Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

Vanguard Energy Services is designing an identity and access management solution for a new Microsoft Entra ID tenant. The tenant must synchronize with an on-premises Active Directory Domain Services (AD DS) environment.

The solution must meet the following business and technical requirements:
- User passwords must be validated directly in the cloud to minimize reliance on on-premises infrastructure.
- Leaked credentials published on the public internet must be automatically detected.
- Just-in-time administrative access must be enforced for administrative roles.
- Administrative access must be maintainable even during a tenant-wide multi-factor authentication (MFA) service outage.

Which identity and access design should the architect recommend?

  1. A
    Implement Password Hash Synchronization (PHS) and enable Microsoft Entra ID Protection. Configure Privileged Identity Management (PIM) with active role assignments for administrative users. Create a Conditional Access policy requiring MFA for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.
  2. Implement Password Hash Synchronization (PHS) and enable Microsoft Entra ID Protection. Configure Privileged Identity Management (PIM) with eligible role assignments for administrative users. Create a Conditional Access policy requiring MFA for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.Answer
  3. C
    Implement Password Hash Synchronization (PHS) and enable Microsoft Entra ID Protection. Configure Privileged Identity Management (PIM) with eligible role assignments for administrative users. Create a Conditional Access policy requiring MFA for all administrative roles, ensuring no accounts are excluded from the policy.
  4. D
    Deploy Active Directory Federation Services (AD FS) for user authentication. Configure Privileged Identity Management (PIM) with eligible role assignments for administrative users. Create a Conditional Access policy requiring MFA for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.

Answer

Implement Password Hash Synchronization (PHS), enable Microsoft Entra ID Protection, configure Privileged Identity Management (PIM) with eligible role assignments for administrative users, and create a Conditional Access policy requiring MFA that excludes a dedicated emergency access account with a permanently assigned Global Administrator role.
The correct recommendation is to implement Password Hash Synchronization (PHS) to satisfy cloud validation and leaked credential detection requirements, utilize eligible PIM role assignments to enforce just-in-time administrative access, and exclude a dedicated, permanently assigned emergency access account from the Conditional Access MFA policy to ensure recovery during service outages.

Step-by-Step Solution

1
Select the hybrid authentication method that supports cloud validation and threat detection.
Password Hash Synchronization (PHS) is selected.
PHS validates passwords directly in Microsoft Entra ID, eliminating dependencies on on-premises authentication infrastructure during sign-in. It is also the only synchronization method that natively allows Microsoft Entra ID Protection to analyze password hashes against leaked credential databases.
2
Configure the privileged access strategy.
Privileged Identity Management (PIM) with eligible role assignments is selected.
To satisfy just-in-time (JIT) access requirements, administrators must not have permanent standing privileges. Configuring their roles as eligible requires them to actively request and justify elevation when needed.
3
Establish emergency access and lockout resilience.
Excluding an emergency access account with a permanently assigned Global Administrator role from the Conditional Access MFA policy is selected.
During an MFA service outage or a PIM service disruption, administrators will be unable to elevate their roles or complete MFA challenges. A pre-created emergency account that bypasses MFA and has permanent, standing Global Administrator rights ensures tenant recovery capabilities.

Key Concept

Designing secure hybrid authentication, just-in-time privilege elevation, and emergency access resiliency using Microsoft Entra ID and Conditional Access.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access