Question 310 An employee has an account in two source forests but should have one Microsoft 365 identity. What must be designed? Two separate cloud identities with identical UPNs Match source forest accounts by identical display name and assume they will automatically merge into one stable Entra user object Match multiple forest users solely by identical UPN text without defining source ownership Supported joining rules and source anchor ownership for one cloud user Explanation Correct Answer D:Cross-forest matching must avoid duplicate cloud identities. Incorrect Answers A:Duplicate UPNs cannot be used as a join strategy. B:Multi-forest joining requires documented rules and source-anchor ownership; names are neither reliably unique nor immutable. C:UPN matches can be ambiguous across forests and do not establish which object owns the one cloud identity.
Question 311 An organization wants cloud sign-in without requiring a live on-premises authentication agent. Which model best meets that availability requirement? Password hash synchronization with cloud authentication Pass-through authentication requiring an available agent A permanently disabled synchronization connector A dedicated federation service only Explanation Correct Answer A:Cloud verification does not require every sign-in to reach on-prem AD DS. Incorrect Answers B:PTA depends on agent connectivity to validate credentials. C:No directory updates would maintain hybrid identity lifecycle. D:Federation introduces provider availability dependencies.
Question 312 Users cannot sign in after every pass-through authentication agent host lost connectivity. Which dependency is most relevant? Switch to a federated sign-in domain without a validated, available identity provider Change Conditional Access session frequency while no PTA agent is reachable Restore health and connectivity of an available PTA authentication agent Increase the frequency of pass-through authentication retries while every PTA agent remains unreachable Explanation Correct Answer C:PTA uses on-prem agents to validate passwords. Incorrect Answers A:Unplanned federation is not a repair for unavailable PTA validation and may introduce another sign-in dependency. B:Session changes cannot restore password validation when the configured pass-through authentication service has no available agents. D:More retry attempts cannot authenticate users until a supported reachable agent can validate credentials against on-premises AD DS.
Question 313 A tenant wants to test cloud authentication for one group while most users continue federated sign-in. Which approach can support a limited test? Use supported staged rollout of cloud authentication for selected users Apply cloud authentication to the whole tenant rather than the intended small pilot group Disable federation for every domain immediately Create a new user group in Entra without configuring staged cloud authentication for its members Explanation Correct Answer A:Staging reduces risk while changing sign-in authority. Incorrect Answers B:An all-user authentication cutover breaches the requirement to preserve the majority of existing federated users during the trial. C:A blanket change defeats pilot scope. D:Group membership alone does not change the authentication authority for selected federated identities.
Question 314 A federated tenant suddenly rejects sign-ins due to an expired signing certificate. What must be investigated? An unused Purview label publishing policy Federation certificate trust and the configured identity provider metadata Reset browser session lifetimes but leave the expired federation token-signing trust unchanged Require MFA for all users without fixing federation's expired signing certificate Explanation Correct Answer B:Invalid trust prevents Microsoft from accepting assertions. Incorrect Answers A:Classification does not repair identity tokens. C:Session duration does not repair a token issuer or signing certificate that the relying party no longer trusts. D:An additional authentication factor cannot validate identity assertions signed by an untrusted or expired federation certificate.
Question 315 Two independently configured Connect Sync servers attempt active exports to one tenant for the same source population. What configuration is safer? Assign identical static passwords to both service accounts Disable tenant audit logs during a cutover Point both servers at the same mailbox database Use supported staging mode for the standby Connect Sync server Explanation Correct Answer D:Staging prevents two active exporters racing on objects. Incorrect Answers A:Shared passwords do not prevent export collisions. B:Audit status is not staging control. C:Exchange databases do not coordinate directory exports.
Question 316 A healthy Connect Sync staging server must replace a failed active sync host. What sequence matters? Recreate every cloud account with a new identifier Enable exports from both the failed former active host and the staging host simultaneously to speed recovery Convert all cloud users into guests before promotion Promote the staging server to active export after controlling the former active instance Explanation Correct Answer D:Only the intended active instance should export changes. Incorrect Answers A:Unnecessary reprovisioning risks duplicate identities. B:Two uncontrolled active export paths can create conflicting directory updates; promote the healthy staging host with explicit control of the old active path. C:Guest conversion breaks identity continuity.
Question 317 Changes are visible in local AD DS but not yet in the cloud after five minutes. What should be determined before treating this as failure? Open a Defender incident for all users immediately Change the tenant's default sign-in domain to force synchronization of the delayed source attributes Reduce sensitivity label encryption strength Check the scheduled or triggered synchronization cycle and its last result Explanation Correct Answer D:Change visibility depends on sync timing and successful cycles. Incorrect Answers A:No attack evidence has been established. B:Domain selection does not initiate the necessary delta cycle or explain the last connector processing result. C:Classification does not affect directory update timing.
Question 318 A normal connector cycle changes only updated objects rather than reviewing all directory data. What type of cycle is this? A mandatory full initial import of every object A delta synchronization cycle Perform a full connector synchronization of all directory objects for every normal incremental change, without assessing whether a delta cycle is sufficient A device antivirus scan Explanation Correct Answer B:Delta processing handles changed source state. Incorrect Answers A:Full import is broader than delta changes. C:Routine changes generally use a delta cycle; full cycles are for specific configuration changes or recovery needs and add overhead. D:Endpoint scanning does not import directory objects.
Question 319 An administrator updates attribute flow rules but normal delta cycles do not recalculate older objects as expected. What should be evaluated? Run the appropriate full synchronization cycle after the configuration change Add new users for every old identity Run another ordinary delta cycle and expect it to reevaluate objects affected by a changed attribute-flow rule that needs full synchronization Turn off Entra sign-in logs Explanation Correct Answer A:Full reevaluation can apply modified transformation logic. Incorrect Answers B:Duplicating objects masks the original issue. C:Delta cycles may not recalculate the older object state after certain rule changes; use the supported full synchronization operation. D:Logging does not refresh attribute values.
Question 320 Accounts were moved to an excluded OU and then disappeared from cloud scope. What best explains the result? Create new cloud-only accounts for all removed users without examining the excluded organizational-unit synchronization filter Cloud mailboxes automatically disable OU filtering The user count exceeded a Defender incident threshold The configured organizational-unit filter no longer includes those source accounts Explanation Correct Answer D:Object moves across filter boundaries affect provisioning scope. Incorrect Answers A:New accounts can break identity continuity; the OU filter is what moved the original synchronized objects out of scope. B:Mailbox state is not the source filter. C:Security incidents are not the directory filter.
