MS-102 Microsoft 365 Administrator Expert Configuring Identity Synchronization 3 — Questions and Answers
Question 1: Which Azure AD Connect synchronization rule action should be used to prevent a specific attribute from being exported to Azure AD?
- Set the flow type to Constant
- Set the flow type to Expression with NULL (Correct answer)
- Set the precedence to 0
- Delete the attribute from the metaverse
Correct answer: Set the flow type to Expression with NULL
Using an Expression flow type with a NULL value in a synchronization rule prevents that attribute from being exported to Azure AD.
Question 2: An organization enables Seamless SSO. Which on-premises object is created in Active Directory as part of this configuration?
- A service account named AzureADSSO
- A computer account named AZUREADSSOACC (Correct answer)
- A group named AzureSSO_Users
- An OU named SeamlessSSO
Correct answer: A computer account named AZUREADSSOACC
Azure AD Connect creates a computer account named AZUREADSSOACC in the on-premises AD to facilitate Seamless SSO Kerberos ticket issuance.
Question 3: What happens when Azure AD Connect is placed in staging mode?
- It imports and synchronizes objects but does not export changes (Correct answer)
- It exports changes but does not import from on-premises AD
- It performs a full synchronization immediately
- It disables password hash synchronization
Correct answer: It imports and synchronizes objects but does not export changes
In staging mode, Azure AD Connect runs the full import and sync process but does not export any changes to Azure AD or on-premises AD.
Question 4: An administrator needs to force an immediate full synchronization cycle. Which PowerShell command should they run?
- Start-ADSyncSyncCycle -PolicyType Initial (Correct answer)
- Start-ADSyncSyncCycle -PolicyType Delta
- Invoke-ADSyncRunProfile -connectorName
- Set-ADSyncScheduler -SyncCycleEnabled $true
Correct answer: Start-ADSyncSyncCycle -PolicyType Initial
Start-ADSyncSyncCycle -PolicyType Initial triggers a full synchronization cycle immediately on the Azure AD Connect server.
Question 5: Which feature allows on-premises users to reset their passwords from the Azure AD self-service password reset portal and have the new password written back to AD?
- Password hash synchronization
- Pass-through authentication
- Password writeback (Correct answer)
- Federation with ADFS
Correct answer: Password writeback
Password writeback is the Azure AD Connect feature that synchronizes password changes made in the cloud back to the on-premises Active Directory.
Question 6: A company with multiple on-premises AD forests needs to synchronize all users to a single Azure AD tenant. Which Azure AD Connect topology supports this scenario?
- Single forest, single Azure AD tenant
- Multiple forests, single Azure AD tenant (Correct answer)
- Multiple forests, multiple Azure AD tenants
- Single forest, multiple Azure AD tenants
Correct answer: Multiple forests, single Azure AD tenant
The multiple forests, single Azure AD tenant topology allows Azure AD Connect to merge identities from multiple forests into one Azure AD tenant.
Question 7: Which Azure AD Connect synchronization engine component is responsible for storing a unified view of all synchronized objects from all connected directories?
- Connector space
- Metaverse (Correct answer)
- Run profile
- Provisioning engine
Correct answer: Metaverse
The metaverse is the central repository in the Azure AD Connect sync engine that stores a unified, consolidated representation of all synchronized objects.
MS-102 Microsoft 365 Administrator Expert Configuring Identity Synchronization 3
Which Azure AD Connect synchronization rule action should be used to prevent a specific attribute from being exported to Azure AD?