Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

A global financial enterprise is designing a hybrid identity and access management solution using Microsoft Entra ID. You need to align specific security and authentication requirements with the appropriate Microsoft Entra ID feature or Conditional Access configuration.

Match each security requirement on the left to its corresponding feature or configuration on the right. (Each option on the right may be used once, more than once, or not at all.)

  • Validate authentication requests in real-time directly against the on-premises Active Directory Domain Services (AD DS) without storing any form of password hashes in the cloud, while ensuring high availability via redundant on-premises agents.Microsoft Entra Pass-through Authentication (PTA)
  • Detect and block the use of custom, organization-specific weak passwords or terms during password changes, applied both to cloud-native users and users synchronized from on-premises AD DS.Microsoft Entra Password Protection
  • Enforce multi-factor authentication (MFA) for administrative roles only when they access Azure management portals from external, untrusted IP ranges.Conditional Access policy using Locations conditions and Grant controls
  • Restrict session lifetimes for web-based access to SharePoint Online on unmanaged personal devices, forcing users to re-verify credentials every 4 hours.Conditional Access policy using Session controls with Sign-in frequency

Answer

Match the following: validation without cloud hashes maps to Pass-through Authentication; custom weak password blocking maps to Microsoft Entra Password Protection; IP-based MFA restriction maps to Conditional Access Locations conditions and Grant controls; and limiting session lifetimes maps to Conditional Access Session controls with Sign-in frequency.
Pass-through Authentication validates passwords directly against on-premises Active Directory using agents, fulfilling the requirement of validating credentials in real-time without cloud-stored hashes. Microsoft Entra Password Protection allows custom banned password lists to block weak terms globally and on-premises. Conditional Access Locations conditions combined with Grant controls restrict access based on network locations and require MFA. Conditional Access Session controls with Sign-in frequency allow setting specific re-authentication intervals for resource access.

Step-by-Step Solution

1
Analyze the identity synchronization and authentication requirement for validation without cloud hashes.
Identify Microsoft Entra Pass-through Authentication (PTA) as the solution, as it leverages on-premises agents to validate credentials directly without storing password hashes in Microsoft Entra ID.
Password Hash Synchronization (PHS) stores hashes in the cloud, which violates the primary constraint.
2
Evaluate the requirement for banning custom weak terms for both cloud and synchronized users.
Determine that Microsoft Entra Password Protection meets this requirement through custom banned lists deployed to both cloud and on-premises Active Directory via agents.
This features ensures password quality policy compliance across hybrid identity systems.
3
Assess the requirement to enforce MFA based on IP addresses.
Select Conditional Access with Locations conditions and Grant controls to require MFA only when external to trusted IP ranges.
Named Locations allow defining IP networks, and Grant controls allow requiring MFA under specific conditions.
4
Assess the requirement to limit the session lifetime on unmanaged devices.
Select Conditional Access Session controls configured with a Sign-in frequency of 4 hours.
Sign-in frequency dictates how often a user must re-authenticate to access the targeted cloud resource.

Key Concept

Microsoft Entra ID hybrid authentication and Conditional Access design
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access