Microsoft MS-102 Exam Dumps, Practice Test Questions

An account expected to be cloud-only was accidentally bound to an on-premises sync object. would fit a different circumstance involving: An organization needs to exclude cloud-only privileged accounts from on-premises directory lifecycle changes. Here the actual symptom is: The cloud password reset succeeds but the on-premises credential remains unchanged.

The filter conditions did not exclude the service account's actual attributes. is a plausible failure in another case: A privileged service identity is synchronized despite an exclusion requirement. It does not explain the current incident: The cloud password reset succeeds but the on-premises credential remains unchanged.

The evaluator ignored another applicable Conditional Access policy or actual membership. would fit a different circumstance involving: A new Conditional Access design is blocking employees who should be outside the pilot group. Here the actual symptom is: The cloud password reset succeeds but the on-premises credential remains unchanged.

Plan source-anchor and object-matching behavior before joining hybrid accounts. can be useful when a source Active Directory object has two possible cloud matches and a tenant fears duplicate identities. However, it does not specifically achieve: Only the designated active server exports changes while the standby is prepared.

Investigate the sync deletion event and restore source identity through the supported recovery process. addresses another administrative need: After an accidental on-premises account deletion, a synchronized user disappears from the Microsoft 365 directory. This question instead requires the outcome: Only the designated active server exports changes while the standby is prepared.

Use Conditional Access with targeted users, cloud app and device state conditions. can be useful when users accessing a finance app from unmanaged devices must pass a policy condition rather than receive unrestricted access. However, it does not specifically achieve: Only the designated active server exports changes while the standby is prepared.

Modify the authoritative Active Directory attribute and run normal sync. is directed at a separate task: A directory team wants to understand why an Entra user attribute is read-only in cloud admin center. It does not produce the required configuration outcome: Only the designated active server exports changes while the standby is prepared.

Enable pass-through authentication and deploy supported agents with redundancy. implements a different mechanism for: A hybrid company wants cloud authentication while applying certain on-premises policies through pass-through authentication agents. It does not configure the mechanism needed here: Use the supported staging-server approach for Connect Sync resilience.

Configure user or sign-in risk conditions with suitable remediation controls. is directed at a separate task: A user in a high-risk sign-in event should be challenged or denied according to risk-based policy. It does not produce the required configuration outcome: Only the designated active server exports changes while the standby is prepared.

One intended on-premises identity is linked to its existing cloud user. would assess a different control. In this case it does not rule out the specific failure: Two identically active sync servers produce competing export behavior.

In-scope Active Directory users provision through the Cloud Sync agent service. is evidence of another system state: A branch wants lightweight cloud-managed synchronization agents instead of a full dedicated Connect Sync server. The acceptance evidence here instead is: Only the designated active server exports changes while the standby is prepared.

Risky sign-ins are identified and handled according to the configured grant action. would assess a different control. In this case it does not rule out the specific failure: Two identically active sync servers produce competing export behavior.

The federated authentication dependency is down or incorrectly configured. would fit a different circumstance involving: A hybrid organization wants users to authenticate against its on-premises identity provider with an explicitly managed federation design. Here the actual symptom is: Two identically active sync servers produce competing export behavior.

The fault was not isolated using connector or provisioning-stage diagnostics. is a plausible failure in another case: The administrator restarts agents repeatedly without locating the failed export. It does not explain the current incident: Two identically active sync servers produce competing export behavior.

Required SSPR authentication method registration was never completed. would fit a different circumstance involving: A tenant must require user registration of security information when access recovery is enabled. Here the actual symptom is: Two identically active sync servers produce competing export behavior.

Use session revocation and credential remediation for a compromised user. can be useful when a protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. However, it does not specifically achieve: The employee signs in through a registered FIDO2 credential.

Configure Microsoft Entra Password Protection with a custom banned password list. addresses another administrative need: Administrators want to reject a known list of weak company-themed passwords at password change. This question instead requires the outcome: The employee signs in through a registered FIDO2 credential.

Verify the sign-in domain and plan a supported UPN mapping for hybrid identities. can be useful when a user has a UPN suffix in Active Directory that has not been verified in the cloud tenant. However, it does not specifically achieve: The employee signs in through a registered FIDO2 credential.

Install the supported proxy and DC agents and register the forest as required. is directed at a separate task: An organization extends cloud password protection to on-premises AD Domain Services. It does not produce the required configuration outcome: The employee signs in through a registered FIDO2 credential.

Configure and verify the option to unlock an account without changing the password in the supported identity environment. implements a different mechanism for: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. It does not configure the mechanism needed here: Use approved phishing-resistant authentication methods such as FIDO2 security keys where supported.

Configure the secondary Connect Sync server in staging mode and document a controlled switchover. is directed at a separate task: Two hybrid sync servers cannot both actively export the same set of objects to one tenant in the intended design. It does not produce the required configuration outcome: The employee signs in through a registered FIDO2 credential.

An eligible user completes password recovery using registered verification methods. would assess a different control. In this case it does not rule out the specific failure: Staff are instructed to use SMS while the policy requires phishing-resistant authentication.

A prohibited company-themed password is rejected during a test change. is evidence of another system state: Administrators want to reject a known list of weak company-themed passwords at password change. The acceptance evidence here instead is: The employee signs in through a registered FIDO2 credential.

The contributing policy and matched user condition explain the block. would assess a different control. In this case it does not rule out the specific failure: Staff are instructed to use SMS while the policy requires phishing-resistant authentication.

The on-premises Password Protection DC agent path is absent or unhealthy. would fit a different circumstance involving: An organization extends cloud password protection to on-premises AD Domain Services. Here the actual symptom is: Staff are instructed to use SMS while the policy requires phishing-resistant authentication.

The Temporary Access Pass lifetime or one-time-use setting was not constrained. is a plausible failure in another case: A temporary enrollment code remains reusable beyond the approved period. It does not explain the current incident: Staff are instructed to use SMS while the policy requires phishing-resistant authentication.

The organizational unit was excluded by the Connect Sync filtering configuration. would fit a different circumstance involving: An organization needs synchronized Microsoft Entra identities with the broad features of an on-premises Connect Sync server. Here the actual symptom is: Staff are instructed to use SMS while the policy requires phishing-resistant authentication.

Configure Microsoft Entra Password Protection with a custom banned password list. can be useful when administrators want to reject a known list of weak company-themed passwords at password change. However, it does not specifically achieve: User authentication method registration shows Authenticator available and usable.

Use supported SSPR account unlock without password reset where eligible. addresses another administrative need: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. This question instead requires the outcome: User authentication method registration shows Authenticator available and usable.

Configure password hash synchronization through the supported Entra sync method. can be useful when help desk wants changed on-premises passwords usable for Microsoft 365 sign-in with password hash synchronization. However, it does not specifically achieve: User authentication method registration shows Authenticator available and usable.

Configure and verify the option to unlock an account without changing the password in the supported identity environment. is directed at a separate task: A locked-out employee remembers their password but must unlock the account through self-service without a forced credential change. It does not produce the required configuration outcome: User authentication method registration shows Authenticator available and usable.

Revoke sign-in sessions, reset credentials and investigate the specific risk event. implements a different mechanism for: A protected account must have its sessions invalidated after suspicious sign-in without permanently deleting the identity. It does not configure the mechanism needed here: Enable Microsoft Authenticator in the authentication methods policy.

Select Require device to be marked as compliant for the applicable users and apps. is directed at a separate task: The business wants to enforce accepted device compliance rather than merely check if the user owns a registered device. It does not produce the required configuration outcome: User authentication method registration shows Authenticator available and usable.