Question 280 A company wants cloud sign-in password verification to use on-premises agents rather than only a cloud-stored password hash. What authentication model should it evaluate? Microsoft Entra pass-through authentication with supported agents An external access review report A Purview sensitivity label policy Use password hash synchronization alone without any available pass-through authentication agents Explanation Correct Answer A:PTA verifies password sign-ins through on-premises authentication agents. Incorrect Answers B:Reviews do not implement password verification. C:Classification cannot validate passwords. D:PHS validates against a cloud-synchronized hash rather than delegating each password validation to supported on-premises PTA agents.
Question 281 A tenant uses pass-through authentication and an agent host fails during a network outage. What design reduces reliance on one host? Deploy and monitor additional supported PTA agents for redundancy Enable guest invitations for all users Install a second PTA agent on the same unavailable host with no separate failure domain Increase password retry limits instead of adding a second available PTA agent Explanation Correct Answer A:Multiple healthy agents reduce a single server's effect on authentication. Incorrect Answers B:Guest access does not replace PTA agent redundancy. C:A redundant process on the failed host cannot provide independent availability during that host or site's outage. D:Retry settings do not provide authentication service availability when the sole validating agent is unreachable.
Question 282 A federated sign-in deployment depends on an external identity provider that is unavailable. What should administrators anticipate? All cloud resources will automatically become publicly accessible Assume federated users fall back automatically to PHS when the identity provider is down Reset every user's cloud password while leaving the failed federated identity provider as the sign-in path Federated authentication may fail while its identity provider is unavailable Explanation Correct Answer D:Federation adds an availability dependency for sign-in processing. Incorrect Answers A:An identity provider outage does not grant anonymous access. B:A supported cloud-authentication contingency requires explicit configuration and cannot be inferred from the presence of synced objects. C:Password resets cannot repair the authentication flow while requests still depend on unavailable federation infrastructure.
Question 283 The identity team needs visibility into health and alerts for supported synchronization infrastructure. Which Microsoft Entra feature is relevant? Microsoft Secure Score email recommendations only Purview Activity explorer only Microsoft Entra Connect Health for monitored supported components Review ordinary tenant user create/delete events without synchronization agent health data Explanation Correct Answer C:Connect Health provides synchronization or identity infrastructure health signals. Incorrect Answers A:Email posture is not a synchronization server health dashboard. B:Classification activity is not directory sync health monitoring. D:General directory audit events do not replace service and component health signals from the monitored sync infrastructure.
Question 284 The Entra Connect server is online but directory changes stopped exporting yesterday. Which component should be investigated? OneDrive synchronization on an employee's laptop Microsoft 365 Apps device update channel The synchronization scheduler and connector run history Email anti-phishing safety tips Explanation Correct Answer C:An online Windows host can still have a paused or failing sync cycle. Incorrect Answers A:File synchronization is distinct from directory synchronization. B:Office servicing cannot resume Entra Connect cycles. D:Phishing policy does not control connector runs.
Question 285 A sync report shows export errors for only a few objects after an attribute update. What should the team inspect? Check only the tenant-wide synchronization status without opening the five object-level export errors Per-object provisioning/export error details and conflicting attributes Change users to another sign-in authentication method to resolve a directory export conflict Rerun a full synchronization before resolving which changed attributes each object rejected Explanation Correct Answer B:Object-level failures can have specific formatting or uniqueness causes. Incorrect Answers A:A healthy overall cycle can coexist with rejected per-object attribute exports that require individual investigation. C:Authentication choices do not repair object attribute constraints discovered during provisioning export. D:Reprocessing the same invalid or conflicting source values tends to repeat the specific export errors.
Question 286 A misconfigured OU filter suddenly marks thousands of synchronized accounts for deletion. Which safeguard is relevant? Delete the source OU to resynchronize from scratch Reduce the license count for affected users Disable all Entra sign-in logs first Accidental deletion protection and a review of changed synchronization scope Explanation Correct Answer D:Deletion threshold safeguards help prevent mass removal due to filtering mistakes. Incorrect Answers A:Deleting source accounts worsens the accidental deletion risk. B:License reduction can worsen impact without fixing the filter. C:Removing sign-in logs does not stop destructive object deletion.
Question 287 IT must replace an aging Entra Connect Sync server while keeping one authoritative active exporter. What role can a staging server play? Run two unrestricted active exporters forever to increase speed Enable the replacement server's active export while the existing server is still authoritative Validate configuration and imports without becoming an active exporter until cutover Change all users to cloud-only by removing AD accounts Explanation Correct Answer C:Staging mode supports preparation without competing exports from two active servers. Incorrect Answers A:Multiple independent exporters can introduce conflicting directory changes. B:Simultaneous active exports for the same managed identities undermine the controlled staging-to-primary cutover. D:Mass identity conversion is beyond a controlled sync server migration.
Question 288 A branch Cloud Sync provisioning agent shows unhealthy and new local users are not appearing in Entra. What should be checked? Broaden all OU provisioning filters while the local agent still cannot communicate The OneDrive file sync status on laptops Agent service connectivity, credentials and provisioning health The tenant's Service health notices for Power BI only Explanation Correct Answer C:Agent communication and configuration affect object provisioning. Incorrect Answers A:Filter changes will not restore synchronization when the agent service or its network authentication path is unavailable. B:Client file syncing is not directory provisioning agent operation. D:An unrelated workload advisory does not establish agent state.
Question 289 A single synchronized user fails provisioning because its mail attribute contains an unsupported address format. Where should the correction be made? Change the user's Exchange Online alias in the cloud, while keeping the invalid authoritative mail/proxy attribute unchanged in on-premises AD DS The destination user's Microsoft 365 Apps channel Change Exchange accepted-domain routing before repairing the invalid mail attribute at its source The authoritative on-premises mail/proxy attribute and validation rules Explanation Correct Answer D:A malformed source address will recur until corrected at the source. Incorrect Answers A:A synchronized source attribute will continue to cause export errors until the invalid original value is corrected at its authority. B:Office client updates do not sanitize directory mail attributes. C:Exchange transport configuration cannot make an unsupported authoritative source attribute valid for directory provisioning.
Question 290 Several forests synchronize into one tenant and two accounts represent the same worker. What governance concern is critical? Pick whichever forest has the newest account timestamp as authoritative for all identity fields Assigning one license per source forest account by default Reliable object matching and attribute precedence across all source forests Join accounts only when their display names match across forests Explanation Correct Answer C:Multi-forest identity collisions can create duplicate or misjoined cloud principals. Incorrect Answers A:Creation recency is not a supported substitute for explicit object matching and authoritative attribute precedence. B:Blind duplication wastes seats and does not fix identity matching. D:Names can repeat or change; multi-forest matching requires supported anchors, precedence and join rules.
