Question 340 A company needs to pause identity updates during a planned AD DS restructuring. What should be documented? A permanent removal of every synchronized cloud user Stop the synchronization Windows service without planning the supported scheduler pause/resume sequence or verifying recovery The supported scheduler/provisioning pause method and a controlled re-enable validation A security quarantine of all endpoint devices Explanation Correct Answer C:A controlled pause protects the transition and audit trail. Incorrect Answers A:Deleting identities cannot safely pause changes. B:An unplanned process stop risks inconsistent state; use documented provisioning pause and re-enable checks during restructuring. D:Device isolation does not pause provisioning.
Question 341 An in-scope synchronized user is deleted accidentally and then restored in on-prem AD DS. What should admins consider? Change the Purview sensitive-information type Create a new cloud-only identity with the same display name before confirming the restored AD DS object's source anchor mapping Assign every tenant role to the recovered account Source restoration and supported cloud object recovery/matching behavior Explanation Correct Answer D:Recovery must avoid duplicate object anchors or lingering deletions. Incorrect Answers A:Classification does not restore identity anchors. B:A new cloud object may not preserve the former synchronized identity and application links; source restoration needs reconciliation. C:Excess privilege does not establish correct identity match.
Question 342 An HR workflow removes an employee from the synchronization scope but a retention rule preserves mailbox content. What distinction matters? A deleted user cannot have any recoverable cloud content Identity deprovisioning and content retention have separate lifecycle behavior A mail transport rule determines source accountEnabled state A retention label always keeps the user enabled Explanation Correct Answer B:Preserved content does not keep the identity active. Incorrect Answers A:Retention may preserve data independently. C:Transport rules do not manage directory object lifecycle. D:Retention is not an identity sign-in control.
Question 343 Management worries PHS stores users' cleartext AD DS passwords in Entra. What should the administrator explain? PHS only works for Microsoft Teams sign-ins Assume Entra Connect synchronizes the reversible AD DS password hash and decrypts it when the user signs in PHS copies passwords as readable user attributes PHS synchronizes a derived password hash, not user plaintext passwords Explanation Correct Answer D:The cloud receives derived verification material under the supported design. Incorrect Answers A:Cloud authentication applies beyond one workload. B:PHS uses derived hash material; plaintext passwords are not uploaded and reversed by the Entra service. C:Readable passwords are not its sync mechanism.
Question 344 The organization requires hybrid pass-through password validation and is designing redundant agents. What should it deploy? A Purview audit retention label on the agent folder Place two PTA agents on the same virtual host and assume that gives independent sign-in availability during a host outage A second onmicrosoft.com tenant for every agent Multiple supported pass-through authentication agents on independent hosts Explanation Correct Answer D:Redundancy reduces a single agent's impact on sign-in. Incorrect Answers A:Retention does not make agents available. B:Multiple agents must span meaningful failure domains for redundancy; colocated instances still fail with their shared host. C:Tenant sprawl is not required for agent resilience.
Question 345 A federated SSO provider fails, while Microsoft 365 service health is normal. Which users are most at risk? Only employees with Teams meeting licenses Users whose authentication depends on the unavailable federated provider Assume users with PHS configured automatically fall back to cloud password authentication while federation remains the active sign-in method Only users with unusually large SharePoint libraries Explanation Correct Answer B:Federation is a critical part of their sign-in path. Incorrect Answers A:Meeting entitlement is not the federation dependency. C:A PHS backup does not guarantee automatic federation failover without an appropriate supported authentication changeover. D:Storage does not choose federated authentication.
Question 346 Two on-premises objects unexpectedly map to an identical immutable anchor during migration. What is the primary risk? Email messages automatically bypass spam filtering Both users receive identical mailbox storage quotas only All directory groups become nested by default Cloud identity collision or incorrect object association Explanation Correct Answer D:Source anchors must unambiguously identify source objects. Incorrect Answers A:Source matching is unrelated to mail filtering. B:Quota symmetry is not the main identity risk. C:Anchors do not control group nesting.
Question 347 A company wants new hires, role changes, and terminations to flow reliably from AD DS to cloud accounts. What must the solution document? Only the Teams audio conferencing license count Authoritative source changes, sync scope, timing, and deprovision safeguards Only the tenant's email spam confidence level Only the current SharePoint site templates Explanation Correct Answer B:Lifecycle events require consistent provisioning and controlled deletion. Incorrect Answers A:Calling subscriptions do not define directory lifecycle. C:Spam classification cannot provision identities. D:Site templates are not identity lifecycle policy.
Question 348 A hybrid tenant has users synchronized but its computer objects are not usable for a planned device identity scenario. What must be verified? Supported device object synchronization and hybrid join prerequisites for the chosen setup The user's Exchange archive enablement Synchronize only user accounts while assuming hybrid device registration works without computer object and device prerequisites The organization's DLP policy priority Explanation Correct Answer A:User provision success does not prove device readiness. Incorrect Answers B:Archives cannot synchronize computer objects. C:User sync does not automatically establish the device join/synchronization dependencies for hybrid device identity. D:DLP cannot create hybrid device identities.
Question 349 A directory contains privileged on-premises service accounts that must not provision as ordinary cloud users. What should admins configure? A message transport rule for service accounts A default retention label for every directory group Explicit supported filtering and scope exclusions for those source objects A blanket tenant disabling of MFA Explanation Correct Answer C:Scoped provisioning avoids unnecessary cloud exposure. Incorrect Answers A:Mail rules do not govern user provisioning. B:Labels cannot exclude AD DS objects from synchronization. D:Disabling MFA weakens all accounts unnecessarily.
Question 350 A synchronization service needs its connector credentials rotated. Which operational safeguard matters? Follow supported account credential rotation while maintaining connector permissions and validation Give service account Global Administrator forever Disable connector health alerts until rotation finishes Publish connector passwords in tenant DNS TXT records Explanation Correct Answer A:Unplanned secret changes can break exports. Incorrect Answers B:Permanent broad privilege is not a rotation plan. C:Suppressing alerts hides failures during change. D:Public DNS must never expose credentials.
