MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Set the sync scope to 'Synchronize selected groups'

  Why this is correct

  Selecting 'Synchronize selected groups' in Microsoft Entra Connect wizard (or via PowerShell) restricts synchronization to only the on-premises groups you explicitly choose, along with their members. This is the native group-based filtering (also called group scoping) feature, letting you sync, for example, only the 'Sales' group and its users while excluding all other objects. It directly controls what the sync engine copies from the on-premises connector to Microsoft Entra ID, making it the correct answer.

• ✗

  Configure attribute-based filtering in Microsoft Entra Connect

  Why it's wrong here

  Attribute-based filtering in Microsoft Entra Connect uses object attributes (such as extensionAttribute15 or a custom 'department' value) to include or exclude objects from synchronization on a per-object basis. It does not let you pick a group and then automatically include all its members; instead, every user, contact, or group is evaluated individually against the attribute rule. Thus, while it can filter users who belong to groups, it cannot define the sync scope as 'these specific groups plus their members'—that requires group-based filtering.

• ✗

  Create a security group in Microsoft Entra ID and add members

  Why it's wrong here

  Creating a security group in Microsoft Entra ID (cloud) and manually adding members does not affect what Microsoft Entra Connect synchronizes from on-premises Active Directory. The sync engine only populates objects from the on-premises source, and cloud-only groups are out of scope unless they are enabled for write-back or cloud-synced groups are in use (which still require on-premises group filtering). Performing this action would leave the on-premises sync scope unchanged and would not limit which AD groups are replicated.

• ✗

  Use the Synchronization Service Manager to select groups

  Why it's wrong here

  The Synchronization Service Manager (often launched from the Microsoft Entra Connect installation) is a troubleshooting and monitoring tool that shows connector spaces, metaverse objects, run profiles, and synchronization errors. It does not provide any wizard or UI for selecting which groups to synchronize—that configuration is done through the Microsoft Entra Connect installer (Customization options) or with cmdlets like Set-ADSyncConnector or the 'Get-ADSyncConnector' pipeline. Trying to use it to set sync scope is a category error because it is read-only for provisioning settings.

Go deeper

Related to this question