Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

An organization is designing a security and identity infrastructure solution using Microsoft Entra ID. Match each organization's technical or security requirement to the most appropriate Microsoft Entra ID authentication method or Conditional Access feature.

  • A manufacturing company needs a hybrid identity solution that minimizes on-premises infrastructure and ensures users can authenticate to cloud services even during an on-premises network outage.Microsoft Entra Password Hash Synchronization (PHS)
  • A financial services firm must ensure that remote employees using unmanaged personal devices can access web-based email but are blocked from downloading attachments.Conditional Access session controls with App Enforced Restrictions
  • A regulated utility provider requires that all user password validations occur directly against their local Active Directory domain controllers in real-time to immediately honor disabled accounts.Microsoft Entra Pass-through Authentication (PTA)
  • A technology startup wants to block sign-in attempts to the Azure portal if they originate from anonymous IP addresses or exhibit anomalous travel patterns.Conditional Access risk-based policies using Sign-in Risk

Answer

Matching pairs: Left Item 1 to Password Hash Synchronization (PHS); Left Item 2 to Conditional Access session controls with App Enforced Restrictions; Left Item 3 to Pass-through Authentication (PTA); Left Item 4 to Conditional Access risk-based policies using Sign-in Risk.
The correct pairings map the hybrid authentication methods (PHS and PTA) to their correct operational requirements (PHS for offline capability, PTA for real-time local AD validation), and map the Conditional Access features to their correct use cases (App Enforced Restrictions for web-only limiting on personal devices, and Sign-in Risk for blocking anomalous connection events).

Step-by-Step Solution

1
Analyze Left Item 1 (manufacturing company). The key requirement is resilience to on-premises network outages and minimal on-premises infrastructure.
This requires Password Hash Synchronization (PHS) because it is the only hybrid option that performs authentication entirely in the cloud, removing dependency on on-premises domain controllers and network paths.
PTA and Active Directory Federation Services (AD FS) require live connections to on-premises resources to complete authentications, making them vulnerable to local outages.
2
Analyze Left Item 2 (financial services firm). The requirement is to restrict user actions (blocking downloads) within application sessions based on device compliance state.
This matches Conditional Access session controls using App Enforced Restrictions.
Standard grant controls only block or allow access, whereas session controls allow fine-grained access limits like blocking downloads or copy-paste on unmanaged devices.
3
Analyze Left Item 3 (utility provider). The requirements are real-time validation against local domain controllers to immediately honor account disable status, without hosting password hashes in Microsoft Entra ID.
This points to Pass-through Authentication (PTA).
PTA validates passwords directly against on-premises Active Directory in real-time. Unlike PHS, it does not require password hashes to be kept in the cloud, and unlike AD FS, it does not require complex federation infrastructure.
4
Analyze Left Item 4 (technology startup). The requirement is to evaluate anomalous behavior associated with the login event itself (such as impossible travel or anonymous IPs).
This matches Conditional Access risk-based policies targeting Sign-in Risk.
Sign-in Risk represents the probability that a specific sign-in request is compromised (e.g., anonymous IP, impossible travel), whereas User Risk represents the probability that the identity itself is compromised (e.g., leaked credentials).

Key Concept

Selecting and configuring hybrid authentication methods (PHS vs. PTA) and designing Conditional Access policies using session controls and risk-based conditions.
Estimated Time:3m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access