Question
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains an organizational unit (OU) named OU1.
You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named fabrikam.com. Fabrikam.com syncs with contoso.com.
In Sub1, you create a Microsoft Entra Domain Services domain configured as shown in the following table.
In domain1.onmicrosoft.com, you create two OUs named OU1 and OU2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
| Property | Value |
| --- | --- |
| DNS domain name | domain1.onmicrosoft.com |
| Location | East US |
| IP addresses | East US/10.0.2.5 10.0.2.4 |
| Secure LDAP | Disabled |
| Secure LDAP external IP addresses | East US/52.188.201.46 |
| Synchronization | All |
| Admin group | AAD DC Administrators |
Explanation
Statement 1 (Yes): contoso.com syncs to the Microsoft Entra tenant fabrikam.com through Microsoft Entra Connect, and the managed domain synchronizes All users from the tenant. User1 therefore reaches fabrikam.com and then domain1.onmicrosoft.com. The managed domain has a flat OU structure: on-premises OUs such as OU1 are not reproduced, and all synchronized user accounts are placed in the built-in AADDC Users container. For User1 to sign in to the managed domain, Microsoft Entra Connect must also synchronize the legacy password hashes.
Statement 2 (No): synchronization is one-way, from Microsoft Entra ID into Microsoft Entra Domain Services. Objects created in a custom OU of the managed domain, such as OU2, exist only in the managed domain and are never synchronized back to fabrikam.com.
Statement 3 (Yes): User3 is created as a cloud account in the tenant, and with synchronization set to All, the account is synchronized into the managed domain's built-in users container (AADDC Users). Synchronized accounts never land in custom OUs such as OU1 or OU2. Cloud-only accounts sync once their password hashes exist, which happens when the user changes their password.
