Entra ID. This question instead requires the outcome: The valid user is restored with the correct source linkage and licenses as applicable.

Block unsupported legacy authentication with an appropriate security/access control. can be useful when a security team needs users to move away from an older legacy authentication mechanism. However, it does not specifically achieve: The valid user is restored with the correct source linkage and licenses as applicable.

Check the relevant sync cycle, connector space and source attribute mapping. is directed at a separate task: A user changes their on-premises display name but Entra never reflects the update. It does not produce the required configuration outcome: The valid user is restored with the correct source linkage and licenses as applicable.

Configure supported attribute filtering or provisioning scoping rules for the identified users. implements a different mechanism for: A business needs different attribute filtering rules for hybrid service accounts and employees. It does not configure the mechanism needed here: Investigate the sync deletion event and restore source identity through the supported recovery process.

Revoke sign-in sessions, reset credentials and investigate the specific risk event. is directed at a separate task: A protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. It does not produce the required configuration outcome: The valid user is restored with the correct source linkage and licenses as applicable.

The test sign-in follows the expected validation path during the planned dependency test. would assess a different control. In this case it does not rule out the specific failure: Restoring a disconnected cloud object causes another duplicate user to be created.

The mapped attribute is exported and the cloud display name updates. is evidence of another system state: A user changes their on-premises display name but Entra never reflects the update. The acceptance evidence here instead is: The valid user is restored with the correct source linkage and licenses as applicable.

A prohibited company-themed password is rejected during a test change. would assess a different control. In this case it does not rule out the specific failure: Restoring a disconnected cloud object causes another duplicate user to be created.

Duplicate or invalid source directory attributes were not remediated before synchronization. would fit a different circumstance involving: An enterprise is synchronizing decades-old on-premises directory accounts that have malformed proxy addresses. Here the actual symptom is: Restoring a disconnected cloud object causes another duplicate user to be created.

Pass-through authentication lacked redundant healthy agents. is a plausible failure in another case: Authentication fails when the only installed PTA agent host is offline. It does not explain the current incident: Restoring a disconnected cloud object causes another duplicate user to be created.

The evaluator ignored another applicable Conditional Access policy or actual membership. would fit a different circumstance involving: A new Conditional Access design is blocking employees who should be outside the pilot group. Here the actual symptom is: Restoring a disconnected cloud object causes another duplicate user to be created.