Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the objects shown in the following table.You configure Microsoft Entra Connect Sync to sync contoso.com to the Microsoft Entra tenant. Which objects will sync to the Microsoft Entra tenant?
Answer(s): D
Disabled accountsDisabled accounts are synchronized as well to Microsoft Entra ID. Disabled accounts are common to represent resources in Exchange, for example conference rooms. The exception is users with a linked mailbox; as previously mentioned, these will never provision an account to Microsoft Entra ID.The assumption is that if a disabled user account is found, then we won't find another active account later and the object is provisioned to Microsoft Entra ID with the userPrincipalName and sourceAnchor found. In case another active account will join to the same metaverse object, then its userPrincipalName and sourceAnchor will be used.
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/concept-azure-ad-connect-sync-user- and-contacts
You have a Microsoft 365 E5 subscription.You need to create Conditional Access policies to meet the following requirements:All users must use multi-factor authentication (MFA) when they sign in from outside the corporate network. Users must only be able to sign in from outside the corporate network if the sign-in originates from a compliant device.All users must be blocked from signing in from outside the United States and Canada.Only users in the R&D department must be blocked from signing in from both Android and iOS devices. Only users in the finance department must be able to sign in to a Microsoft Entra enterprise application named App1. All other users must be blocked from signing in to App1.What is the minimum number of Conditional Access policies you should create?
Answer(s): B
Only users in the finance department must be able to sign in to a Microsoft Entra enterprise application named App1. All other users must be blocked from signing in to App1.One Policy.Only users in the R&D department must be blocked from signing in from both Android and iOS devices. One Policy.Users must only be able to sign in from outside the corporate network if the sign-in originates from a compliant device.All users must use multi-factor authentication (MFA) when they sign in from outside the corporate network. One policyAll users must be blocked from signing in from outside the United States and Canada. Only users in the R&D department must be blocked from signing in from both Android One Policy
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory domain. You have a Microsoft 365 E5 subscription.You plan to implement directory synchronization.You need to identify potential synchronization issues for the domain. The solution must use the principle of least privilege.What should you use? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: IdFixQuery and fix invalid object attributes with the IdFix toolMicrosoft is working to reduce the time required to remediate identity issues when onboarding to Microsoft 365. A portion of this effort is intended to address the time involved in remediating the Windows Server Active Directory (Windows Server AD) errors reported by the directory synchronization tools such as Microsoft Entra Connect and Microsoft Entra Connect cloud sync. The focus of IdFix is to enable you to accomplish this task in a simple, expedient fashion.The IdFix tool provides you the ability to query, identify, and remediate the majority of object synchronization errors in your Window’s Server AD forests in preparation for deployment to Microsoft 365. The utility does not fix all errors, but it does find and fix the majority. This remediation will then allow you to successfully synchronize users, contacts, and groups from on-premises Active Directory into Microsoft 365. Note: IdFix might identify errors beyond those that emerge during synchronization. The most common example is compliance with rfc 2822 for smtp addresses. Although invalid attribute values can be synchronized to the cloud, the product group recommends that these errors be corrected.Incorrect:AccessChkBox 2: Enterprise AdminsIdFix permissions requirementsThe user account that you use to run IdFix must have read and write access to the AD DS domain.If you aren’t sure if your user account meets these requirements, and you’re not sure how to check, you can still download and run IdFix. If your user account doesn’t have the right permissions, IdFix will simply display an error when you try to run it.Enterprise AdminsThe Enterprise Admins group exists only in the root domain of an Active Directory forest of domains. The group is a Universal group if the domain is in native mode. The group is a Global group if the domain is in mixed mode. Members of this group are authorized to make forest-wide changes in Active Directory, like adding child domains.Incorrect:Domain AdminsMembers of the Domain Admins security group are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. The Domain Admins group is the default owner of any object that's created in Active Directory for the domain by any member of the group. If members of the group create other objects, such as files, the default owner is the Administrators group.Server OperatorServer Operators can log on to a server interactively; create and delete network shares; start and stop services; back up and restore files; format the hard disk of the computer; and shut down the computer. Any service that accesses the system has the Service identity.* Domain Users - too few permissionsThe Domain Users group includes all user accounts in a domain. When you create a user account in a domain, it's automatically added to this group.
https://microsoft.github.io/idfix/https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.Multi-factor authentication (MFA) is configured to use 131.107.5.0/24 as trusted IPs.The tenant contains the named locations shown in the following table.You create a conditional access policy that has the following configurations: Users: All usersTarget resources assignment: App1 Conditions: Include all trusted locationsGrant access: Require multi-factor authenticationFor each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Yes131.107.50.10 is in a Trusted Location so the conditional access policy applies. The policy requires MFA. However, User1’s MFA status is disabled. The MFA requirement in the conditional access policy will override the user’s MFA status of disabled. Therefore, User1 must use MFA.Box 2: Yes.131.107.20.15 is in a Trusted Location so the conditional access policy applies. The policy requires MFA so User2 must use MFA.Box 3: No.IP not from Trusted Location so Policy does not apply, Subnet 131.107.5.5 is not in the range of 131.107.50.0/24
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
You have a Microsoft 365 subscription.You register two applications named App1 and App2 to Microsoft Entra ID.You need to ensure that users who connect to App1 require multi-factor authentication (MFA). MFA is required only for App1. What should you do?
Use Conditional Access policiesIf your organization has more granular sign-in security needs, Conditional Access policies can offer you more control. Conditional Access lets you create and define policies that react to sign in events and request additional actions before a user is granted access to an application or service.
https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor- authentication
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.