Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Vanguard Global Shipping is designing an identity security and access strategy for its Microsoft Entra ID tenant. The tenant is synchronized with an on-premises Active Directory Domain Services (AD DS) domain.

The design must satisfy the following requirements:
- Minimize the on-premises infrastructure required for user authentication.
- Enforce Multi-Factor Authentication (MFA) for all users with privileged administrative roles.
- Ensure that administrators can access the tenant even if a misconfiguration or third-party service outage affects Entra ID MFA.

Which solution should you recommend to meet the requirements?

  1. Configure Password Hash Synchronization (PHS) as the hybrid identity authentication method, implement a Conditional Access policy requiring MFA for all administrative roles, and exclude a dedicated emergency access account from the policy.Answer
  2. B
    Configure Password Hash Synchronization (PHS) as the hybrid identity authentication method, and implement a Conditional Access policy requiring MFA for all administrative roles and accounts without any exclusions to guarantee maximum security.
  3. C
    Deploy Active Directory Federation Services (AD FS) on-premises to handle authentication and federated MFA, and implement a Conditional Access policy requiring MFA for all administrative roles while excluding a dedicated emergency access account.
  4. D
    Configure Password Hash Synchronization (PHS) as the hybrid identity authentication method, configure all administrative roles as permanently active assignments in Privileged Identity Management (PIM), and implement a Conditional Access policy requiring MFA for those roles.

Answer

Configure Password Hash Synchronization (PHS) as the hybrid identity authentication method, implement a Conditional Access policy requiring MFA for all administrative roles, and exclude a dedicated emergency access account from the policy.
The correct solution uses Password Hash Synchronization (PHS) to satisfy the requirement of minimizing on-premises infrastructure while maintaining authentication capabilities in the cloud. It secures privileged access by enforcing Multi-Factor Authentication (MFA) via a Conditional Access policy. Crucially, it excludes a dedicated emergency access account from this MFA policy, preventing the organization from being locked out of the tenant if there is a regional or global outage affecting Entra ID MFA services.

Step-by-Step Solution

1
Evaluate the hybrid identity authentication method that minimizes on-premises infrastructure.
Select Password Hash Synchronization (PHS) as it requires minimal infrastructure compared to Active Directory Federation Services (AD FS).
AD FS requires deploying and maintaining federation servers, proxy servers, and certificates, which increases infrastructure and administrative overhead, whereas PHS performs authentication directly in the cloud.
2
Design the Conditional Access policies to secure administrative access while preventing lockout.
Enforce MFA for all admin roles using a Conditional Access policy, and explicitly exclude a dedicated emergency access account.
Excluding a dedicated emergency access account (break-glass account) is a Microsoft best practice to ensure access is maintained during service outages or policy misconfigurations.
3
Validate the governance configuration for administrative access.
Avoid permanently active administrative assignments in Privileged Identity Management (PIM).
Roles should be configured as eligible rather than permanently active to enforce just-in-time access and reduce the attack surface.

Key Concept

Microsoft Entra ID Authentication and Conditional Access
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access