Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 341:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has a main office and three branch offices. All the branch offices connect to the main office by using a WAN link. The main office has a high-speed Internet connection. All the branch offices connect to the Internet by using the

  main office connection.

  Users use Microsoft Outlook 2016 to connect to a Microsoft Exchange Server mailbox hosted in the main office.

  The users report that when the WAN link in their office becomes unavailable, they cannot access their mailbox.

  You create a Microsoft 365 subscription, and then migrate all the user data to Microsoft 365.

  You need to ensure that all the users can continue to use Outlook to receive email messages if a WAN link fails.

  Solution: You deploy a site-to-site VPN from each branch office to Microsoft Azure.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The question states that the branch offices connect to the Internet by using the main office connections. Therefore, all Internet traffic goes over the WAN link between the branch office and main office. After the migration, the users connect to

  their mailboxes hosted in Exchange Online over the Internet and therefore over the WAN link.

  If the WAN link goes down, the branch office users will not be able to connect to the Internet and therefore will not be able to access their email using Outlook.

  A site-to-site VPN from each branch office to Microsoft Azure would still use the WAN link so this answer does achieve the goal.

  The solution is to add a direct connection to the Internet from the branch offices, so their Internet traffic does not go over the WAN link.

• Question 342:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has a main office and three branch offices. All the branch offices connect to the main office by using a WAN link. The main office has a high-speed Internet connection. All the branch offices connect to the Internet by using the

  main office connection.

  Users use Microsoft Outlook 2016 to connect to a Microsoft Exchange Server mailbox hosted in the main office.

  The users report that when the WAN link in their office becomes unavailable, they cannot access their mailbox.

  You create a Microsoft 365 subscription, and then migrate all the user data to Microsoft 365.

  You need to ensure that all the users can continue to use Outlook to receive email messages if a WAN link fails.

  Solution: In each branch office, you add a direct connection to the Internet.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The question states that the branch offices connect to the Internet by using the main office connections. Therefore, all Internet traffic goes over the WAN link between the branch office and main office. After the migration, the users connect to their mailboxes hosted in Exchange Online over the Internet and therefore over the WAN link.

  If the WAN link goes down, the branch office users will not be able to connect to the Internet and therefore will not be able to access their email using Outlook.

  Adding a direct connection to the Internet from the branch offices would mean that the Internet traffic does not go over the WAN link. Therefore, if the WAN link fails, the users would still be able to access their email. Therefore, this solution does ensure that all the users can continue to use Outlook to receive email messages if a WAN link fails.

• Question 343:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has a main office and three branch offices. All the branch offices connect to the main office by using a WAN link. The main office has a high-speed Internet connection. All the branch offices connect to the Internet by using the

  main office connection.

  Users use Microsoft Outlook 2016 to connect to a Microsoft Exchange Server mailbox hosted in the main office.

  The users report that when the WAN link in their office becomes unavailable, they cannot access their mailbox.

  You create a Microsoft 365 subscription, and then migrate all the user data to Microsoft 365.

  You need to ensure that all the users can continue to use Outlook to receive email messages if a WAN link fails.

  Solution: For each device, you configure an additional Outlook profile that uses IMAP.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The question states that the branch offices connect to the Internet by using the main office connections. Therefore, all Internet traffic goes over the WAN link between the branch office and main office. After the migration, the users connect to

  their mailboxes hosted in Exchange Online over the Internet and therefore over the WAN link.

  If the WAN link goes down, the branch office users will not be able to connect to the Internet and therefore will not be able to access their email using Outlook.

  Using IMAP to access the mailboxes would still use the WAN link so this answer does achieve the goal.

  The solution is to add a direct connection to the Internet from the branch offices, so their Internet traffic does not go over the WAN link.

• Question 344:

  Your network contains an Active Directory domain named contoso.com.

  You have a Microsoft 365 subscription.

  You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

  You implement directory synchronization.

  The developers at your company plan to build an app named App1. App1 will connect to the Microsoft Graph API to provide access to several Microsoft Office 365 services.

  You need to provide the URI for the authorization endpoint that App1 must use.

  What should you provide?

  A. https://login.microsoftonline.com/

  B. https://contoso.com/contoso.onmicrosoft.com/app1

  C. https://login.microsoftonline.com/contoso.onmicrosoft.com/

  D. https://myapps.microsoft.com

  Correct Answer: C

  In a single tenant application, sign-in requests are sent to the tenant's sign-in endpoint. For example, for contoso.onmicrosoft.com the endpoint would be: https://login.microsoftonline.com/contoso.onmicrosoft.com. Requests sent to a tenant's endpoint can sign in users (or guests) in that tenant to applications in that tenant.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant

• Question 345:

  Your on-premises network contains the web applications shown in the following table.

  

  You purchase Microsoft 365, and then implement directory synchronization.

  You plan to publish the web applications.

  You need to ensure that all the applications are accessible by using the My Apps portal. The solution must minimize administrative effort. What should you do first?

  A. Deploy one conditional access policy.

  B. Deploy one Application Proxy connector.

  C. Create four application registrations.

  D. Create a site-to-site VPN from Microsoft Azure to the on-premises network.

  Correct Answer: B

  The Application Proxy connector is what connects the on-premises environment to the Azure Application Proxy.

  Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Application Proxy includes both the Application Proxy service which runs in the cloud, and the Application Proxy connector which runs on an on-premises server. Azure AD, the Application Proxy service, and the Application Proxy connector work together to securely pass the user sign-on token from Azure AD to the web application.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy-connectors

• Question 346:

  You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.

  You add an app named App1 to the enterprise applications in contoso.com.

  You need to configure self-service app access for App1.

  What should you do first?

  A. Assign App1 to users and groups.

  B. Add an owner to App1.

  C. Configure the provisioning mode for App1.

  D. Configure an SSO method for App1.

  Correct Answer: C

  The provisioning mode (manual or automatic) needs to be configured for an app before you can enable self-service application access. Incorrect Answers:

  A: If you're assign App1 to users and groups, the users will not need to use self-service to request access to the App. They would already have access to the app.

  B: The app does not need an owner. You would configure an owner to delegate control of the app. Without an owner, a Global Admin could configure self-service.

  D: The SSO method depends on the provisioning mode.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-self-service-access https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Employee-Self-Service-App-Access-for-Azure-AD-now-in-preview/ba-p/243966

• Question 347:

  Your network contains an Active Directory forest named contoso.local.

  You purchase a Microsoft 365 subscription.

  You plan to move to Microsoft 365 and to implement a hybrid deployment solution for the next 12 months.

  You need to prepare for the planned move to Microsoft 365.

  What is the best action to perform before you implement directory synchronization? More than one answer choice may achieve the goal. Select the BEST answer.

  A. Purchase a third-party X.509 certificate.

  B. Rename the Active Directory forest.

  C. Purchase a custom domain name.

  D. Create an external forest trust.

  Correct Answer: C

  The first thing you need to do before you implement directory synchronization is to purchase a custom domain name. This could be the domain name that you use in your on-premise Active Directory if it's a routable domain name, for

  example, contoso.com.

  If you use a non-routable domain name in your Active Directory, for example contoso.local, you'll need to add the routable domain name as a UPN suffix in Active Directory.

  Reference:

  https://docs.microsoft.com/en-us/office365/enterprise/set-up-directory-synchronization

• Question 348:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.

  

  The domain syncs to an Azure Active Directory (Azure AD) tenant named contoso.com as shown in the exhibit.

  

  User2 fails to authenticate to Azure AD when signing in as [email protected].

  You need to ensure that User2 can access the resources in Azure AD.

  Solution: From the Azure Active Directory admin center, you assign User2 the Security reader role. You instruct User2 to sign in as [email protected].

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  This is not a permissions issue so you do not need to assign the Security Reader role.

  The on-premises Active Directory domain is named contoso.com. User2 could sign on as [email protected] but you would first need to change the UPN of User2 to [email protected].

• Question 349:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.

  

  The domain syncs to an Azure Active Directory (Azure AD) tenant named contoso.com as shown in the exhibit.

  

  User2 fails to authenticate to Azure AD when signing in as [email protected].

  You need to ensure that User2 can access the resources in Azure AD.

  Solution: From the on-premises Active Directory domain, you set the UPN suffix for User2 to @contoso.com. You instruct User2 to sign in as [email protected].

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The on-premises Active Directory domain is named contoso.com. You can enable users to sign on using a different UPN (different domain), by adding the domain to Microsoft 365 as a custom domain. Alternatively, you can configure the user account to use the existing domain (contoso.com).

• Question 350:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.

  

  The domain syncs to an Azure Active Directory (Azure AD) tenant named contoso.com as shown in the exhibit.

  

  User2 fails to authenticate to Azure AD when signing in as [email protected].

  You need to ensure that User2 can access the resources in Azure AD.

  Solution: From the on-premises Active Directory domain, you assign User2 the Allow logon locally user right. You instruct User2 to sign in as [email protected].

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  This is not a permissions issue.

  The on-premises Active Directory domain is named contoso.com. To enable users to sign on using a different UPN (different domain), you need to add the domain to Microsoft 365 as a custom domain.