Question 270 Before first Entra directory synchronization, several on-premises users have duplicate or invalid proxy addresses. Which preflight tool category is relevant? Defender endpoint onboarding Purview DLP testing IdFix and source-directory attribute remediation Start an unrestricted export before cleaning duplicate proxyAddresses in the source directory Explanation Correct Answer C:Identity preparation tools can expose directory attributes that would cause sync conflicts. Incorrect Answers A:Device enrollment does not validate user proxy addresses for synchronization. B:Data exfiltration rules cannot fix source directory attribute formatting. D:Sending known conflicting proxy addresses to Entra simply repeats the uniqueness failures; the source attributes must be corrected first.
Question 271 Two on-premises accounts use the same intended cloud sign-in name and sync fails for one. What should be corrected? Unique UPN or identifier values in the authoritative on-premises source A Microsoft 365 Group expiration rule Edit the conflicting user's cloud display name while leaving the authoritative UPN collision intact Change the tenant's default sign-in suffix while leaving duplicate AD DS source UPNs intact Explanation Correct Answer A:Directory provisioning needs unique identity values for cloud objects. Incorrect Answers B:Collaboration lifecycle is unrelated to duplicate UPN sync. C:Display names are not the source identifiers used to resolve duplicate sign-in names during synchronization. D:A default tenant suffix does not resolve a collision between two authoritative synchronized source account names.
Question 272 An organization relies on complex directory topology and advanced sync customization with an existing Windows host. Which sync option should be assessed? Microsoft Entra Connect Sync where the required supported customization is available Choose Cloud Sync solely for a lightweight agent without validating its supported customization scope Microsoft Defender for Cloud Apps discovery Microsoft Purview Data Map connectors Explanation Correct Answer A:Connect Sync can handle scenarios requiring advanced configuration beyond lightweight agents. Incorrect Answers B:Cloud Sync may not expose the advanced transformation or topology features needed for this established deployment. C:App discovery cannot replace AD DS directory synchronization. D:Data catalog connections are not Entra user synchronization.
Question 273 A company wants cloud-managed synchronization configuration using lightweight agents rather than managing the full traditional sync server. What solution should be considered? Replace the existing system with another full Connect Sync server and keep all server-managed configuration Configure cloud provisioning rules without deploying the required supported on-premises agent Defender for Endpoint device connector Microsoft Entra Cloud Sync with its supported agent and topology requirements Explanation Correct Answer D:Cloud Sync uses on-premises provisioning agents and cloud-managed configuration. Incorrect Answers A:A traditional full Connect Sync host does not satisfy the request for cloud-managed agent-based provisioning. B:Cloud Sync requires a supported agent path to access and provision the source directory objects. C:Security endpoint telemetry does not provision Entra users.
Question 274 The Cloud Sync agent is online but a filtered OU's accounts do not reach Entra. What configuration should be checked? Defender Office 365 safe sender list Extend attribute mappings for every tenant user but leave the excluded OU filter unchanged Microsoft 365 Message center digest subscriptions Cloud Sync provisioning scope and OU/filter selections Explanation Correct Answer D:Correct agent health alone cannot include objects excluded by the provisioning configuration. Incorrect Answers A:Mail allow lists have no identity provisioning scope. B:Additional mapped fields cannot bring in accounts that are explicitly outside the provisioning scope. C:Vendor notices do not evaluate directory provisioning filters.
Question 275 An on-premises user is renamed, but Microsoft 365 must keep the existing synchronized cloud identity. What identity design principle matters? Use a stable source anchor that survives ordinary display-name or UPN changes Use the mutable primary SMTP address as the source anchor for every account Use the user's current display name as an immutable key Generate a new source anchor on every sync cycle Explanation Correct Answer A:Stable linkage prevents a rename being mistaken for a new account. Incorrect Answers B:Email addresses may be renamed or reassigned and are unsuitable as the immutable matching anchor for a user's synchronized identity. C:Display names can change and are not safe anchor values. D:Unstable anchors can create duplicates or break joins.
Question 276 A synchronized department value reverts after a cloud admin updates it. Where should the change usually originate? Edit the synced user's Entra profile directly again and expect the change to survive the next scheduled attribute flow The service health outage record The Microsoft 365 subscription invoice The on-premises attribute that is authoritative for that synchronized property Explanation Correct Answer D:Sync reasserts authoritative source values. Incorrect Answers A:Cloud edits to a sourced AD DS property are overwritten as long as the on-premises attribute remains authoritative. B:Incident history cannot master employee attributes. C:Billing data does not update department attributes.
Question 277 An existing cloud account and an incoming on-premises identity appear to represent one worker. What must the migration design avoid? Use only display-name similarity to merge objects Every cloud user must be deleted first Unverified identity matching that creates duplicate or wrongly linked directory accounts Join cloud and on-premises identities by display name alone when names appear to match Explanation Correct Answer C:Account matching requires correct identifiers and carefully reviewed source data. Incorrect Answers A:A shared name is insufficient evidence of identity equivalence. B:Blanket deletion is destructive and not inherently required for matching. D:Display names are not stable unique source anchors and can bind different people to the wrong cloud identity.
Question 278 Security asks whether password hash synchronization uploads employees' plaintext passwords to Entra. What is the correct explanation? Assume password hash sync uploads a reversibly encrypted password that Entra decrypts PHS uploads each password in clear text for Microsoft to encrypt later Password hash synchronization transfers a derived hash representation, not readable plaintext passwords PHS exposes users' password change history to every administrator Explanation Correct Answer C:PHS does not copy original plaintext user passwords. Incorrect Answers A:PHS handles a derived hash representation rather than a recoverable copy of the user's plaintext credential. B:This misstates the synchronization design. D:Sync does not provide all administrators readable password history.
Question 279 A user changed their on-premises password but cloud sign-in still accepts the prior one briefly. What should be investigated? Office desktop update release status Password hash synchronization state and recent sync processing Inspect cloud-to-on-premises password writeback instead of the on-premises-to-cloud hash sync pipeline Trigger a full user-and-group export instead of checking recent password-hash synchronization errors and propagation delays Explanation Correct Answer B:Cloud sign-in behavior can reflect delayed or failing hash propagation. Incorrect Answers A:Client software updates cannot synchronize the user's password hash. C:The reported lag is in propagation of a source AD DS password change toward cloud authentication, not writeback in the opposite direction. D:A full directory export is not a substitute for diagnosing the password hash synchronization pipeline after an on-premises password change.
Question 280 A company wants cloud sign-in password verification to use on-premises agents rather than only a cloud-stored password hash. What authentication model should it evaluate? Microsoft Entra pass-through authentication with supported agents An external access review report A Purview sensitivity label policy Use password hash synchronization alone without any available pass-through authentication agents Explanation Correct Answer A:PTA verifies password sign-ins through on-premises authentication agents. Incorrect Answers B:Reviews do not implement password verification. C:Classification cannot validate passwords. D:PHS validates against a cloud-synchronized hash rather than delegating each password validation to supported on-premises PTA agents.
