Examkin

Question

Difficulty: Very hardMicrosoft Entra ID Authentication and Conditional Access

You are designing a secure, resilient identity architecture for a global corporation with an on-premises Active Directory Domain Services (AD DS) directory and a Microsoft Entra ID tenant. The design must meet the following requirements:

* On-premises users must be synced to Microsoft Entra ID and must be able to authenticate to cloud services even during an on-premises WAN link outage.
* Administrative roles must be secured using Microsoft Entra Privileged Identity Management (PIM) with just-in-time (JIT) activation.
* All administrative actions must require multi-factor authentication (MFA) and a compliant device via a Conditional Access policy.
* The design must include a mitigation plan to prevent tenant lockout in the event of an outage of the Azure MFA service.

Which design strategy should you recommend?

  1. Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS). Assign administrative roles as eligible in Microsoft Entra Privileged Identity Management (PIM). Create a Conditional Access policy enforcing multi-factor authentication (MFA) and device compliance for administrative users, and explicitly exclude a dedicated, permanently assigned emergency access account that does not require MFA.Answer
  2. B
    Deploy Active Directory Federation Services (AD AD) with Web Application Proxies to handle authentication. Assign administrative roles as eligible in Microsoft Entra Privileged Identity Management (PIM). Create a Conditional Access policy enforcing multi-factor authentication (MFA) and device compliance for administrative users, and explicitly exclude a dedicated, permanently assigned emergency access account that does not require MFA.
  3. C
    Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS). Assign administrative roles as eligible in Microsoft Entra Privileged Identity Management (PIM). Create a Conditional Access policy enforcing multi-factor authentication (MFA) and device compliance for all administrative users and directory roles, with no exclusions, ensuring all administrators are protected by MFA.
  4. D
    Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS). Configure permanently active administrative role assignments in Microsoft Entra Privileged Identity Management (PIM) to prevent activation delays. Create a Conditional Access policy enforcing multi-factor authentication (MFA) and device compliance for administrative users, and explicitly exclude a dedicated emergency access account that does not require MFA.

Answer

The design strategy that uses Password Hash Synchronization (PHS), eligible PIM assignments, and a Conditional Access policy with an excluded emergency access account is correct.
The correct strategy combines Password Hash Synchronization (PHS) to ensure cloud authentication resilience during on-premises WAN outages, eligible PIM assignments to implement just-in-time administrative access, and a Conditional Access policy that enforces MFA and compliance for administrators while excluding a break-glass emergency account to prevent lockout.

Step-by-Step Solution

1
Select the hybrid authentication mechanism that provides the highest resilience during a local network outage.
Password Hash Synchronization (PHS) is selected over AD FS or Pass-through Authentication (PTA) because it performs authentication entirely in the cloud and does not rely on on-premises infrastructure availability.
This satisfies the requirement that users can authenticate to cloud services even during an on-premises WAN link outage.
2
Determine the PIM role assignment strategy for administrative governance.
Administrative roles must be configured as 'eligible' assignments in PIM.
This allows administrators to activate their roles on-demand (just-in-time), minimizing the attack surface and satisfying the governance requirements.
3
Design the Conditional Access policy to enforce security controls while maintaining emergency access resilience.
Create a Conditional Access policy requiring MFA and compliant devices, target it to administrative users, and configure an exclusion rule for a dedicated emergency access account.
The policy secures administrative roles during normal operations, while the excluded emergency access (break-glass) account ensures that administrators do not get locked out of the tenant in the event of an Azure MFA service failure.

Key Concept

Designing a resilient, secure hybrid identity architecture that balances administrative access control via Conditional Access and PIM with emergency lockout prevention.
Estimated Time:3m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access