Task 1.4: Implement and manage hybrid identity

• AA second Active Directory connector for the Litware forest, added on the existing Connect Sync server

  Incorrect

  Connect Sync doesn't support disconnected forests; the server needs a network path to Litware's domain controllers.

• BA Connect Sync server in staging mode inside the Litware forest

  Incorrect

  A staging server imports but doesn't export, so it would never create Litware users in the tenant.

• CMicrosoft Entra Cloud Sync with provisioning agents installed on two Litware servers

  Correct

  Cloud Sync handles disconnected forests with lightweight agents, and several active agents fail over automatically.

• DA new tenant for Litware, synchronized into Contoso with cross-tenant synchronization

  Incorrect

  Cross-tenant sync creates B2B collaboration users whose passwords stay in Litware's own tenant, and adds a tenant to run.

Cloud Sync's provisioning agents need only outbound connections, support disconnected forests (Connect Sync doesn't) and run as several active agents for automatic failover. Litware's 30,000 users are within Cloud Sync's 150,000-objects-per-domain limit, and password hash sync is supported.

• APass-through authentication

  Correct

  Its on-premises agents validate each password against Active Directory, so account states and sign-in hours apply at once.

• BFederation with AD FS

  Incorrect

  AD FS also enforces these policies but needs the federation servers the company wants to avoid.

• CSeamless single sign-on

  Incorrect

  Seamless SSO only signs in domain-joined devices silently; it works on top of password hash sync or pass-through authentication.

• DPassword hash synchronization

  Incorrect

  Password hash sync validates in the cloud and doesn't immediately enforce on-premises account states or sign-in hours.

Pass-through authentication validates passwords on premises through lightweight agents that make outbound connections only, so account expired, disabled, password expired, locked out and sign-in hours are enforced at sign-in. Password hash sync doesn't enforce account state changes until they sync. Enabling password hash sync as well is still recommended for leaked credential detection.

• AMembers of nested groups inside a pilot group are included in the pilot

  Incorrect

  Nested groups aren't supported for Staged Rollout.

• BCloud security groups are recommended, to avoid the sync latency of on-premises groups

  Correct

  The guidance recommends cloud groups for this reason.

• CA dynamic group can be used so that the pilot grows by department automatically

  Incorrect

  Dynamic groups aren't supported for Staged Rollout.

• DEach Staged Rollout feature, such as password hash sync, accepts up to 10 groups

  Correct

  The limit is 10 groups each for password hash sync, pass-through authentication and seamless SSO.

• EA group that also holds contact objects can be added to Staged Rollout, and the contacts are ignored

  Incorrect

  Contact objects inside a group block the group from being added.

Staged Rollout moves selected users to cloud authentication while the domain stays federated. It accepts up to 10 security groups per feature, recommends cloud groups, and doesn't support nested or dynamic groups or groups that contain contacts. The final cutover from federated to managed is still a separate step.

• AEvery 2 minutes

  Incorrect

  Two minutes is Cloud Sync's provisioning interval, not Connect Sync's.

• BEvery 30 minutes

  Correct

  The built-in scheduler runs a cycle every 30 minutes unless customized.

• CEvery 3 hours

  Incorrect

  Connect Sync's default is shorter.

• DOnce a day at midnight

  Incorrect

  Connect Sync's default is shorter; a cycle must run at least every 7 days if you change it.

The Connect Sync scheduler is built into the sync engine and runs a synchronization cycle every 30 minutes by default. CustomizedSyncCycleInterval changes it, and a cycle must still run at least once every 7 days.

• ANever; Microsoft Entra ID rotates it automatically

  Incorrect

  The rollover is a manual step with Update-AzureADSSOForest.

• BOnce a year, when the certificate expires

  Incorrect

  The recommended interval is much shorter.

• COnly after a domain controller is replaced

  Incorrect

  Rollover is recommended on a regular schedule, not only after changes.

• DAt least every 30 days

  Correct

  Microsoft highly recommends rolling over the key at least every 30 days.

Microsoft highly recommends rolling over the seamless SSO Kerberos decryption key at least every 30 days with the Update-AzureADSSOForest cmdlet, running it only once per forest.

• AMicrosoft Entra ID Free

  Incorrect

  Connect Health can't be configured without P1 or P2.

• BMicrosoft Defender for Identity

  Incorrect

  Defender for Identity is a separate product for threat detection.

• CMicrosoft Entra ID Governance

  Incorrect

  Governance licenses aren't required for Connect Health.

• DMicrosoft Entra ID P1 or P2

  Correct

  Connect Health is a feature of Microsoft Entra ID P1 or P2.

Microsoft Entra Connect Health is a feature of Microsoft Entra ID P1 or P2; without one of them, the configuration can't be completed in the admin center.

• AReplace Connect Sync with Cloud Sync, which becomes mandatory for every tenant on that date

  Incorrect

  Supported Connect Sync 2.x versions keep working; migration isn't forced by this date.

• BUpgrade to version 2.6.84.0 or later and configure application-based authentication

  Correct

  Legacy authentication is retiring, and sync stops after that date without both.

• CMove the Connect Sync database to a full SQL Server instance

  Incorrect

  The requirement concerns the version and authentication, not the database.

• DInstall the MSOnline PowerShell module on the sync server

  Incorrect

  Connect Sync replaced its MSOnline calls with Microsoft Graph.

Microsoft requires Microsoft Entra Connect Sync version 2.6.84.0 or later with application-based authentication by April 7, 2027; legacy authentication is retiring and synchronization stops after that date otherwise. Connect Sync 1.x versions no longer work.