Question
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains an organizational unit (OU) named OU1.
You have an Azure subscription that is linked to a Microsoft Entra tenant named fabrikam.com.
You need to sync contoso.com with fabrikam.com. The solution must meet the following requirements:
• Support Windows Hello for Business by using a hybrid certificate deployment.
• Ensure that the passwords in contoso.com do NOT sync to fabrikam.com.
Which Microsoft Entra Connect feature should you use for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Support Windows Hello for Business by using a hybrid certificate deployment: Device writeback — A hybrid certificate trust deployment requires the on-premises AD DS forest to know about devices that are registered in Microsoft Entra ID, and Microsoft Entra Connect's device writeback feature copies those Entra ID device objects back into the on-premises directory (the Registered Devices container) so that domain controllers and the certificate/conditional-access evaluation can recognize the device. Pass-through authentication and password hash synchronization only affect how user sign-in credentials are validated and do nothing to make device objects visible on-premises.
Ensure that the passwords in contoso.com do NOT sync with fabrikam.com: Pass-through authentication — With pass-through authentication, Microsoft Entra Connect installs a lightweight agent on-premises that validates each sign-in directly against a contoso.com domain controller, so no password or password hash ever leaves the on-premises directory and none is stored in fabrikam.com. Password hash synchronization is the opposite of the requirement because it copies password hashes into Entra ID, and password writeback moves password changes in the other direction (from Entra ID back to AD DS) rather than preventing password sync.
