70-158 Question #68: Real Exam Question with Answer & Explanation

Question

You administer a Forefront Identity Manager (FIM) 2010 server. The FIM server has management agents (MAs) connected to the following data sources: Active Directory Domain Services (AD DS) Active Directory Lightweight Directory Services (AD LDS) Microsoft SQL Server. You need to delete a user object from AD LDS when the matching user record in the SQL Server database is marked as inactive. The attribute flow between the user record in the SQL Server and the matching AD DS user object must remain unchanged. What should you do? (Each correct answer presents part of the solution. Choose all that apply.)

Options

• AConfigure connector filter for the AD DS MA.
• BConfigure connector filter for the SQL Server MA.
• CConfigure deprovisioning for the AD LDS MA.
• DConfigure deprovisioning in the AD LDS triple.
• EConfigure deprovisioning for the SQL Server MA.
• FConfigure object deletion rule for the Person object type.

Explanation

To delete an AD LDS object when a SQL Server record becomes inactive without affecting the AD DS attribute flow, you must configure deprovisioning settings specifically on the AD LDS MA and its metaverse object handling.

Common mistakes.

• A. A connector filter on the AD DS MA would prevent AD DS objects from joining or projecting into the metaverse, which would disrupt the required unchanged attribute flow between SQL Server and AD DS.
• B. A connector filter on the SQL Server MA would prevent the SQL record from connecting to the metaverse entirely, rather than triggering a targeted deletion of only the AD LDS object when the record is inactive.
• E. Configuring deprovisioning for the SQL Server MA controls what happens to SQL Server objects when disconnected, not what happens to AD LDS objects, so this does not address the requirement to delete the AD LDS user.
• F. An object deletion rule for the Person object type would affect all MAs connected to that metaverse object type globally, potentially disrupting the AD DS attribute flow rather than isolating the deletion action to AD LDS only.

Concept tested. FIM 2010 deprovisioning configuration for targeted connector deletion

Reference. https://learn.microsoft.com/en-us/previous-versions/windows/desktop/forefront-2010/ff686835(v=ws.10)

No community discussion yet for this question.