Your on-premises network contains an Active Directory domain. You have a Microsoft 365 E5 subscription.You plan to implement a hybrid configuration that has the following requirements:-Minimizes the number of times users are prompted for credentials when they access Microsoft 365 resources-Supports the use of Microsoft Entra ID ProtectionYou need to configure Microsoft Entra Connect to support the planned implementation. Which two options should you select? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Answer(s): A,D
Cloud authenticationWhen you choose this authentication method, Microsoft Entra handles users' sign-in process. Coupled with single sign-on (SSO), users can sign in to cloud apps without having to reenter their credentials. With cloud authentication, you can choose from two options:Microsoft Entra password hash synchronization. The simplest way to enable authentication for on-premises directory objects in Microsoft Entra. Users can use the same username and password that they use on- premises without having to deploy any other infrastructure. Some premium features of Microsoft Entra, like Identity Protection and Microsoft Entra Domain Services, require password hash synchronization, no matter which authentication method you choose.Microsoft Entra Pass-through Authentication (incorrect) Incorrect:Not B: Microsoft Entra self-service password reset (SSPR) lets users reset their passwords in the cloud, but most companies also have an on-premises Microsoft Entra Domain Services environment for users. Password writeback allows password changes in the cloud to be written back to an on-premises directory in real time by using either Microsoft Entra Connect or Microsoft Entra Connect cloud sync. When users change or reset their passwords using SSPR in the cloud, the updated passwords also written back to the on-premises Microsoft Entra Domain Services environment.
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn
HOTSPOT (Drag and Drop is not supported)Your network contains an Active Directory domain and a Microsoft Entra tenant.You implement directory synchronization for all 10,000 users in the organization. You automate the creation of 100 new user accounts.You need to ensure that the new user accounts synchronize to the Microsoft Entra as quickly as possible. Which command should you run? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Start-AdSyncSyncCycleMicrosoft Entra Connect synchronizes Active Directory to Microsoft Entra ID on a schedule. The minimum time between synchronizations is 30 minutes.If you want to synchronize changes to Active Directory without waiting for the next sync cycle, you can initiate a sync by using the Start-AdSyncSyncCycle. The Delta option synchronizes changes to Active Directory made since the last sync. The Full option synchronizes all Active Directory objects including those that have not changed.Box 2: Delta
https://blogs.technet.microsoft.com/rmilne/2014/10/01/how-to-run-manual-dirsync-azure-active-directory-sync- updates/
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains the users shown in the following table.Each user has a device with the Microsoft Authenticator app installed.From Microsoft Authenticator settings for the subscription, the Enable and Target settings are configured as shown in the exhibit. (Click the Exhibit tab.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: YesUser1 is member of Group1, passwordless capable, and MFA method is Microsoft Authenticator. The Microsoft Authenticator is configured for number matching for Group1.Box 2: NoUser2 is member of Group2 only.Box 3: NoUser3 is member of both Group1 and Group2.However, MFA method does not include Microsoft Authenticator.Note: How number matching works in multifactor authentication (MFA) push notifications for Authenticator - Authentication methods policyThis topic covers how number matching in Microsoft Authenticator push notifications improves user sign-in security. Number matching is a key security upgrade to traditional second factor notifications in Authenticator.Beginning May 8, 2023, number matching is enabled for all Authenticator push notifications. As relevant services deploy, users worldwide who are enabled for Authenticator push notifications will begin to see number matching in their approval requests. Users can be enabled for Authenticator push notifications either in the Authentication methods policy or the legacy multifactor authentication policy if Notifications through mobile app is enabledNote 2: Microsoft offers the following three passwordless authentication options that integrate with Microsoft Entra ID:Microsoft Authenticator - turns any iOS or Android phone into a strong, passwordless credential by allowing users to sign into any platform or browser.FIDO2-compliant security keys - useful for users who sign in to shared machines like kiosks, in situations where use of phones is restricted, and for highly privileged identities.Windows Hello for Business
https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless- deployment
You have a Microsoft 365 subscription that contains a Microsoft Entra tenant named contoso.com. The tenant includes a user named User1.You enable Microsoft Entra ID Protection.You need to ensure that User1 can review the list in Microsoft Entra ID Protection of users flagged for risk. The solution must use the principle of least privilege.To which role should you add User1?
Answer(s): B
The risky sign-ins reports are available to users in the following roles:Security Administrator Global Administrator Security ReaderNote:There are several versions of this question in the exam. The question has three possible correct answers: Security ReaderSecurity Administrator Global AdministratorOther incorrect answer options you may see on the exam include the following: Reports ReaderCompliance Administrator
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risky-sign-in
The risky sign-ins reports are available to users in the following roles:Security Administrator Global Administrator Security ReaderOf the three roles listed above, the Security Reader role has the least privilege. Note:There are several versions of this question in the exam. The question has three possible correct answers: Security ReaderSecurity Administrator Global AdministratorOther incorrect answer options you may see on the exam include the following: Service Administrator.Reports Reader Compliance Administrator
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.