Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 291:

  Your company has 10,000 users who access all applications from an on-premises data center.

  You plan to create a Microsoft 365 subscription and to migrate data to the cloud.

  You plan to implement directory synchronization.

  User accounts and group accounts must sync to Microsoft Azure Active Directory (Azure AD) successfully.

  You discover that several user accounts fail to sync to Azure AD.

  You need to resolve the issue as quickly as possible.

  What should you do?

  A. From Active Directory Administrative Center, search for all the users, and then modify the properties of the user accounts.

  B. Run idfix.exe, and then click Complete.

  C. From Windows PowerShell, run the Start-AdSyncCycle 璓olicyType Delta command.

  D. Run idfix.exe, and then click Edit.

  Correct Answer: D

  IdFix is used to perform discovery and remediation of identity objects and their attributes in an on-premises Active Directory environment in preparation for migration to Azure Active Directory. IdFix is intended for the Active Directory administrators responsible for directory synchronization with Azure Active Directory.

  Reference: https://docs.microsoft.com/en-us/office365/enterprise/prepare-directory-attributes-for-synch-with-idfix

  https://www.microsoft.com/en-gb/download/details.aspx?id=36832

• Question 292:

  Your network contains an Active Directory domain named adatum.com that is synced to Microsoft Azure Active Directory (Azure AD).

  The domain contains 100 user accounts.

  The city attribute for all the users is set to the city where the user resides.

  You need to modify the value of the city attribute to the three-letter airport code of each city.

  What should you do?

  A. From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings.

  B. From the Microsoft 365 admin center, select the users, and then use the Bulk actions option.

  C. From Azure Cloud Shell, run the Get-MsolUser and Set-MSOluser cmdlets.

  D. From Windows PowerShell on a domain controller, run the Get-AzureADUser and Set-AzureADUser cmdlets.

  Correct Answer: A

  The user accounts are synced from the on-premise Active Directory to the Microsoft Azure Active Directory (Azure AD). Therefore, the city attribute must be changed in the on-premise Active Directory. You can modify certain attributes of

  multiple user accounts simultaneously by selecting them in Active Directory Administrative Center or Active Directory Users and Computers, right clicking then selecting Properties. The other three options all suggest modifying the city

  attribute of the users in the Azure Active Directory which is incorrect.

  Note:

  There are several versions of this question in the exam. The question has two possible correct answers:

  1. From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.

  2. From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings. Other incorrect answer options you may see on the exam include the following:

  1. From the Azure portal, select all the Azure AD users, and then use the User settings blade.

  2. From Windows PowerShell on a domain controller, run the Get-AzureADUser and Set-AzureADUser cmdlets.

  3. From the Microsoft 365 admin center, select the users, and then use the Bulk actions option.

  Reference: https://blogs.technet.microsoft.com/canitpro/2015/11/25/step-by-step-managing-multiple-user-accounts-via-active-directory-admin-center/

• Question 293:

  Your network contains two on-premises Active Directory forests named contoso.com and fabrikam.com. Fabrikam.com contains one domain and five domain controllers. Contoso.com contains the domains shown in the following table.

  

  You need to sync all the users from both the forests to a single Azure Active Directory (Azure AD) tenant by using Azure AD Connect. What is the minimum number of Azure AD Connect sync servers required?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: A

  You can have only one active Azure AD Connect server synchronizing accounts to a single Azure Active Directory (Azure AD) tenant. You can have `backup' Azure AD Connect servers, but these must be running in `staging' mode. Staging mode means the Azure AD Connect instance is not actively synchronizing users but is ready to be bought online if the active Azure AD Connect instance goes offline.

  When you have multiple forests, all forests must be reachable by a single Azure AD Connect sync server. The server must be joined to a domain. If necessary, to reach all forests, you can place the server in a perimeter network (also known as DMZ, demilitarized zone, and screened subnet).

  References: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies#multiple-forests-single-azure-ad-tenant

• Question 294:

  Your network contains an on-premises Active Directory forest.

  You are evaluating the implementation of Microsoft 365 and the deployment of an authentication strategy. You need to recommend an authentication strategy that meets the following requirements:

  1. Allows users to sign in by using smart card-based certificates

  2. Allows users to connect to on-premises and Microsoft 365 services by using SSO Which authentication strategy should you recommend?

  A. password hash synchronization and seamless SSO

  B. federation with Active Directory Federation Services (AD FS)

  C. pass-through authentication and seamless SSO

  Correct Answer: B

  Federation with Active Directory Federation Services (AD FS) is required to allow users to sign in by using smart card-based certificates.

  Federated authentication

  When you choose this authentication method, Azure AD hands off the authentication process to a separate trusted authentication system, such as on-premises Active Directory Federation Services (AD FS), to validate the user's password.

  The authentication system can provide additional advanced authentication requirements. Examples are smartcard-based authentication or third-party multifactor authentication.

  Reference:

  https://docs.microsoft.com/en-us/azure/security/azure-ad-choose-authn

• Question 295:

  Your company has a Microsoft 365 subscription.

  Your plan to add 100 newly hired temporary users to the subscription next week.

  You create the user accounts for the new users.

  You need to assign licenses to the new users.

  Which command should you run?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  The first line gets all users from the Temp department that have a UsageLocation assigned and stores them in the $NewStaff variable. You cannot use PowerShell to assign a license to a user that does not have a UsageLocation configured. The second line adds the licenses to each user in the $NewStaff variable.

  Reference: https://docs.microsoft.com/en-us/office365/enterprise/powershell/assign-licenses-to-user-accounts-with-office-365-powershell

• Question 296:

  Your network contains an Active Directory domain and a Microsoft Azure Active Directory (Azure AD) tenant.

  The network uses a firewall that contains a list of allowed outbound domains.

  You begin to implement directory synchronization.

  You discover that the firewall configuration contains only the following domain names in the list of allowed domains:

  1.

  *.microsoft.com

  2.

  *.office.com

  Directory synchronization fails.

  You need to ensure that directory synchronization completes successfully.

  What is the best approach to achieve the goal? More than one answer choice may achieve the goal. Select the BEST answer.

  A. From the firewall, allow the IP address range of the Azure data center for outbound communication.

  B. From Azure AD Connect, modify the Customize synchronization options task.

  C. Deploy an Azure AD Connect sync server in staging mode.

  D. From the firewall, create a list of allowed inbound domains.

  E. From the firewall, modify the list of allowed outbound domains.

  Correct Answer: E

  Azure AD Connect needs to be able to connect to various Microsoft domains such as login.microsoftonline.com. Therefore, you need to modify the list of allowed outbound domains on the firewall.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-ports

• Question 297:

  Your network contains an on-premises Active Directory domain that syncs to Azure Active Directory (Azure AD).

  The on-premises network contains a Microsoft SharePoint Server 2019 farm.

  The company purchases a Microsoft 365 subscription.

  You have the users shown in the following table

  

  You plan to assign User1 and User2 the required roles to run the SharePoint Hybrid Configuration Wizard.

  User1 will be used for on-premises credentials and User2 will be used for cloud credentials.

  You need to assign the correct role to User2. The solution must use the principle of least privilege.

  Which role should you assign to User2?

  A. Application administrator

  B. SharePoint farm administrator

  C. Global administrator

  D. SharePoint administrator

  Correct Answer: C

  To run the SharePoint Hybrid Configuration Wizard, you need to provide credentials of a user (in this case User2) of a Global Administrator account in Azure Active Directory.

  Reference: https://www.c-sharpcorner.com/article/sharepoint-2019-enable-hybrid-experience/

• Question 298:

  Your network contains an Active Directory forest named contoso.local.

  You have a Microsoft 365 subscription.

  You plan to implement a directory synchronization solution that will use password hash synchronization.

  From the Microsoft 365 admin center, you verify the contoso.com domain name.

  You need to prepare the environment for the planned directory synchronization solution.

  What should you do first?

  A. From the public DNS zone of contoso.com, add a new mail exchanger (MX) record.

  B. From Active Directory Domains and Trusts, add contoso.com as a UPN suffix.

  C. From the Microsoft 365 admin center, verify the contoso.local domain name.

  D. From Active Directory Users and Computers, modify the UPN suffix for all users.

  Correct Answer: B

  The on-premise Active Directory domain is named contoso.local. Therefore, all the domain users accounts will have a UPN suffix of contoso.local by default. To enable directory synchronization that will use password hash synchronization, you need to configure the domain user accounts to have the same UPN suffix as the verified domain (contoso.com in this case). Before you can change the UPN suffix of the domain user accounts to contoso.com, you need to add contoso.com as a UPN suffix in the domain.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-userprincipalname

• Question 299:

  You have a Microsoft 365 subscription.

  You view the service advisories shown in the following exhibit.

  

  You need to ensure that a user named User1 can view the advisories to investigate service health issues. Which role should you assign to User1?

  A. Compliance administrator

  B. Message Center reader

  C. Reports reader

  D. Service administrator

  Correct Answer: D

  People who are assigned the global admin or service administrator role can view service health. To allow Exchange, SharePoint, and Skype for Business admins to view service health, they must also be assigned the Service admin role.

  Reference: https://docs.microsoft.com/en-us/office365/enterprise/view-service-health

• Question 300:

  You network contains an on-premises Active Directory domain named contoso.com. The domain contains a Microsoft Exchange Server 2019 organization.

  You plan to sync the domain to Azure Active Directory (Azure AD) and to enable device writeback and group writeback.

  You need to identify which group types will sync from Azure AD.

  Which two group types should you identify? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. an Office 365 group that uses the Assigned membership type

  B. a security group that uses the Dynamic Device membership type

  C. an Office 365 group that uses the Dynamic User membership type

  D. a security group that uses the Assigned membership type

  E. a security group that uses the Dynamic User membership type

  Correct Answer: AC

  Group writeback allows you to write cloud groups back to your on-premises Active Directory instance by using Azure Active Directory (Azure AD) Connect sync. You can use this feature to manage groups in the cloud, while controlling access

  to on-premises applications and resources.

  Group writeback enables the following capabilities:

  You can write back Microsoft 365 groups as distribution groups, security groups, or mail-enabled security groups.

  You can write back Azure AD security groups as security groups.

  All groups are written back with a group scope of Universal.

  You can write back groups that have assigned and dynamic memberships.

  You can configure directory settings to control whether newly created Microsoft 365 groups are written back by default.

  Etc.

  Note: Discover the current writeback settings for existing Microsoft 365 groups

  To view the existing writeback settings on Microsoft 365 groups in the portal, go to each group and select its properties.

  Reference:

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-group-writeback-v2

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-preview