Exam MS-100 All Questions

View all questions & answers for the MS-100 exam

Exam MS-100 topic 3 question 97 discussion

Actual exam question from Microsoft's MS-100

Question #: 97
Topic #: 3

HOTSPOT
-

Your network contains an on-premises Active Directory domain. The domain contains the users shown in the following table.

You have a Microsoft 365 subscription that is linked to an Azure AD tenant named contoso.com.

You configure Azure AD Connect to sync the on-premises domain to contoso.com as shown in the following exhibit.

You create a synchronization rule for the users. The scoping filters for the rule are configured as shown in the following exhibit.

Add scoping filters, or click next to skip this step.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by mefist0 at Jan. 5, 2023, 7:22 p.m.

Comments

Submit Cancel

hubran

Highly Voted 2 years, 5 months ago

We are talking here about scope filtering. Filtering means exclude from sync. According to https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#attribute-based-filtering, the correct answer should be: User1: YES (because in OU1 and none of the filters apply: not in OU2 and not country=CA) User2: NO (would be synched because in OU1 but country=CA prevents it) User3: NO (because out of OU scope (OU2 and not OU1)

upvoted 9 times

Petrucci914

2 years, 5 months ago

I'm not so sure: "In inbound filtering, you use the power of scope to determine which objects to synchronize or not synchronize. This is where you make adjustments to fit your own organization's requirements. The scope module has a group and a clause to determine when a sync rule is in scope. A group contains one or many clauses. There is a logical "AND" between multiple clauses, and a logical "OR" between multiple groups." https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#attribute-based-filtering

upvoted 1 times

...

Feyenoord

Highly Voted 2 years, 3 months ago

Answer is NYN. It is a positive filter, else the value would be NoSync. User 3 is not in the correct OU. User 1 does not match the filter. User 2 does. So its YNY

upvoted 7 times

Feyenoord

2 years, 3 months ago

Correction NYN

upvoted 2 times

...

Meebler

Most Recent 2 years, 3 months ago

hubran is mistaken, Scope filtering in Azure AD is generally used to only include objects that meet a specific criteria (exclude the rest), In this case: 'C=CA' && 'OU=OU2'. note: That both criteria have to be met as the 'AND' operand is being used. So in basic term, we are applying a filter on a selection. The answer is: (N,N,N) N - Both OU and Country are incorrect N - Country is good but OU is not N - Only OU is correct

upvoted 5 times

Meebler

2 years, 3 months ago

When multiple scope filters are created the 'AND' logic is applied.

upvoted 1 times

[Removed]

2 years, 3 months ago

I think, you are incorrect here. As per the screenshot it would seem that the OR is being used here as both clauses are in different groups, thus making the given answer, correct. As per the source, "There is a logical "AND" between multiple clauses, and a logical "OR" between multiple groups". Source: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering (Inbound filtering)

upvoted 3 times

Meebler

2 years, 3 months ago

Hi Radiance5650, I thank you for your source. I stand corrected I carefully reviewed the provided link and an "OR" Is provided between different filters: (OU= IT) OR (Country = CA). The answer should be NYN N = excluded by the scope filtering Y = Condition is met N = is excluded is 'Domain and OU Filtering'

upvoted 4 times

...

One111

1 year, 9 months ago

We don't no anything about transformation or provisioning rules. Ruleset from screenshot might do nothing except filtering. There is now way to determine what is happening to users that meet criteria. All we know for sure is OU filtering.

upvoted 1 times

...

DeLoc

2 years, 4 months ago

I think the answer is NYN. The filter is not clear if it is Negative or Positive from the information available, however, the default would be positive so in this case user in OU2 OR C=CA. Given that OU2 is not selected in for sync the only user to qualify here is User2 who is in OU1 and meets the criteria for Canada.

upvoted 3 times

...

mefist0

2 years, 5 months ago

N,N,N You can use multiple filtering options at the same time. For example, you can use OU-based filtering to only include objects in one OU. At the same time, you can use attribute-based filtering to filter the objects further. When you use multiple filtering methods, the filters use a logical "AND" between the filters. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#filtering-options

upvoted 3 times

mefist0

2 years, 5 months ago

hubran is right it is Y,N,N The attribute based filtering (scoping filters) are usually negative filtering: "do not sync these". I first thought they were "only sync these" filters.

upvoted 3 times

...