nerdexam

70-158 · Question #45

You deploy Forefront Identity Manager (FIM) 2010 in your company network. You configure group synchronization between the Active Directory Domain Services (AD DS) domain and the FIM Portal. You…

The correct answer is C. The outbound synchronization rule has incorrect null flow for one of the attributes. The issue arises because the outbound synchronization rule from FIM to AD DS is not correctly configured to handle null or empty values for the group membership attribute, preventing AD DS from being updated when all users are deleted from a group in the FIM Portal.

Submitted by manish99· Mar 4, 2026Configure Data Synchronization

Question

You deploy Forefront Identity Manager (FIM) 2010 in your company network. You configure group synchronization between the Active Directory Domain Services (AD DS) domain and the FIM Portal. You discover that when you add a new user to a group through the FIM Portal, the group membership successfully flows to the domain. However, if you delete all users from the group, the domain group membership is not updated. What is the cause of the issue?

Options

  • AThe FIM Service account does not have Replicating Directory Changes permissions.
  • BThe FIM MA Service account does not have Replicating Directory Changes permissions.
  • CThe outbound synchronization rule has incorrect null flow for one of the attributes.
  • DThe outbound synchronization rule has incorrect flow scope for one of the attributes.

How the community answered

(37 responses)
  • A
    24% (9)
  • B
    14% (5)
  • C
    57% (21)
  • D
    5% (2)

Why each option

The issue arises because the outbound synchronization rule from FIM to AD DS is not correctly configured to handle null or empty values for the group membership attribute, preventing AD DS from being updated when all users are deleted from a group in the FIM Portal.

AThe FIM Service account does not have Replicating Directory Changes permissions.

Replicating Directory Changes permissions are primarily required for the FIM Service account to read changes from Active Directory (inbound synchronization), not for writing outbound changes like clearing group membership.

BThe FIM MA Service account does not have Replicating Directory Changes permissions.

Similar to option A, the FIM MA Service account requiring Replicating Directory Changes permissions relates to inbound synchronization from AD, not the outbound flow of an empty attribute to AD.

CThe outbound synchronization rule has incorrect null flow for one of the attributes.Correct

When all users are deleted from a group in the FIM Portal, the group's membership attribute effectively becomes null or empty. If the outbound synchronization rule is not configured to correctly flow these null values, the corresponding attribute in Active Directory will not be cleared, leading to the observed discrepancy where AD DS membership is not updated.

DThe outbound synchronization rule has incorrect flow scope for one of the attributes.

Incorrect flow scope would typically mean the attribute is not considered for synchronization at all, or only under specific conditions, but in this case, adding users works, indicating the scope is generally correct; the problem is with handling null values.

Concept tested: FIM synchronization rule null flow configuration

Topics

#Synchronization Rules#Null Flow#Group Synchronization#AD DS Integration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 70-158 Practice