Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Aventis Pharmaceuticals is designing a secure access and identity solution for its Microsoft Entra ID tenant. The tenant will synchronize identities from an on-premises Active Directory Domain Services (AD DS) environment.

The solution must meet the following requirements:
- Enforce multi-factor authentication (MFA) for all administrative users using Conditional Access policies.
- Ensure that administrators can access the tenant even if a misconfiguration or outage affects the MFA service.
- Prevent administrators from having standing access to highly privileged roles.
- Implement the simplest possible hybrid identity authentication model that requires no on-premises server infrastructure for credential validation.

Which two of the following components should you include in the identity and authentication design? (Select TWO.)

  1. A dedicated, cloud-only emergency access account that is explicitly excluded from the Conditional Access policyAnswer
  2. Password Hash Synchronization (PHS) to provide hybrid identity authenticationAnswer
  3. C
    Active Directory Federation Services (AD FS) to handle user authentication for all synchronized identities
  4. D
    A Conditional Access policy that enforces MFA for all administrator accounts without any exclusions
  5. E
    Privileged Identity Management (PIM) assignments configured as permanently active for the designated administrator accounts

Answer

Include a dedicated, cloud-only emergency access account excluded from the Conditional Access policy, and use Password Hash Synchronization (PHS) to provide hybrid identity authentication.
To satisfy the requirements, the design must exclude a dedicated emergency access account from the Conditional Access policy enforcing MFA to prevent lockouts. It must also utilize Password Hash Synchronization (PHS) because it is the simplest hybrid authentication method and requires no on-premises infrastructure for validation, processing authentications entirely in the cloud.

Step-by-Step Solution

1
Analyze the resiliency requirement for administrative access during MFA outages.
Identify that an emergency access (break-glass) account must be created as a cloud-only account and excluded from Conditional Access policies that enforce MFA.
This prevents administrative lockout in the event of an MFA service outage or misconfiguration.
2
Evaluate the hybrid identity authentication requirements.
Select Password Hash Synchronization (PHS) as the authentication mechanism.
PHS is the simplest hybrid authentication option, validating credentials in the cloud and requiring no on-premises server infrastructure for authentication.
3
Verify options against the requirement to prevent standing access.
Ensure that administrative roles are configured using eligible assignments rather than permanent active assignments.
Eligible assignments require users to request activation for a limited duration, enforcing just-in-time access.

Key Concept

Microsoft Entra ID hybrid authentication and Conditional Access design resiliency
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access