Question 330 An attribute arrives in Entra with unexpected capitalization or formatting after a new rule. Which information identifies the transformation? Defender endpoint exposure score alone SharePoint storage usage charts Recipient safe-links rewrite settings Attribute-mapping rule evaluation and source/target values for the object Explanation Correct Answer D:Mapping logic determines exported property values. Incorrect Answers A:Device exposure cannot explain directory transformations. B:Storage charts cannot show identity mappings. C:Link protection is unrelated to identity formatting.
Question 331 A connector reports repeated authentication errors after its host clock drifts substantially. What should be checked? Increase all user OneDrive quotas Reset every user's MFA method Host clock and authentication trust before rotating directory accounts Remove all tenant verified domains Explanation Correct Answer C:Time-sensitive authentication may fail when clocks diverge. Incorrect Answers A:Storage cannot repair connector authentication. B:Users' methods do not control agent service credentials. D:Domain removal would disrupt unrelated services.
Question 332 Multiple acquired forests contain reused aliases, and source sync rejects some accounts. Which data quality rule matters? Every email proxy address must resolve uniquely to its intended directory recipient All users must have identical display names All forests must use the same objectGUID values Every group must share the same primary alias Explanation Correct Answer A:Conflicting values create matching and routing ambiguity. Incorrect Answers B:Display names need not be unique account anchors. C:GUID collisions are neither needed nor supported. D:Shared alias duplication makes conflicts worse.
Question 333 A sync agent repeatedly fails scheduled imports but no team notices until users complain. What monitoring should be enabled? Microsoft Entra Connect Health alerts for relevant synchronization components Assign an Outlook inbox category to Entra synchronization notification emails instead of setting supported connector health alerting Publish a mailbox retention rule for sync service account logs and treat it as a real-time provisioning component health monitor A sensitivity label on the source forest name Explanation Correct Answer A:Health monitoring surfaces connector failures promptly. Incorrect Answers B:Inbox categorization does not identify agent or import failures promptly when users have not yet reported symptoms. C:Keeping mail longer does not create actionable Connect Health alarms about import or agent connectivity failures. D:Classification does not alert on sync health.
Question 334 SSPR works for cloud-only users but reports writeback unavailable for hybrid users. What dependency should be reviewed? The endpoint antivirus scan schedule The cloud users' Exchange transport rules The default Teams meeting policy Supported password writeback configuration and on-prem permissions for hybrid identities Explanation Correct Answer D:Cloud reset alone cannot guarantee AD DS writeback. Incorrect Answers A:Scan timing cannot configure AD DS writeback. B:Mail flow has no password writeback function. C:Meetings settings cannot grant directory reset privileges.
Question 335 An administrator synchronizes users but only certain groups appear in Entra. What must be confirmed before re-creating missing groups? Increase the Entra user license count before confirming whether the sync method supports the missing group types and object filters Recreate all absent groups as cloud-only groups without confirming whether their source group type and filter are supported The last Defender phishing simulation score Supported group types and group/object filters in the selected sync method Explanation Correct Answer D:Not every source group may be in provisioning scope. Incorrect Answers A:Licensing does not change which group objects the selected synchronization solution and configured scope can export. B:Recreation can disrupt group identity and permissions; first determine whether the missing source objects are in supported sync scope. C:Phishing training cannot select sync groups.
Question 336 AD DS contacts do not appear in Entra after the organization enables a new sync configuration. What is the correct initial check? Change every user's strong authentication method Whether the chosen sync engine supports and scopes those contact objects Create new cloud contacts for all objects without testing Enable full mailbox auditing before adding contacts Explanation Correct Answer B:Provisioning behavior varies by object type and method. Incorrect Answers A:Authentication methods do not import contact objects. C:Manual duplicates may obscure the real limitation. D:Auditing is not the connector object-type setting.
Question 337 The connector agent service is running but cannot query a recently moved AD DS domain controller. What layer deserves investigation? Network, DNS, and LDAP/AD DS reachability from the agent host A conditional access policy for external guest users A Microsoft 365 usage report period Retry a cloud password reset for the agent service account instead of testing AD DS DNS resolution and LDAP reachability from the agent host Explanation Correct Answer A:A live process cannot provision inaccessible directory objects. Incorrect Answers B:Guest access settings do not fix local DC reachability. C:Usage metrics do not open directory connections. D:A connector that cannot reach the moved domain controller has a networking and directory endpoint problem, not a mailbox lifecycle issue.
Question 338 A synchronization server imports users but fails to read a newly secured OU. What should be assessed? Broaden user provisioning filters and restart exports, leaving the connector's OU read authorization unchanged The company's DMARC aggregate reporting address Source connector account permissions to read objects and attributes in the OU All employees' Power BI workspace memberships Explanation Correct Answer C:Delegation changes can prevent the connector reading identities. Incorrect Answers A:Wider filtering does not grant the source connector read rights to secured OU objects and may expand scope unnecessarily. B:Mail authentication is not directory delegation. D:Analytics permissions do not grant AD DS read access.
Question 339 An export rule rejects addresses with invalid syntax on several objects. Which action preserves data integrity? Fix invalid values in the authoritative directory and reevaluate the export Hide the errors by removing monitor alerts Create new tenants for the rejected users Disable all validation and force exports Explanation Correct Answer A:Correct source data prevents repeated provisioning errors. Incorrect Answers B:Suppressing alerts leaves malformed data unchanged. C:Tenant duplication does not normalize attributes. D:Bypassing checks can create corrupt accounts.
Question 340 A company needs to pause identity updates during a planned AD DS restructuring. What should be documented? A permanent removal of every synchronized cloud user Stop the synchronization Windows service without planning the supported scheduler pause/resume sequence or verifying recovery The supported scheduler/provisioning pause method and a controlled re-enable validation A security quarantine of all endpoint devices Explanation Correct Answer C:A controlled pause protects the transition and audit trail. Incorrect Answers A:Deleting identities cannot safely pause changes. B:An unplanned process stop risks inconsistent state; use documented provisioning pause and re-enable checks during restructuring. D:Device isolation does not pause provisioning.
