Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

Meridian BioLabs is designing a hybrid identity solution to integrate its on-premises Active Directory Domain Services (AD DS) forest, meridianbiolabs.local, with Microsoft Entra ID. The solution must support administrative access governance, secure collaboration, and business continuity.

You must design the solution to meet the following requirements:
- Users must be able to authenticate to cloud resources even during an on-premises internet WAN outage.
- Users must be able to change their passwords in the Microsoft Entra portal and have those changes updated on-premises immediately.
- Management overhead for Azure RBAC role assignments must be kept to a minimum.
- Emergency administrator accounts must be protected against accidental lockout resulting from tenant-wide multi-factor authentication (MFA) policies.

Which two of the following components should you include in the design? (Select two.)

  1. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable Password Writeback.Answer
  2. Create Microsoft Entra security groups for Azure RBAC assignments, and configure Conditional Access policies that exclude the designated emergency access accounts.Answer
  3. C
    Configure Microsoft Entra Connect with Pass-through Authentication (PTA) as the primary authentication method without any fallback mechanism.
  4. D
    Configure a Conditional Access policy that enforces MFA for all users including all emergency access accounts.
  5. E
    Configure Privileged Identity Management (PIM) with permanent active assignments of administrative roles to the administrator accounts.
  6. F
    Assign the required Azure RBAC roles directly to the individual administrator accounts rather than using group memberships.

Answer

The correct design incorporates Microsoft Entra Connect configured with Password Hash Synchronization (PHS) and Password Writeback, alongside using Microsoft Entra security groups for role assignments and excluding emergency access accounts from Conditional Access policies requiring multi-factor authentication (MFA).
The design must use Password Hash Synchronization (PHS) to ensure users can authenticate during a WAN outage, since PHS validates credentials directly in the cloud. Enabling Password Writeback satisfies the requirement to write cloud-reset passwords back to the on-premises Active Directory immediately. To minimize management overhead and follow security guidelines, RBAC roles should be assigned to security groups rather than individual users. Finally, excluding emergency access accounts from MFA Conditional Access policies ensures that administrators can access the tenant even during MFA outages or administrative lockouts.

Step-by-Step Solution

1
Analyze authentication and business continuity needs.
Identify that Password Hash Synchronization (PHS) allows cloud authentication during on-premises WAN outages because hashes are stored in Microsoft Entra ID. Reject Pass-through Authentication (PTA) as it requires active connectivity.
Meets the requirement for users to authenticate to cloud resources when the on-premises network is down.
2
Evaluate self-service password management.
Select Password Writeback as an addition to Microsoft Entra Connect sync configurations.
Allows cloud-based self-service password changes to write back instantly to the on-premises Active Directory.
3
Determine the resource authorization delegation model.
Avoid direct user role assignments and implement group-based Azure RBAC assignments.
Minimizes governance overhead and simplifies tracking as administrator personnel change.
4
Assess administrative lock-out prevention.
Define Conditional Access policy exclusions specifically targeting emergency glass-breaker accounts.
Protects against tenant lockout if there is a regional MFA infrastructure failure or identity configuration issue.

Key Concept

Designing hybrid identity synchronization methods and secure multi-tenant access governance while maintaining administrative resilience.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic