You deploy Forefront Identity Manager (FIM) 2010 server in your company network. You configure group objects synchronization between the Active Directory domain and FIM Portal. You create an…

The AD groupType attribute is a bitmask integer that encodes both the group type (security vs. distribution) and scope (domain local, global, universal) simultaneously; since FIM stores these as separate attributes (type and scope), a custom expression is required to combine them into the correct groupType bitmask value to support all possible combinations.

The distinguished name (dn) in Active Directory must be dynamically constructed based on the group name and target organizational unit, meaning a simple direct mapping is insufficient and a custom expression is needed to build the correct LDAP DN string for provisioning.

Mapping only the type source attribute to groupType is incorrect because groupType is a combined bitmask requiring both type and scope values; a simple single-attribute mapping would not produce a valid or complete groupType value.

Mapping only the scope source attribute to groupType is incorrect for the same reason as C - the groupType bitmask requires both type and scope encoded together, so a single-attribute direct mapping would result in an incomplete or invalid value.

The dn attribute cannot be configured as a simple source-to-destination direct mapping because the FIM metaverse dn value does not correspond to a valid Active Directory DN format; it requires a custom expression to construct the proper LDAP distinguished name.

The member attribute requires a direct mapping from the FIM Portal member source attribute to the Active Directory member destination attribute to synchronize group membership, and this is a straightforward multi-valued reference attribute mapping that does not require a custom expression.