Question 290 Several forests synchronize into one tenant and two accounts represent the same worker. What governance concern is critical? Pick whichever forest has the newest account timestamp as authoritative for all identity fields Assigning one license per source forest account by default Reliable object matching and attribute precedence across all source forests Join accounts only when their display names match across forests Explanation Correct Answer C:Multi-forest identity collisions can create duplicate or misjoined cloud principals. Incorrect Answers A:Creation recency is not a supported substitute for explicit object matching and authoritative attribute precedence. B:Blind duplication wastes seats and does not fix identity matching. D:Names can repeat or change; multi-forest matching requires supported anchors, precedence and join rules.
Question 291 An eligible privileged role is assigned to a role-assignable group, but a member cannot yet make role changes. What should the engineer inspect? Only the group's Exchange primary SMTP address Effective assignment and activation status, including PIM for Groups where applicable Only the user's default Microsoft 365 Apps channel Only the tenant Service health incident notifications Explanation Correct Answer B:Group-based role eligibility may still require explicit elevation before administrator capabilities take effect. Incorrect Answers A:Mail addressing does not activate directory privilege. C:Application servicing is unrelated to role activation. D:Provider incidents cannot grant role assignments.
Question 292 Hybrid users should reset their passwords in the cloud and have the changes written back to on-premises AD DS. What capability must be evaluated? Supported SSPR password writeback integration and prerequisites Enable PHS and assume it automatically reverses the password synchronization direction Enable cloud SSPR registration without configuring writeback permissions to AD DS A Defender endpoint alert suppression rule Explanation Correct Answer A:Writeback is needed if a cloud reset must update the authoritative local password. Incorrect Answers B:Password hash sync publishes derived on-premises credentials to cloud; it does not implement cloud password reset writeback. C:Cloud reset registration by itself does not send credential changes to the authoritative on-premises directory. D:Endpoint alert management cannot provide directory password writeback.
Question 293 Cloud SSPR succeeds for a hybrid user but the on-premises directory rejects the writeback. What should be checked? Writeback agent health and required AD DS account permissions Force a new directory export cycle rather than inspect the failed password-writeback transaction Relax cloud password requirements while leaving the on-premises writeback permissions unresolved Inspect only the user's MFA registration methods despite the reported AD DS writeback rejection Explanation Correct Answer A:Directory writeback requires a working connector and permissions to change the affected account. Incorrect Answers B:An outbound directory export does not fix the permissions or service failure in the separate password-writeback path. C:Cloud policy changes cannot grant the writeback identity the necessary source AD DS password-reset rights. D:MFA registration proves nothing about the agent's rights to modify password attributes in the source directory.
Question 294 A tenant uses Connect Sync to provision identities and a federated identity provider for authentication. What separation should the administrator understand? Connect Sync automatically replaces all federated sign-in endpoints Federation necessarily disables directory synchronization Expect the federated identity provider to create every Entra user instead of provisioning objects Provisioning synchronizes identities, while federation handles supported sign-in authentication Explanation Correct Answer D:Directory object lifecycle and actual sign-in verification are different components. Incorrect Answers A:Synchronization does not by itself eliminate federation dependencies. B:Sign-in federation can coexist with synced user accounts. C:Federation authenticates supported identities; it does not replace the directory-provisioning process that creates and updates cloud accounts.
Question 295 A newly acquired OU is absent from Entra, while other OUs are synchronizing. What change should be investigated? Defender incident advanced hunting query syntax The Cloud Sync scope and inclusion filters for the acquired OU The tenant's Office application update channel A Purview DLP policy for acquired files Explanation Correct Answer B:Objects outside configured provisioning scope do not export despite healthy agent status. Incorrect Answers A:Security telemetry does not govern identity provisioning scope. C:Client servicing cannot add an AD DS OU to Cloud Sync scope. D:File leakage protection does not include directory OUs.
Question 296 An on-premises user attribute has been corrected, yet Entra continues showing the old value. Which evidence best isolates the issue? Latest sync cycle state and attribute export flows for that object Change Exchange address policies without examining the latest export for the specific synchronized attribute The organization's external guest invitation history A Microsoft 365 Group owner list Explanation Correct Answer A:Connector history reveals whether the correction entered the pipeline and reached Entra. Incorrect Answers B:An address policy adjustment is not sufficient evidence that the corrected attribute flowed from its source object into Entra. C:Invites are unrelated to this existing synced attribute. D:Group ownership does not prove attribute export success.
Question 297 A cloud application modifies a user attribute in Entra, but on-premises AD DS must use the new value. What should the engineer verify? Rely on soft matching alone to write an edited cloud profile field into the source directory Whether that exact attribute supports the intended bidirectional writeback mechanism Enable password writeback and assume every user profile attribute also flows to on-premises AD DS Every cloud directory attribute is writeback-enabled by default Explanation Correct Answer B:Not every synced property can be written back to AD DS automatically. Incorrect Answers A:Identity matching does not establish that a particular user property supports outbound writeback to AD DS. C:Password writeback is a specialized credential flow; it does not provide generic bidirectional synchronization for arbitrary attributes. D:Synchronization typically has authoritative directions and supported feature limits.
Question 298 A source AD DS user is accidentally deleted and later disappears from Entra. What lifecycle dependency explains this? Remove accidental deletion safeguards and allow the source deletion to flow without assessing whether the resulting cloud identity is recoverable Disable accidental-deletion safeguards and assume the synchronized cloud account will remain indefinitely The cloud user's licensing expired and deleted AD DS Directory synchronization propagates scoped source deletions subject to safeguards Explanation Correct Answer D:An on-premises mastered object can be deprovisioned in the cloud when removed from scope. Incorrect Answers A:Disabling safeguards does not clarify lifecycle behavior and can amplify unintended cloud deletions after source changes. B:A scoped deletion can propagate into Entra; removing safeguards makes unintended bulk deletions more dangerous. C:Product licensing does not delete authoritative on-premises accounts.
Question 299 A hybrid tenant uses cloud password hash synchronization and its on-premises domain controllers become temporarily unavailable. Which effect should administrators assess? Switch every user to PTA during the domain-controller outage without verifying accessible agents All OneDrive content is erased when DCs fail All Entra sign-ins must fail because DCs are down Existing cloud sign-in can continue using synchronized credentials even while new on-premises changes stop Explanation Correct Answer D:PHS cloud verification is not the same live dependency as PTA. Incorrect Answers A:PTA requires reachable on-premises validation infrastructure, whereas existing PHS cloud credentials can still authenticate during a source outage. B:Directory infrastructure availability does not delete cloud documents. C:PHS sign-in does not verify every login against a live on-premises DC.
Question 300 Users are in Cloud Sync scope, but a target group is not provisioned. What should be checked? Only the user's Intune compliance policy Change the group's SMTP alias while leaving Cloud Sync group support and filters untested Only a Defender for Office 365 quarantine rule Group provisioning support, filtering and configured object scope for the selected sync service Explanation Correct Answer D:User object success does not prove all group types and filters are supported. Incorrect Answers A:Device compliance does not create directory groups. B:An email alias does not determine whether the sync service supports and includes the group object in provisioning scope. C:Mail protection does not govern group object export.
