MS-100 Hybrid Identity & Authentication 2 — Questions and Answers
Question 1: Which hybrid join type registers a device with both on-premises AD and Azure AD, enabling Conditional Access policies requiring a domain-joined device?
- Azure AD registered
- Azure AD joined
- Hybrid Azure AD joined (Correct answer)
- Workplace joined
Correct answer: Hybrid Azure AD joined
Hybrid Azure AD joined devices are joined to both on-premises Active Directory and registered in Azure AD, satisfying Conditional Access policies for compliant or domain-joined devices.
Question 2: What synchronization rule controls which on-premises Active Directory objects are synchronized to Azure AD using Azure AD Connect?
- Organizational Unit (OU) filtering
- Attribute-based filtering
- Domain filtering
- All of the above (Correct answer)
Correct answer: All of the above
Azure AD Connect supports OU-based filtering, attribute-based filtering, and domain filtering — all three can be used to control which objects are synchronized to Azure AD.
Question 3: An organization wants to enforce on-premises Active Directory password policies (including complexity and history) for hybrid users signing into Microsoft 365. Which authentication method achieves this?
- Password Hash Synchronization
- Pass-through Authentication
- Federation with AD FS
- Both B and C (Correct answer)
Correct answer: Both B and C
Both Pass-through Authentication and AD FS federation enforce on-premises AD password policies because authentication is validated against on-premises AD in real time.
Question 4: Which Azure AD Connect staging mode feature is used for?
- Testing synchronization rules without writing changes to Azure AD
- Providing a failover server that can be promoted to active
- Running Azure AD Connect on multiple servers simultaneously
- Both A and B (Correct answer)
Correct answer: Both A and B
Staging mode allows an Azure AD Connect server to import and sync data without exporting to Azure AD, useful for testing rule changes and as a warm standby for failover.
Question 5: What is the primary purpose of Azure AD Password Protection in a hybrid environment?
- Synchronizing password hashes to Azure AD
- Preventing the use of weak and banned passwords on both on-premises AD and Azure AD (Correct answer)
- Enforcing MFA for all password changes
- Detecting password spray attacks in real time
Correct answer: Preventing the use of weak and banned passwords on both on-premises AD and Azure AD
Azure AD Password Protection enforces a global and custom banned password list on-premises by installing DC agents that validate password changes against the banned list.
Question 6: Which tool should be used to diagnose Azure AD Connect synchronization errors, such as objects not appearing in Azure AD?
- Azure AD Connect wizard's troubleshoot task
- Synchronization Service Manager
- Azure AD Connect Health portal
- All of the above (Correct answer)
Correct answer: All of the above
All three tools — the troubleshoot task in the wizard, Synchronization Service Manager for operational errors, and Connect Health for health monitoring — are used together to diagnose sync issues.
MS-100 Hybrid Identity & Authentication 2
Which hybrid join type registers a device with both on-premises AD and Azure AD, enabling Conditional Access policies requiring a domain-joined device?