Examkin

Question

Difficulty: Very hardMicrosoft Entra ID Authentication and Conditional Access

An enterprise architect is designing an identity and access management strategy for a multinational corporation. The strategy must incorporate Microsoft Entra ID hybrid authentication, identity protection, and granular access controls. Match each corporate security and technical requirement on the left to the most appropriate Microsoft Entra ID or Conditional Access feature on the right that satisfies the requirement.

  • Authenticate users against on-premises Active Directory Domain Services (AD DS) without synchronizing password hashes or credentials to the cloud, and without deploying federated servers.Microsoft Entra Pass-through Authentication (PTA)
  • Enforce phishing-resistant multi-factor authentication (MFA) exclusively when accessing sensitive financial applications, while permitting standard push notifications for other cloud services.Conditional Access Authentication Strengths
  • Automatically require users to change their password using Self-Service Password Reset (SSPR) when their credentials are found to be compromised and leaked on public networks.Microsoft Entra ID Protection User Risk Policy
  • Allow external partner users to access internal resources only if their devices are marked as compliant within their home tenant, trusting the compliance state across directories.Microsoft Entra External ID Cross-Tenant Access Settings

Answer

Match 'Authenticate users against on-premises Active Directory Domain Services (AD DS) without synchronizing password hashes...' to 'Microsoft Entra Pass-through Authentication (PTA)'; match 'Enforce phishing-resistant multi-factor authentication (MFA) exclusively...' to 'Conditional Access Authentication Strengths'; match 'Automatically require users to change their password...' to 'Microsoft Entra ID Protection User Risk Policy'; match 'Allow external partner users to access internal resources...' to 'Microsoft Entra External ID Cross-Tenant Access Settings'.
Pass-through Authentication (PTA) allows secure, on-premises credential validation without cloud password synchronization or ADFS. Conditional Access Authentication Strengths allow defining specific MFA methods like phishing-resistant authentication. Microsoft Entra ID Protection User Risk Policies handle long-term risks like leaked credentials and require password change remediation. Cross-Tenant Access Settings let resource tenants trust compliant devices managed by external Entra tenants.

Step-by-Step Solution

1
Analyze the authentication requirement that forbids credential sync and federated servers.
Identify that Password Hash Synchronization (PHS) syncs hashes and Active Directory Federation Services (AD FS) is a federated server infrastructure. Pass-through Authentication (PTA) fulfills the exact criteria by validating passwords against on-premises AD DS using a local agent.
To design the appropriate hybrid identity integration without storing credentials in the cloud or deploying federated infrastructure.
2
Determine the mechanism to enforce phishing-resistant MFA for specific applications.
Recall that Conditional Access authentication strengths allow policy enforcement of specific MFA methods (like FIDO2 security keys) per application, rather than applying a global or coarse MFA policy.
To enforce granular, application-specific authentication requirements.
3
Evaluate the remediation strategy for compromised/leaked credentials.
Identify leaked credentials as a user-level risk. A Microsoft Entra ID Protection User Risk Policy can detect this and trigger a secure password change through Self-Service Password Reset (SSPR) to transition the user back to a low-risk state.
To secure compromised accounts using automated risk-based policies.
4
Assess how to trust device compliance states from partner tenants.
Select cross-tenant access settings, which permit inbound trust configuration for external tenant multi-factor authentication and compliant devices.
To enable secure external collaboration without requiring partner devices to enroll in the local Intune tenant.

Key Concept

Microsoft Entra ID hybrid identity integration, advanced Conditional Access policies, risk-based access, and cross-tenant resource governance.
Estimated Time:3m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access