Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Zephyr Energy Services has an on-premises Active Directory Domain Services (AD DS) domain. The company is designing a hybrid identity solution to integrate AD DS with a Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must be able to authenticate to cloud services using their on-premises credentials.
- User password hashes must not be synchronized or stored in the cloud under any circumstances due to regulatory compliance policies.
- Authentication requests must be validated directly against on-premises Active Directory domain controllers.
- The deployment must avoid the infrastructure overhead and complexity of Active Directory Federation Services (AD FS).

Which authentication sync method should you include in the design to meet these requirements?

  1. Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)Answer
  2. B
    Password Hash Synchronization (PHS) with Seamless Single Sign-On (SSO)
  3. C
    Active Directory Federation Services (AD FS) federated sign-in
  4. D
    Microsoft Entra Domain Services with cloud-only user accounts

Answer

Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)
Pass-through Authentication (PTA) allows users to authenticate to cloud services by validating their passwords directly against their on-premises Active Directory. Because validation happens on-premises using a lightweight agent, no password hashes need to be synchronized to Microsoft Entra ID. This satisfies the security compliance constraints while avoiding the heavy infrastructure overhead of Active Directory Federation Services (AD FS).

Step-by-Step Solution

1
Analyze the authentication validation requirements.
The requirements demand that passwords or password hashes must not be stored in the cloud and must be validated against on-premises domain controllers directly.
This rules out Password Hash Synchronization (PHS) because PHS copies password hashes to Microsoft Entra ID.
2
Analyze the infrastructure overhead and complexity constraints.
The solution must avoid Active Directory Federation Services (AD FS) to minimize overhead.
This rules out AD FS federated sign-in, which would otherwise satisfy the direct on-premises validation requirement but requires extensive on-premises infrastructure.
3
Select the hybrid identity method that satisfies all remaining constraints.
Pass-through Authentication (PTA) allows direct on-premises validation of passwords via a lightweight agent without storing password hashes in the cloud and without the complexity of AD FS.
PTA meets all defined compliance and architectural constraints.

Key Concept

Selecting the appropriate hybrid identity synchronization and authentication method based on security compliance, sign-in requirements, and infrastructure complexity.
Estimated Time:1m 30s
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic