Question 350 A synchronization service needs its connector credentials rotated. Which operational safeguard matters? Follow supported account credential rotation while maintaining connector permissions and validation Give service account Global Administrator forever Disable connector health alerts until rotation finishes Publish connector passwords in tenant DNS TXT records Explanation Correct Answer A:Unplanned secret changes can break exports. Incorrect Answers B:Permanent broad privilege is not a rotation plan. C:Suppressing alerts hides failures during change. D:Public DNS must never expose credentials.
Question 351 Only some users show correct updated display names after the same AD DS change process. What should be compared? Their sensitivity-label publishing order only Their effective attribute flows, source values, and synchronization errors Their Teams emoji preferences only Their mailbox message trace filters only Explanation Correct Answer B:Object-specific mappings can cause divergent outcomes. Incorrect Answers A:Label publishing is not directory transformation. C:Client preferences do not replace source attributes. D:Mail flow doesn't map display names.
Question 352 A new standby Connect Sync server has different object filtering from production. What should be aligned before failover? Connector scope, synchronization rules, and source-anchor configuration The SharePoint site owner's calendar sharing policy The user's default Teams meeting background The company's email quarantine summary setting Explanation Correct Answer A:A mismatched standby can export unintended changes. Incorrect Answers B:Sharing rights are not connector mappings. C:Appearance has no provisioning role. D:Quarantine reports do not align sync rules.
Question 353 After enabling sync, a user appears twice: one source-controlled and one cloud-only. What is the likely remediation focus? Increase Microsoft 365 Backup restore windows Examine matching identifiers and safely reconcile the duplicate identities Change DMARC from quarantine to reject Assign a third Microsoft 365 license to both identities Explanation Correct Answer B:Incorrect joins may create separate accounts. Incorrect Answers A:Backup settings cannot fix matching. C:Mail policy does not combine directory identities. D:Licensing cannot merge duplicate objects.
Question 354 A deleted synchronized cloud account must be recovered before retention windows expire. What should the administrator coordinate? Only the organization's transport-rule audit mode Only the OneDrive sharing link expiration Restoration of the authoritative source account and supported Entra deleted-user recovery Only a device antivirus quick scan Explanation Correct Answer C:Both identity state and object match must be reconciled. Incorrect Answers A:Transport rules cannot reactivate deleted identities. B:Link expiry is not the identity recovery mechanism. D:Endpoint security cannot restore directory user objects.
Question 355 An admin assumes every advanced hybrid identity feature is included with the baseline license. What should be checked? Feature-specific Entra licensing and service prerequisites before enabling the design The number of verified DNS TXT records Only the total number of mailboxes in Exchange The number of Microsoft 365 usage reports Explanation Correct Answer A:Capabilities can require qualifying licenses or supported versions. Incorrect Answers B:Domain count cannot establish license rights. C:Mailbox count alone does not prove feature entitlement. D:Usage metrics are not entitlement evidence.
Question 356 The company needs a disaster-recovery plan for synchronized identities when the source forest is unavailable. What should be explicitly tested? Assume pass-through authentication continues when every source AD DS domain controller is unavailable, without a configured alternate sign-in strategy Cloud authentication behavior for the selected PHS, PTA, or federation method Only whether Teams chat history is retained Only the Exchange Online anti-phishing sensitivity Explanation Correct Answer B:Sign-in continuity varies with authentication dependency. Incorrect Answers A:PTA depends on available on-premises authentication infrastructure; recovery planning must consider the chosen cloud or federation path. C:Retention cannot validate sign-in resiliency. D:Anti-phishing policies do not define auth availability.
Question 357 Cloud provisioning takes longer after a major acquisition. Which metrics should be correlated? Only sensitivity-label encryption usage Only Outlook junk email folder counts Measure only the overall count of synchronized users and ignore per-cycle latency, pending change queues and export throttling Connector processing durations, change backlog, throttling and export errors Explanation Correct Answer D:These identify synchronization throughput constraints. Incorrect Answers A:Labels are unrelated to sync queues. B:Client spam folders don't measure directory throughput. C:An inventory count alone cannot explain why post-acquisition provisioning has become slower.
Question 358 The team plans to add a new provisioning feature but its current agent build may be unsupported. What should it validate? The user's SharePoint storage allowance The supported agent version and compatibility requirements for that feature Deploy the provisioning feature on the current agent version without checking release support, assuming unsupported versions upgrade themselves A tenant-wide mobile app protection label Explanation Correct Answer B:Provisioning functionality depends on supported builds and prerequisites. Incorrect Answers A:Site quota does not determine agent support. C:A feature may require a supported agent build and compatibility with source/target schema and tenant configuration. D:App protection cannot change provisioning binaries.
Question 359 An on-prem application expects newly created cloud groups to appear in AD DS automatically. What should be verified? The administrator's mailbox forwarding rule A default Purview label priority The exact supported group provisioning or writeback capability and configuration A Defender email simulation campaign Explanation Correct Answer C:Not every cloud group type synchronizes back to AD DS. Incorrect Answers A:Forwarding does not export groups to local directories. B:Classification cannot provision AD DS groups. D:Training cannot replicate group objects.
Question 360 After a source attribute mapping update, a pilot group receives incorrect cloud department values. What rollback preparation is appropriate? Restore verified mapping logic and compare exported object state before broader cycles Disable all source logging to simplify the test Delete the entire tenant to reset mappings Rotate every end-user password to refresh department Explanation Correct Answer A:Controlled rollback prevents propagating incorrect attributes. Incorrect Answers B:Removing evidence makes verification harder. C:Tenant deletion is destructive and unnecessary. D:Password changes cannot correct transformation rules.
