nerdexam

70-158 · Question #18

Your company network includes Forefront Identity Manager (FIM) 2010. The Self-Service Password Reset and Registration feature is configured. From the FIM Portal, you create a set of help desk users…

The correct answer is D. Create an MPR that enables the Operation type to Read resource and Remove a value from a multivalued. To allow help desk users to manage locked-out Password Reset users in FIM 2010, a specific MPR must be created that grants the ability to read resources and remove values from multivalued attributes, which corresponds to unlocking/removing lockout gate registrations.

Submitted by hassan_iq· Mar 4, 2026Configuring Policy Management

Question

Your company network includes Forefront Identity Manager (FIM) 2010. The Self-Service Password Reset and Registration feature is configured. From the FIM Portal, you create a set of help desk users and a set of lockout gate registration resources. You create the following Management Policy Rules (MPRs): - Grant the Modify permission to help desk users to the attributes of the lockout gate restrictions. - Grant the Read permission to help desk users to the Password Reset Users set. You need to ensure that help desk users can manage users that are locked out of the Password Reset feature. What should you do?

Options

  • ACreate a new Password Reset Users set.
  • BConfigure the existing MPR to grant the Modify permission to the Password Reset Users set.
  • CCreate an MPR that enables the Operation type to Create resource and Add a value to a multivalued
  • DCreate an MPR that enables the Operation type to Read resource and Remove a value from a multivalued

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    26% (7)
  • C
    11% (3)
  • D
    56% (15)

Why each option

To allow help desk users to manage locked-out Password Reset users in FIM 2010, a specific MPR must be created that grants the ability to read resources and remove values from multivalued attributes, which corresponds to unlocking/removing lockout gate registrations.

ACreate a new Password Reset Users set.

Creating a new Password Reset Users set does not grant any additional permissions to help desk users and does not address the need to manage locked-out users.

BConfigure the existing MPR to grant the Modify permission to the Password Reset Users set.

Granting Modify permission to the Password Reset Users set would allow help desk users to modify set membership, not manage the individual lockout gate registration attributes that control the locked-out state.

CCreate an MPR that enables the Operation type to Create resource and Add a value to a multivalued

An MPR with 'Create resource and Add a value to a multivalued' operation type grants creation and addition permissions, which is the opposite of what is needed - unlocking requires removing a value, not adding one.

DCreate an MPR that enables the Operation type to Read resource and Remove a value from a multivaluedCorrect

Creating an MPR with the Operation type 'Read resource and Remove a value from a multivalued' attribute allows help desk users to remove lockout gate registration entries from a user's profile, which is the specific action needed to unlock a user from the Password Reset feature. The lockout state in FIM Self-Service Password Reset is represented as a multivalued attribute, and removing the offending value effectively resets the lockout. This MPR type grants the precise combination of permissions required for help desk users to both view and remediate the locked-out condition.

Concept tested: FIM 2010 MPR configuration for Password Reset lockout management

Source: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/forefront-2010/ff394386(v=vs.100)

Topics

#Management Policy Rules#Self-Service Password Reset#Lockout Gate#FIM Portal

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 70-158 Practice