SC-300 Certification Practice Question #55

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains an Active Directory Federation Services (AD FS) instance and a member server named Server1 that runs Windows Server. The domain contains the users shown in the following table.

You have a Microsoft Entra tenant named contoso.com that is linked to a Microsoft 365 subscription.

You establish federation between fabrikam.com and contoso.com by using a Microsoft Entra Connect instance that is configured as shown in the following exhibit.

You perform the following tasks in contoso.com:

•	Create a group named Group1.
•	Disable User2.
•	Enable User3.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

All three statements describe cloud-side actions against directory-synced objects in a federated tenant. Box 1 is Yes because Group1 lives in Entra and User1 is a synced cloud object, so the membership is valid in the cloud (Group writeback being off only blocks the group from appearing on-prem, and MS Learn confirms the on-prem 6-char password policy overrides cloud complexity for synced users). Box 2 is Yes because Server1 is on-premises and only password writeback (not account enable/disable) flows from Entra to AD, so disabling User2 in the cloud leaves the on-prem account enabled. Box 3 is No because User3 is disabled in on-prem AD; manually enabling it in Entra is reverted on the next sync cycle since on-prem AD is the authority for synced objects. The 30-👍 and 9-👍 Highly Voted comments both land on Y/Y/N; confidence is held at 84 (not higher) because the thread is noisy with several low-vote dissenting permutations and no recorded official Suggested Answer.

More SC-300 practice questions