HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory domain named fabrikam.com. The domain contains the objects shown in the following table.The groups have the members shown in the following table.You are configuring synchronization between fabrikam.com and a Microsoft Entra tenant.You configure the Domain/OU Filtering settings in Microsoft Entra Connect as shown in the Domain/OUFiltering exhibit (Click the Domain/OU Filtering tab.)You configure the Filtering settings in Microsoft Entra Connect as shown in the Filtering exhibit. (Click the Filtering tab.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: NoThe filtering is configured to synchronize Group2 and OU2 only. The effect of this is that only members of Group2 who are in OU2 will be synchronized.User2 is in Group2. However, the User2 account object is in OU1 so User2 will not synchronize to Microsoft Entra.Box 2: YesGroup2 is in OU2 so Group2 will synchronize to Microsoft Entra. However, only members of the group who are in OU2 will synchronize. Members of Group2 who are in OU1 will not synchronize.Box 3: YesUser3 is in Group2 and in OU2. Therefore, User3 will synchronize to Microsoft Entra.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#group- based-filterin
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.From Microsoft Entra ID Protection, you configure a Multifactor authentication registration policy with the following settings on August 1st:Assignments: All usersControls: Require Microsoft Entra ID multifactor authentication registration Policy enforcement: EnabledOn August 3, you create two users named User1 and User2.Users authenticate by using Multi-Factor Authentication (MFA) for the first time on the dates shown in the following table.By which dates will User1 and User2 be forced to complete their MFA registration? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: August 19Note: Security defaults will trigger a 14 day grace period for registration after a user's first login and security defaults being enabled. After 14 days users will be required to register for MFA and will not be able to skip.Conditional Access by itself without Azure Identity Protection does not allow for the 14 day grace period. Identity Protection includes the registration policy that allows registration on its own with no apps assigned to the policy. If a Conditional Access policy requires Multi-Factor Authentication, then the user must be able to pass that MFA request.Box 2: August 21
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
Your on-premises network contains an Active Directory domain.You have a Microsoft 365 subscription.You need to sync the domain with the subscription. The solution must meet the following requirements: On-premises Active Directory password complexity policies must be enforced.Users must be able to use Microsoft Entra Self-Service Password Reset (SSPR).What should you use?
Answer(s): D
Microsoft Entra Pass-through Authentication allows your users to sign in to both on-premises and cloud-based applications using the same passwords.This feature is an alternative to Microsoft Entra Password Hash Synchronization, which provides the same benefit of cloud authentication to organizations. However, certain organizations wanting to enforce their on- premises Active Directory security and password policies, can choose to use Pass-through Authentication instead.Note: Microsoft Entra self-service password reset (SSPR) lets users reset their passwords in the cloud, but most companies also have an on-premises Active Directory Domain Services (AD DS) environment for users. Password writeback allows password changes in the cloud to be written back to an on-premises directory in real time by using either Microsoft Entra Connect or Microsoft Entra Connect cloud sync. When users change or reset their passwords using SSPR in the cloud, the updated passwords also written back to the on-premises AD DS environment.Password writeback is supported in environments that use the following hybrid identity models: Password hash synchronizationPass-through authenticationActive Directory Federation Services
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback
You have a Microsoft 365 E5 subscription.Users access Microsoft 365 from both their laptop and a corporate Virtual Desktop Infrastructure (VDI) solution.From Microsoft Entra ID Protection, you enable a sign-in risk policy.Users report that when they use the VDI solution, they are regularly blocked when they attempt to access Microsoft 365.What should you configure?
Answer(s): B
There are two types of risk policies in Microsoft Entra Conditional Access you can set up to automate the response to risks and allow users to self-remediate when risk is detected:Sign-in risk policy User risk policyConfigured trusted network locations are used by Identity Protection in some risk detections to reduce false positives.
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure- risk-policieshttps://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains a user named User1. Microsoft Entra Password Protection is configured as shown in the following exhibit.User1 attempts to update their password to the following passwords:F@lcon Project22T4il$pin45dg4Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Only T4il$pin45dg4Box 2: can attempt to sign in immediatelyNote: Manage Microsoft Entra smart lockout valuesBased on your organizational requirements, you can customize the Microsoft Entra smart lockout values. Customization of the smart lockout settings, with values specific to your organization, requires Microsoft Entra ID P1 or higher licenses for your users. Customization of the smart lockout settings is not available for Azure China 21Vianet tenants.To check or modify the smart lockout values for your organization, complete the following steps:Sign in to the Entra portal.2. Search for and select Microsoft Entra ID, then select Security > Authentication methods > Password protection.Set the Lockout threshold, based on how many failed sign-ins are allowed on an account before its first lockout.The default is 10 for Azure Public tenants and 3 for Azure US Government tenants.Set the Lockout duration in seconds, to the length in seconds of each lockout.6. The default is 60 seconds (one minute).If the first sign-in after a lockout period has expired also fails, the account locks out again. If an account locks repeatedly, the lockout duration increases.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.