Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

Kestrel Healthcare Services is designing a hybrid identity and access management solution for a new Microsoft Entra ID tenant. The on-premises Active Directory Domain Services (AD DS) domain will synchronize with Microsoft Entra ID. The design must satisfy the following requirements:
- Users must be able to authenticate to cloud services even if the connection between the on-premises network and Azure is completely lost.
- The security team must be able to detect if user credentials synchronized from on-premises have been posted to the dark web.
- Multi-factor authentication (MFA) must be enforced for all administrative tasks performed by the IT support team.
- The organization must prevent administrative lockout of the tenant if the Entra ID multi-factor authentication service or the Privileged Identity Management (PIM) service experiences an outage.

Which of the following infrastructure designs should you recommend?

  1. Implement Password Hash Synchronization (PHS) as the hybrid authentication method. Configure a Conditional Access policy to enforce multi-factor authentication (MFA) for the Global Administrator role, and exclude two cloud-only emergency access accounts. Assign the Global Administrator role permanently to these two emergency access accounts.Answer
  2. B
    Implement Pass-through Authentication (PTA) with Seamless Single Sign-On as the hybrid authentication method. Configure a Conditional Access policy to enforce multi-factor authentication (MFA) for all administrative accounts, including the emergency access accounts. Configure all administrator accounts as permanently active Global Administrators.
  3. C
    Deploy Active Directory Federation Services (AD FS) for identity federation. Configure a Conditional Access policy to enforce multi-factor authentication (MFA) for the Global Administrator role, and exclude two emergency access accounts. Configure all other administrator accounts as permanently active Global Administrators to avoid PIM activation latency.
  4. D
    Implement Password Hash Synchronization (PHS) as the hybrid authentication method. Configure a Conditional Access policy to enforce multi-factor authentication (MFA) for the Global Administrator role. Configure two emergency access accounts as eligible for the Global Administrator role using Microsoft Entra Privileged Identity Management (PIM) and exclude them from the MFA policy.

Answer

Implement Password Hash Synchronization (PHS) as the hybrid authentication method. Configure a Conditional Access policy to enforce multi-factor authentication (MFA) for the Global Administrator role, and exclude two cloud-only emergency access accounts. Assign the Global Administrator role permanently to these two emergency access accounts.
The correct design uses Password Hash Synchronization (PHS) to ensure offline authentication availability and enable leaked credential detection, which is a feature of Entra ID Protection. It enforces MFA on administrative roles using Conditional Access while excluding emergency access accounts from the MFA policy. These break-glass accounts are permanently assigned the Global Administrator role (rather than eligible through PIM) to ensure they can be used to recover tenant access if Entra ID MFA or PIM services experience an outage.

Step-by-Step Solution

1
Select the hybrid authentication method that provides offline resilience and leaked credential detection.
Password Hash Synchronization (PHS) is selected.
PHS allows authentication directly in the cloud, ensuring users can log in even if the on-premises link is offline. Microsoft Entra ID Protection also requires PHS to compare password hashes with credentials leaked on the dark web.
2
Formulate a policy to secure administrative accounts while preventing tenant lockout.
Create a Conditional Access policy that requires MFA for the Global Administrator role, but exclude two break-glass emergency access accounts.
Enforcing MFA on administrators is a security best practice, but excluding break-glass accounts ensures that if the MFA service goes down, administrators can still access the tenant.
3
Configure the role assignment method for the emergency access accounts.
Assign the Global Administrator role permanently to the emergency access accounts, rather than making them eligible in Privileged Identity Management (PIM).
Emergency access accounts must not depend on PIM to activate their roles, because a PIM service outage would prevent activation and lead to lockout.

Key Concept

Microsoft Entra ID hybrid authentication resilience, Conditional Access exclusions, and emergency access account best practices.
Estimated Time:3m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access