Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Borealis Energy is designing a hybrid identity and access management solution. The company synchronizes its on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID.

The solution must meet the following requirements:
- Enforce on-premises security policies, such as log-on hours, during cloud authentication in real-time.
- Minimize on-premises infrastructure and eliminate the need for inbound firewall ports.
- Ensure that administrators are prompted for multi-factor authentication (MFA) when accessing cloud resources, while preventing tenant lockout during an identity system outage.

Which combination of authentication method and Conditional Access policy configuration should you recommend?

  1. Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.Answer
  2. B
    Password Hash Synchronization (PHS) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.
  3. C
    Active Directory Federation Services (AD FS) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.
  4. D
    Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles without any exclusions, relying on emergency administrators to request access via Privileged Identity Management (PIM).

Answer

Pass-through Authentication (PTA) and a Conditional Access policy that requires MFA for all administrative directory roles and explicitly excludes a dedicated emergency access account.
Pass-through Authentication (PTA) validates user passwords directly against the on-premises Active Directory Domain Services, which enforces local security policies like logon hours in real-time. PTA achieves this via lightweight agents that establish outbound connections, meaning no inbound firewall ports are needed. Furthermore, excluding a dedicated emergency access account from the Conditional Access MFA policy ensures that administrators can access the tenant to perform recovery actions in the event of an authentication failure or external service outage.

Step-by-Step Solution

1
Evaluate the authentication method requirements.
Identify Pass-through Authentication (PTA) as the correct method because it evaluates on-premises AD DS policies (like log-on hours) in real-time, unlike Password Hash Synchronization (PHS), and does not require incoming network ports or heavy on-premises server footprint like Active Directory Federation Services (AD FS).
PTA leverages outbound-only connections from lightweight agents running on-premises to process login requests directly against the local domain controllers.
2
Evaluate the Conditional Access policy requirement to enforce MFA while protecting against tenant lockout.
Determine that the Conditional Access policy targeting administrative directory roles must contain an explicit exclusion for a dedicated emergency access (break-glass) account.
Omitting an exclusion for the emergency access account from strict MFA policies risks locking out administrators if there is an MFA service disruption or connectivity issue.

Key Concept

Selecting a hybrid identity authentication method to enforce local AD DS policies in real-time while using Conditional Access policies with exclusion groups to prevent administrative lockout.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access