Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 301:

  Your network contains a single Active Directory domain and two Microsoft Azure Active Directory (Azure AD) tenants.

  You plan to implement directory synchronization for both Azure AD tenants. Each tenant will contain some of the Active Directory users.

  You need to recommend a solution for the planned directory synchronization.

  What should you include in the recommendation?

  A. Deploy two servers that run Azure AD Connect, and then filter the users for each tenant by using organizational unit (OU)-based filtering.

  B. Deploy one server that runs Azure AD Connect, and then filter the users for each tenant by using attribute-based filtering.

  C. Deploy one server that runs Azure AD Connect, and then filter the users for each tenant by using organizational unit (OU)-based filtering.

  D. Deploy one server that runs Azure AD Connect, and then filter the users for each tenant by using domain-based filtering.

  Correct Answer: A

  There's a 1:1 relationship between an Azure AD Connect sync server and an Azure AD tenant. For each Azure AD tenant, you need one Azure AD Connect sync server installation. Therefore, we need to deploy two servers that run Azure AD Connect for the two Azure AD tenants.

  Each user account can only be synchronized to one Azure AD tenant. Therefore, we need a way of splitting the users between the two Azure AD tenants. Azure AD Connect offers three ways to filter which users get synchronized to an Azure AD tenant. You can use domain-based filtering if you have multiple domains in a forest, attribute-based filtering or OU-based filtering.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies#multiple-azure-ad-tenants

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

• Question 302:

  Your network contains three Active Directory forests.

  You create a Microsoft Azure Active Directory (Azure AD) tenant.

  You plan to sync the on-premises Active Directory to Azure AD.

  You need to recommend a synchronization solution. The solution must ensure that the synchronization can complete successfully and as quickly as possible if a single server fails.

  What should you include in the recommendation?

  A. three Azure AD Connect sync servers and three Azure AD Connect sync servers in staging mode

  B. one Azure AD Connect sync server and one Azure AD Connect sync server in staging mode

  C. three Azure AD Connect sync servers and one Azure AD Connect sync server in staging mode

  D. six Azure AD Connect sync servers and three Azure AD Connect sync servers in staging mode

  Correct Answer: B

  Azure AD Connect can be active on only one server. You can install Azure AD Connect on another server for redundancy but the additional installation would need to be in Staging mode. An Azure AD connect installation in Staging mode is configured and ready to go but it needs to be manually switched to Active to perform directory synchronization.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom

• Question 303:

  Your network contains an Active Directory domain named adatum.com that is synced to Microsoft Azure Active Directory (Azure AD).

  The domain contains 100 user accounts.

  The city attribute for all the users is set to the city where the user resides.

  You need to modify the value of the city attribute to the three-letter airport code of each city. What should you do?

  A. From Azure Cloud Shell, run the Get-AzureADUser and Set-AzureADUser cmdlets.

  B. From Azure Cloud Shell, run the Get-ADUser and Set-ADUser cmdlets.

  C. From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.

  D. From Azure Cloud Shell, run the Get-MsolUser and Set-MSOluser cmdlets.

  Correct Answer: C

  The user accounts are synced from the on-premise Active Directory to the Microsoft Azure Active Directory (Azure AD). Therefore, the city attribute must be changed in the on-premise Active Directory.

  You can use Windows PowerShell on a domain controller and run the Get-ADUser cmdlet to get the required users and pipe the results into Set-ADUser cmdlet to modify the city attribute.

  Incorrect Answers:

  A, D: These answers suggest modifying the city attribute of the users in the Azure Active Directory which is incorrect.

  B: This answer has the correct cmdlets but they need to be run on a domain controller, not in the Azure cloud shell.

  Note:

  There are several versions of this question in the exam. The question has two possible correct answers:

  1.

  From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.

  2.

  From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings. Other incorrect answer options you may see on the exam include the following:

  1.

  From the Azure portal, select all the Azure AD users, and then use the User settings blade.

  2.

  From Windows PowerShell on a domain controller, run the Get-AzureADUser and Set-AzureADUser cmdlets.

  3.

  From the Microsoft 365 admin center, select the users, and then use the Bulk actions option.

  Reference: https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-aduser?view=win10-ps

• Question 304:

  You have a Microsoft 365 subscription.

  You view the service advisories shown in the following exhibit.

  

  You need to ensure that users who administer Microsoft SharePoint Online can view the advisories to investigate health issues. Which role should you assign to the users?

  A. SharePoint administrator

  B. Message Center reader

  C. Reports reader

  D. Service administrator

  Correct Answer: D

  People who are assigned the global admin or service administrator role can view service health. To allow Exchange, SharePoint, and Skype for Business admins to view service health, they must also be assigned the Service admin role. For more information about roles that can view service health.

  Reference: https://docs.microsoft.com/en-us/office365/enterprise/view-service-health

• Question 305:

  You have a Microsoft 365 subscription that contains a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. The tenant includes a user named User1.

  You enable Azure AD Identity Protection.

  You need to ensure that User1 can review the list in Azure AD Identity Protection of users flagged for risk. The solution must use the principle of least privilege.

  To which role should you add User1?

  A. Compliance administrator

  B. Global administrator

  C. Owner

  D. Security administrator

  Correct Answer: D

  Either one of the following three roles can review the list in Azure AD Identity Protection of users flagged for risk:

  1.

  Security Administrator

  2.

  Global Administrator

  3.

  Security Reader

  Using the principle of least privilege, we should add User1 to the Security Administrator role.

  Note:

  There are several versions of this question in the exam. The question has three possible correct answers:

  1.

  Security Reader

  2.

  Security Administrator

  3.

  Global Administrator

  Other incorrect answer options you may see on the exam include the following:

  1.

  Service Administrator.

  2.

  Reports Reader

  3.

  User Administrator

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risky-sign-ins https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risky-sign-ins

• Question 306:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has 3,000 users. All the users are assigned Microsoft 365 E3 licenses.

  Some users are assigned licenses for all Microsoft 365 services. Other users are assigned licenses for only certain Microsoft 365 services.

  You need to determine whether a user named User1 is licensed for Exchange Online only.

  Solution: You run the Get-MsolUser cmdlet.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The Get-MsolUser cmdlet will tell you if a user is licensed for Microsoft 365 but it does not tell you which licenses are assigned.

  Reference: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msoluser?view=azureadps-1.0

• Question 307:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has 3,000 users. All the users are assigned Microsoft 365 E3 licenses.

  Some users are assigned licenses for all Microsoft 365 services. Other users are assigned licenses for only certain Microsoft 365 services.

  You need to determine whether a user named User1 is licensed for Exchange Online only.

  Solution: You run the Get-MsolAccountSku cmdlet.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The Get-MsolAccountSku cmdlet returns all the SKUs that the company owns. It does not tell you which licenses are assigned to users.

  Reference: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolaccountsku?view=azureadps-1.0

• Question 308:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has 3,000 users. All the users are assigned Microsoft 365 E3 licenses.

  Some users are assigned licenses for all Microsoft 365 services. Other users are assigned licenses for only certain Microsoft 365 services.

  You need to determine whether a user named User1 is licensed for Exchange Online only.

  Solution: You launch the Azure portal, and then review the Licenses blade.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  In the Licenses blade, click All Products then select the E3 License. This will display a list of all users assigned an E3 license. Select User1. You'll see how many services are assigned in the Enabled Services column. Click on the number in the Enabled Services column for User1 and you'll be taken to the licenses page for that user. Click on the number in the Enabled Services column for User1 again and a page will open which shows you exactly which services are enabled or disabled. Alternatively, you can go into the user account properties directly then select Licenses. This will display the licenses blade for that user. You can then click on the number in the Enabled Services column for the user and a page will open which shows you exactly which services are enabled or disabled.

• Question 309:

  You have a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

  

  You add another user named User5 to the User administrator role.

  You need to identify which two management tasks User5 can perform.

  Which two tasks should you identify? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Delete User2 and User4 only.

  B. Reset the password of User2 and User4 only.

  C. Delete User1, User2, and User4 only.

  D. Delete any user in Azure AD.

  E. Reset the password of any user in Azure AD.

  F. Reset the password of User4 only.

  Correct Answer: AB

  Users with the User Administrator role can create users and manage all aspects of users with some restrictions (see below). Only on users who are non-admins or in any of the following limited admin roles:

  1.

  Directory Readers

  2.

  Guest Inviter

  3.

  Helpdesk Administrator

  4.

  Message Center Reader

  5.

  Reports Reader

  6.

  User Administrator

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#available-roles

• Question 310:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain.

  You deploy a Microsoft Azure Active Directory (Azure AD) tenant.

  Another administrator configures the domain to synchronize to Azure AD.

  You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully.

  You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully.

  You need to ensure that the 10 user accounts are synchronized to Azure AD.

  Solution: From Azure AD Connect, you modify the filtering settings.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The question states that "all the user account synchronizations completed successfully". Therefore, we know that Azure AD Connect is working and configured correctly. The only thing that would prevent the 10 user accounts from being synchronized is that they are being excluded from the synchronization cycle by a filtering rule.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering