Examkin

All practice questions

65 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 1Question →

An enterprise architect is designing an identity and access management strategy for a multinational corporation. The strategy must incorporate Microsoft Entra ID hybrid authentication, identity protection, and granular access controls. Match each corporate security and technical requirement on the left to the most appropriate Microsoft Entra ID or Conditional Access feature on the right that satisfies the requirement.

Click a left item, then click its matching right item

Items

Authenticate users against on-premises Active Directory Domain Services (AD DS) without synchronizing password hashes or credentials to the cloud, and without deploying federated servers.
Enforce phishing-resistant multi-factor authentication (MFA) exclusively when accessing sensitive financial applications, while permitting standard push notifications for other cloud services.
Automatically require users to change their password using Self-Service Password Reset (SSPR) when their credentials are found to be compromised and leaked on public networks.
Allow external partner users to access internal resources only if their devices are marked as compliant within their home tenant, trusting the compliance state across directories.

Matches

Show answer & explanation

Answer

Match 'Authenticate users against on-premises Active Directory Domain Services (AD DS) without synchronizing password hashes...' to 'Microsoft Entra Pass-through Authentication (PTA)'; match 'Enforce phishing-resistant multi-factor authentication (MFA) exclusively...' to 'Conditional Access Authentication Strengths'; match 'Automatically require users to change their password...' to 'Microsoft Entra ID Protection User Risk Policy'; match 'Allow external partner users to access internal resources...' to 'Microsoft Entra External ID Cross-Tenant Access Settings'.
Pass-through Authentication (PTA) allows secure, on-premises credential validation without cloud password synchronization or ADFS. Conditional Access Authentication Strengths allow defining specific MFA methods like phishing-resistant authentication. Microsoft Entra ID Protection User Risk Policies handle long-term risks like leaked credentials and require password change remediation. Cross-Tenant Access Settings let resource tenants trust compliant devices managed by external Entra tenants.

Step-by-Step Solution

1
Analyze the authentication requirement that forbids credential sync and federated servers.
Identify that Password Hash Synchronization (PHS) syncs hashes and Active Directory Federation Services (AD FS) is a federated server infrastructure. Pass-through Authentication (PTA) fulfills the exact criteria by validating passwords against on-premises AD DS using a local agent.
To design the appropriate hybrid identity integration without storing credentials in the cloud or deploying federated infrastructure.
2
Determine the mechanism to enforce phishing-resistant MFA for specific applications.
Recall that Conditional Access authentication strengths allow policy enforcement of specific MFA methods (like FIDO2 security keys) per application, rather than applying a global or coarse MFA policy.
To enforce granular, application-specific authentication requirements.
3
Evaluate the remediation strategy for compromised/leaked credentials.
Identify leaked credentials as a user-level risk. A Microsoft Entra ID Protection User Risk Policy can detect this and trigger a secure password change through Self-Service Password Reset (SSPR) to transition the user back to a low-risk state.
To secure compromised accounts using automated risk-based policies.
4
Assess how to trust device compliance states from partner tenants.
Select cross-tenant access settings, which permit inbound trust configuration for external tenant multi-factor authentication and compliant devices.
To enable secure external collaboration without requiring partner devices to enroll in the local Intune tenant.

Key Concept

Microsoft Entra ID hybrid identity integration, advanced Conditional Access policies, risk-based access, and cross-tenant resource governance.
Estimated Time:3m 0s
Question 2Question →

You are designing an Azure migration strategy for several legacy databases. Match each workload scenario on the left with the correct Azure Cosmos DB API on the right to ensure the migration requires minimal application refactoring while meeting performance and architectural requirements.

Click a left item, then click its matching right item

Items

A telemetry ingestion application that processes high-frequency time-series data from IoT devices. The legacy database uses a wide-column storage model, and developers query it using CQL-based scripts that must be preserved.
A fraud-detection application that analyzes relationships between financial transactions, user accounts, and device fingerprints to find suspicious circular paths. The application requires complex multi-hop query traversals using vertices and edges.
An e-commerce product catalog that is being migrated from an on-premises database. It stores documents in BSON format, relies on nested arrays, and utilizes existing application drivers that communicate over port 27017.
A globally distributed user session state store that currently utilizes Azure Table Storage. The business requires migrating to a database that guarantees sub-10ms read and write latencies with a 99.999% availability SLA and dedicated throughput.

Matches

Show answer & explanation

Answer

Match the wide-column CQL telemetry application to Azure Cosmos DB for Apache Cassandra; match the graph-based fraud-detection application to Azure Cosmos DB for Apache Gremlin; match the BSON-based product catalog to Azure Cosmos DB for MongoDB; and match the low-latency Table Storage workload to Azure Cosmos DB for Table.
Matching each legacy system to its corresponding wire-compatible Azure Cosmos DB API allows developers to preserve client-side code, drivers, and query structures while gaining the benefits of a fully managed cloud database.

Step-by-Step Solution

1
Analyze the technical requirements of the first scenario (CQL and wide-column).
Identify that the Cassandra Query Language (CQL) and wide-column store map directly to the Cassandra API.
This minimizes development effort by allowing the reuse of existing Cassandra drivers and queries.
2
Analyze the technical requirements of the second scenario (vertices, edges, multi-hop traversals).
Identify that a property graph model utilizing TinkerPop/Gremlin maps directly to the Gremlin API.
Graph databases are optimized for traversing relationships between entities.
3
Analyze the technical requirements of the third scenario (BSON, port 27017, nested arrays).
Identify that these details describe MongoDB database communications, which map to the MongoDB API.
Cosmos DB for MongoDB supports the MongoDB wire protocol, allowing applications to connect using standard MongoDB client drivers.
4
Analyze the technical requirements of the fourth scenario (Azure Table Storage migration with sub-10ms latency and 99.999% SLA).
Identify that the Table API provides a drop-in replacement for Table Storage with premium performance guarantees.
Azure Cosmos DB for Table offers turnkey global distribution, dedicated throughput, and single-digit millisecond latency SLAs compared to standard Azure Table Storage.

Key Concept

Selecting the appropriate Azure Cosmos DB API based on legacy database systems, query APIs, protocols, and performance requirements.
Question 3Question →

You are designing an identity solution for an organization. Match each business and technical requirement to the most appropriate Microsoft Entra ID hybrid or multi-tenant identity technology.

Click a left item, then click its matching right item

Items

Authenticate users on-premises using a local agent, ensuring that no password hashes are stored in the cloud.
Synchronize user accounts and their password hashes to the cloud to enable cloud-based authentication and offline resilience.
Enable external business partners to access corporate applications using their own corporate credentials.
Automatically provision and manage user accounts across multiple Microsoft Entra ID tenants within the same organization.

Matches

Show answer & explanation

Answer

The requirement for on-premises validation without cloud password hashes matches Pass-Through Authentication (PTA). The requirement for cloud-based authentication with offline resilience matches Password Hash Synchronization (PHS). The requirement for external partner access matches Microsoft Entra B2B collaboration. The requirement for automated multi-tenant user provisioning matches Cross-tenant synchronization.
The correct pairings align each scenario with its primary technical match: Pass-Through Authentication (PTA) validates credentials locally without storing hashes; Password Hash Synchronization (PHS) copies password hashes to Microsoft Entra ID to support offline cloud authentication; Microsoft Entra B2B collaboration allows external business partners to log in using their own credentials; and Cross-tenant synchronization automates user provisioning and lifecycle management across different Entra ID tenants in the same organization.

Step-by-Step Solution

1
Analyze the on-premises security policy requirement: no cloud password hashes and authentication via local agents.
Identify Pass-Through Authentication (PTA) as the solution because it forwards password validation requests to local agents.
PTA satisfies the constraint of not storing hashes in the cloud while retaining local control.
2
Analyze the business continuity requirement: authenticate in the cloud during on-premises outages.
Identify Password Hash Synchronization (PHS) as the solution because it stores password hashes in Microsoft Entra ID, enabling independent cloud authentication.
PHS allows authentication to succeed even if the on-premises domain controllers or agents are offline.
3
Analyze the external sharing requirement: allow business partners to log in with their own identities.
Identify Microsoft Entra B2B collaboration as the feature designed for external user access.
B2B collaboration enables guest users to use their corporate or social identities.
4
Analyze the multi-tenant automation requirement: automate provisioning across tenants inside the same organization.
Identify Cross-tenant synchronization as the direct service for synchronizing users across tenants.
Cross-tenant synchronization automates lifecycle management of B2B users across organization-owned tenants.

Key Concept

Azure Hybrid and Multi-Tenant Identity Integration Options
Question 4Question →

A conglomerate has an on-premises Active Directory Domain Services (AD DS) forest and three Microsoft Entra ID tenants. You are designing a hybrid and multi-tenant identity solution that must satisfy constraints regarding hybrid synchronization footprints, external collaboration types, self-service governance, and multi-tenant synchronization. Match each business and technical requirement to the most appropriate Microsoft Entra ID technology.

Click a left item, then click its matching right item

Items

Sync users from an isolated on-premises forest with no direct network connectivity to the primary sync server, while supporting password hash sync for authentication continuity.
Enable users from a sister company's Entra tenant to collaborate in Microsoft Teams shared channels without generating guest user accounts.
Provide external vendors access to internal line-of-business apps using guest accounts that support identity governance access reviews.
Provision and update internal user objects across all three Microsoft Entra tenants to build a unified global address list.

Matches

Show answer & explanation

Answer

Syncing from a disconnected forest matches Microsoft Entra Connect cloud sync; collaborating in Teams shared channels without guest accounts matches Microsoft Entra B2B direct connect; providing partner access to web applications with guest management matches Microsoft Entra B2B collaboration; and automating internal sync across multiple corporate tenants matches Cross-tenant synchronization.
The correct matches map each business scenario to the precise Entra capability: cloud sync is the lightweight option for isolated forests; B2B direct connect allows direct Teams channel sharing without guest objects; B2B collaboration provides guest-based application governance; and cross-tenant sync replicates internal users across cloud tenants.

Step-by-Step Solution

1
Analyze the isolated on-premises forest sync requirement with minimal infrastructure footprint.
Identify Microsoft Entra Connect cloud sync as the optimal lightweight sync method that routes through the cloud.
Cloud sync is suited for scenarios like mergers where networks are separated and minimal local footprint is desired.
2
Evaluate Teams shared channels collaboration requirements that must avoid guest account overhead.
Identify Microsoft Entra B2B direct connect.
Direct connect is designed for real-time collaboration where users authenticate in their home directory, bypassing guest account creation entirely.
3
Examine external web application access that requires full identity lifecycle governance.
Identify Microsoft Entra B2B collaboration.
B2B collaboration creates guest accounts that are fully compatible with access reviews and typical application assignments.
4
Determine the synchronization mechanism for internal users across multiple managed Microsoft Entra tenants.
Identify Cross-tenant synchronization.
Cross-tenant synchronization enables automatic user provisioning between different Entra tenants in a multi-tenant organization.

Key Concept

Selecting hybrid and multi-tenant identity technologies based on connection, security, and lifecycle requirements.
Estimated Time:3m 0s
Question 5Question →

You are designing a monitoring and log routing solution for an enterprise Azure environment. Match each log ingestion or routing requirement to its most appropriate Azure Monitor destination or configuration component.

Click a left item, then click its matching right item

Items

Diagnostic logs of an Azure Key Vault that must be ingested into a non-Azure SIEM system in near real-time.
Platform metrics and logs of virtual machines across multiple subscriptions that need to be analyzed using Kusto Query Language (KQL).
Azure subscription Activity Logs that must be retained for 5 years to meet regulatory compliance at the lowest possible cost.
Custom application logs from on-premises servers that need to be ingested into Azure Monitor without deploying local agents on the virtual machines.

Matches

Show answer & explanation

Answer

Key Vault logs to SIEM match with Azure Event Hubs; VM platform metrics and logs match with Centralized Log Analytics Workspace; Subscription Activity Logs for 5-year retention match with Azure Storage Account; Custom agentless on-premises logs match with Data Collection Endpoint and Logs Ingestion API.
The correct pairings align each workload's technical and financial constraints to the exact Azure Monitor feature designed for that purpose: Event Hubs for real-time SIEM integration, Log Analytics for active KQL query support, Storage Accounts for low-cost archive, and the Logs Ingestion API with a Data Collection Endpoint for custom agentless data submission.

Step-by-Step Solution

1
Evaluate the real-time third-party SIEM log delivery requirement.
Identify Azure Event Hubs as the message queueing mechanism that interfaces with external security tools.
SIEM systems require a low-latency push stream, which Event Hubs provides.
2
Determine the query requirements for VM logs across multiple subscriptions.
Select a centralized Log Analytics Workspace to store and analyze logs.
KQL queries and dashboards require logs to be stored in a queryable analytics engine.
3
Assess the long-term retention requirement under strict cost-minimization constraints.
Route Activity Logs to an Azure Storage Account.
Storage accounts offer the cheapest tier of storage for compliance logs that do not need to be queried regularly.
4
Analyze the custom, agentless ingestion requirement for on-premises systems.
Utilize a Data Collection Endpoint (DCE) and the Logs Ingestion API.
This setup allows secure log ingestion over HTTPS directly from code or custom integrations without a VM agent.

Key Concept

Selecting optimal Azure Monitor routing destinations and ingestion mechanisms based on cost, latency, query, and integration constraints.
Question 6Question →

Contoso Pharmaceuticals has an on-premises Active Directory Domain Services (AD DS) environment and multiple Microsoft Entra ID tenants. The company needs to design a hybrid and multi-tenant identity solution to satisfy various connectivity, security, and partnership requirements. Match each operational requirement to the most appropriate Microsoft Entra ID synchronization or collaboration feature.

Click a left item, then click its matching right item

Items

Synchronize user accounts from on-premises AD DS to Azure and allow sign-in even during local network outages, without using federation.
Validate user passwords against on-premises AD DS in real-time using lightweight local agents, ensuring passwords are never stored in the cloud in any form.
Automate the provisioning and lifecycle management of user accounts across multiple distinct Microsoft Entra ID tenants owned by the same parent organization.
Enable external contractors to authenticate using their existing corporate or consumer identity provider to access shared corporate resources.

Matches

Show answer & explanation

Answer

Password Hash Synchronization (PHS) matches the requirement to allow sign-in during local network outages without federation. Pass-through Authentication (PTA) matches the requirement to validate passwords against on-premises AD DS in real-time. Cross-tenant synchronization matches the requirement to automate user account management across distinct Microsoft Entra ID tenants. Microsoft Entra B2B collaboration matches the requirement to enable external contractors to authenticate using their existing identity providers.
The correct association maps each business requirement to its specific technical implementation. Password Hash Synchronization supports cloud-based authentication during local link failures. Pass-through Authentication ensures zero-cloud credential footprint by executing validation on-premises in real-time. Cross-tenant synchronization facilitates identity management across different corporate tenants. B2B collaboration enables external users to access internal resources using their native credentials.

Step-by-Step Solution

1
Analyze the requirement for local network outage resilience without federation.
Identify Password Hash Synchronization (PHS) as the feature that keeps credentials in the cloud and allows local outages to not affect cloud logins.
Cloud-only verification is resistant to on-premises link failures.
2
Analyze the requirement for real-time validation without storing password hashes in the cloud.
Identify Pass-through Authentication (PTA) as the feature using local agents for real-time check without cloud storage.
PTA routes the request to local domain controllers.
3
Analyze the requirement for automated provisioning across multiple internal Entra tenants.
Identify Cross-tenant synchronization as the service that automates lifecycle management of internal multi-tenant users.
Cross-tenant synchronization provides automated CRUD operations across tenants.
4
Analyze the requirement for external contractor access using their own identity provider.
Identify Microsoft Entra B2B collaboration as the mechanism for external partner access.
B2B collaboration relies on external identity providers to validate user identity.

Key Concept

Selecting appropriate synchronization and collaboration technologies based on organizational requirements, security constraints, and network topology.
Question 7Question →

Solas Renewable Solutions is designing a hybrid and multi-tenant identity solution to support its growing infrastructure. The company has an on-premises Active Directory Domain Services (AD DS) forest and has recently acquired a subsidiary with its own Microsoft Entra ID tenant.

Solas has the following identity and access management requirements:
- Ensure that users from the corporate office can sign in to Microsoft Entra ID services even if the on-premises datacenter goes offline.
- Enable automatic account lifecycle management and Global Address List (GAL) visibility for users from the acquired subsidiary's tenant.
- Allow external suppliers to securely access internal resources using their existing corporate credentials.
- Ensure that certain security-sensitive on-premises users have their login credentials validated in real-time against on-premises domain controllers, without storing password hashes in the cloud.

You need to recommend the appropriate identity technology for each requirement.

Match the identity requirements on the left with the correct Microsoft Entra feature or configuration on the right.

Click a left item, then click its matching right item

Items

On-premises users must sign in to Microsoft Entra ID using their on-premises passwords. The authentication must be processed entirely in the cloud to ensure sign-in availability during an on-premises network outage.
External partners must access corporate line-of-business applications. They must use their own corporate or social identities, and Solas must not manage their password resets or lifecycles.
A newly acquired business unit with its own Microsoft Entra ID tenant must have its user accounts automatically provisioned and updated in the Solas corporate tenant to facilitate search in the global address list.
User authentication requests must be validated in real-time against the on-premises Active Directory Domain Services (AD DS) using lightweight agents, without storing password hashes in the cloud.

Matches

Show answer & explanation

Answer

Match the requirements as follows: cloud-resilient sign-in matches Password Hash Synchronization; automated tenant provisioning matches Cross-tenant synchronization; external contractor access matches Microsoft Entra B2B collaboration; real-time on-premises validation without cloud hashes matches Pass-through Authentication.
Matching cloud-resilient sign-in to Password Hash Synchronization (PHS) ensures authentication is processed entirely in the cloud. Matching automated tenant provisioning to Cross-tenant synchronization automates user creation between Microsoft Entra ID tenants. Matching external contractor access to Microsoft Entra B2B collaboration leverages external identities, and matching real-time local verification to Pass-through Authentication (PTA) prevents password hashes from being stored in the cloud.

Step-by-Step Solution

1
Analyze the requirement for on-premises user sign-in that remains functional during on-premises outages.
Password Hash Synchronization (PHS) is selected.
PHS copies password hashes to Microsoft Entra ID, allowing authentication to occur completely in the cloud, independent of on-premises connectivity.
2
Analyze the requirement to automate provisioning and Global Address List visibility between the corporate tenant and the acquired subsidiary's tenant.
Cross-tenant synchronization is selected.
Cross-tenant synchronization automates the creation, management, and deletion of B2B users between distinct Microsoft Entra ID tenants within the same organization.
3
Analyze the requirement to allow external suppliers to access internal resources using their own corporate credentials.
Microsoft Entra B2B collaboration is selected.
B2B collaboration allows external partners to access corporate apps while managing their own credentials, offloading management from Solas.
4
Analyze the requirement for real-time validation against on-premises domain controllers without storing password hashes in the cloud.
Pass-through Authentication (PTA) is selected.
PTA validates credentials in real-time using lightweight on-premises agents, meaning no password hashes are stored in the cloud.

Key Concept

Selecting appropriate Microsoft Entra hybrid and multi-tenant authentication and collaboration features based on organization resiliency, security, and governance requirements.
Question 8Question →

An enterprise is designing a centralized monitoring and log routing architecture for their Azure workloads. The architecture must satisfy specific storage, analytics, and cost requirements. Match each log source and business requirement on the left to its correct Azure destination or configuration on the right.

Click a left item, then click its matching right item

Items

OS-level syslog and performance data from Azure Virtual Machines where specific events must be filtered at the source to minimize workspace ingestion costs.
Azure subscription-level resource management actions that must be archived for 5 years for audit compliance at the lowest storage cost.
Near-real-time resource diagnostic logs that must be immediately streamed to an external, non-Azure Security Information and Event Management (SIEM) system.
Virtual Network traffic flows that must be analyzed to identify traffic patterns, security anomalies, and bandwidth hotspots.

Matches

Show answer & explanation

Answer

OS-level syslog with source filtering matches Azure Monitor Agent with Data Collection Rules; subscription-level activity logs for 5-year archive match Azure Storage account with lifecycle management; near-real-time external SIEM integration matches Azure Event Hubs; and virtual network traffic analysis matches Log Analytics with Traffic Analytics enabled.
The correct pairings map the requirements to the respective Azure monitoring features that best satisfy the specified constraints: DCRs for source filtering, Storage accounts for low-cost archival, Event Hubs for real-time external streaming, and Traffic Analytics for deep network flow insights.

Step-by-Step Solution

1
Analyze VM OS log collection options.
Identify that the Azure Monitor Agent (AMA) combined with Data Collection Rules (DCRs) allows filtering logs at the source, preventing unnecessary ingestion overhead.
Source-side filtering is key to minimizing costs when collecting VM syslog and performance counters.
2
Evaluate long-term compliance storage costs.
Select Azure Storage account with lifecycle management policies.
Log Analytics is cost-prohibitive for simple 5-year archival. Storage accounts provide the cheapest raw storage, and lifecycle policies automate cleanup.
3
Identify the destination for real-time external integration.
Select Azure Event Hubs.
Event Hubs acts as the ingestion broker for external SIEMs to consume Azure diagnostic telemetry in near-real-time.
4
Select the correct network monitoring tool for flow analysis.
Select Traffic Analytics (Network Watcher) routing to a Log Analytics workspace.
Traffic Analytics is specifically designed to analyze NSG flow logs in a Log Analytics workspace to identify security risks and traffic bottlenecks.

Key Concept

Azure Monitor Log Routing Architecture
Estimated Time:2m 0s
Question 9Question →

You are designing the identity security strategy for a Microsoft Entra ID tenant. You need to map specific identity requirements to their correct Microsoft Entra ID configurations. Match each Microsoft Entra ID feature to its correct primary function.

Click a left item, then click its matching right item

Items

Security defaults
Named locations
Authentication strength
Emergency access accounts

Matches

Show answer & explanation

Answer

Security defaults match with providing pre-configured security settings. Named locations match with defining trusted IP ranges or geographic areas. Authentication strength matches with specifying the specific combination of authentication methods. Emergency access accounts match with highly privileged accounts excluded from policies to prevent lockout.
Matching the features to their correct functions aligns each tool with its primary purpose: Security defaults for a basic out-of-the-box baseline; Named locations for network-based policy boundaries; Authentication strength for enforcing specific multi-factor methods; and Emergency access accounts as a fallback to prevent total tenant lockout.

Step-by-Step Solution

1
Analyze the role of Security defaults.
Identified that Security defaults provide standard, pre-configured security settings (like MFA requirements) out-of-the-box, which aligns with the description of providing basic security without custom policies.
Security defaults are designed for organizations looking for a basic security baseline without the complexity of managing custom Conditional Access policies.
2
Analyze the role of Named locations.
Identified that Named locations allow defining IP address ranges and geographical regions to be used within Conditional Access conditions.
This configuration is explicitly used to define network boundaries or locations for policy evaluation.
3
Analyze the role of Authentication strength.
Identified that Authentication strength enforces specific multi-factor authentication methods (like phishing-resistant keys) during Conditional Access evaluation.
It acts as a grant control determining the quality of the authentication method required.
4
Analyze the role of Emergency access accounts.
Identified that Emergency access accounts are dedicated administrative accounts excluded from policies to avoid complete lockout.
Excluding these accounts from Conditional Access policies ensures that administrators can regain access to the tenant if a misconfiguration or outage occurs.

Key Concept

Microsoft Entra ID features for securing authentication and tenant access management, including basic defaults, location-based conditions, authentication methods verification, and emergency recovery options.
Estimated Time:2m 0s
Question 10Question →

You are designing a hybrid and multi-tenant identity solution for an organization that has an on-premises Active Directory Domain Services (AD DS) forest and a Microsoft Entra ID tenant. Match each technical requirement on the left to the correct identity technology or configuration on the right. Each technology or configuration may be used once, more than once, or not at all.

Click a left item, then click its matching right item

Items

Validate hybrid user passwords in the cloud while enabling the detection of compromised credentials on the public internet.
Validate hybrid user passwords by routing requests directly to on-premises domain controllers via lightweight agents.
Enable users from an external partner organization to collaborate inside a Microsoft Teams shared channel without creating guest accounts in your tenant.
Allow guest users in your tenant to satisfy Multi-Factor Authentication (MFA) requirements using their home tenant's MFA verification.

Matches

Show answer & explanation

Answer

Validate hybrid user passwords in the cloud matches Password Hash Synchronization (PHS). Validate hybrid user passwords via lightweight agents matches Pass-through Authentication (PTA). Collaborate in a Microsoft Teams shared channel without creating guest accounts matches Microsoft Entra B2B Direct Connect. Allow guest users to satisfy MFA using their home tenant's verification matches Cross-tenant access settings trust settings.
Password Hash Synchronization (PHS) is the correct choice for validating hybrid user passwords in the cloud and enabling leaked credential detection. Pass-through Authentication (PTA) is correct for validating credentials against on-premises Active Directory domain controllers using lightweight agents. Microsoft Entra B2B Direct Connect is correct for enabling external users to collaborate in Teams shared channels without creating guest accounts. Cross-tenant access settings trust settings is correct for allowing guest users to bypass local MFA prompts by trusting their home tenant's MFA validation.

Step-by-Step Solution

1
Analyze the requirement to validate hybrid passwords in the cloud while enabling leaked credential detection.
Determine that Password Hash Synchronization (PHS) is required because it is the only sync method that replicates password hashes to Microsoft Entra ID, which is necessary for Entra ID Protection to run leaked credential checks.
PHS copies password hashes to Microsoft Entra ID, facilitating both authentication in the cloud and security analysis for leaked credentials.
2
Analyze the requirement to validate passwords directly against on-premises domain controllers using agents.
Determine that Pass-through Authentication (PTA) is required.
PTA validates credentials on-premises using local agents, ensuring that password validation occurs on-premises without replicating password hashes if desired, while avoiding full AD FS deployments.
3
Analyze the requirement to enable external collaboration inside Microsoft Teams shared channels without guest accounts.
Determine that Microsoft Entra B2B Direct Connect is required.
B2B Direct Connect establishes a direct link between organizations, enabling seamless access to shared channels without guest account clutter.
4
Analyze the requirement to trust the home tenant's MFA verification for guest users.
Identify cross-tenant access settings trust settings.
Trusting MFA settings within the cross-tenant access configuration allows external organizations' MFA validations to satisfy local host tenant conditions.

Key Concept

Selecting the correct hybrid synchronization methods and cross-tenant collaboration mechanisms based on organizational requirements.
Estimated Time:2m 0s
Question 11Question →

An enterprise is designing a monitoring and log routing architecture for its Azure workloads to meet various operational and compliance requirements. Match each logging scenario to the most appropriate Azure Monitor routing configuration.

Click a left item, then click its matching right item

Items

Collect guest OS performance metrics and system logs from on-premises and Azure virtual machines for correlation using KQL.
Stream HTTP access logs from an Azure App Service instance to an external, third-party Security Information and Event Management (SIEM) system with minimal latency.
Store Azure SQL Database diagnostic telemetry for a mandatory 5-year compliance audit at the lowest possible storage cost.
Consolidate and search Microsoft Entra ID sign-in activity and directory audit logs across the entire directory tenant.

Matches

Show answer & explanation

Answer

Match guest OS metrics to Azure Monitor Agent and DCRs; stream App Service HTTP logs to Azure Event Hubs; store SQL Database logs in Azure Storage with lifecycle management; and consolidate Microsoft Entra ID logs via tenant-level Diagnostic Settings.
Matching guest OS logs to the Azure Monitor Agent and DCRs ensures proper agent-based telemetry collection. Streaming App Service HTTP logs to an Event Hub satisfies real-time SIEM ingestion. Archiving SQL Database logs in an Azure Storage account with lifecycle policies minimizes costs for 5-year retention. Consolidating Microsoft Entra ID logs requires tenant-level diagnostic settings to span across the entire tenant directory.

Step-by-Step Solution

1
Identify the source of the logs (guest OS level vs platform level vs tenant level) and the target destination requirements (interactive queries vs low-cost archiving vs real-time external ingestion).
Categorize the four requirements: VM guest OS needs agent collection; SIEM requires real-time streaming; compliance audit needs low-cost long-term retention; Entra ID needs tenant-scope collection.
Correctly classifying log scopes ensures you choose the appropriate diagnostic setting level and target endpoint.
2
Match VM guest collection to its specific tool.
The Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) is the designated mechanism for VM guest OS logs and metrics targeting a Log Analytics workspace.
Diagnostic settings only collect host-level metrics for virtual machines, whereas guest-level logs require the agent.
3
Match real-time external SIEM integration to the appropriate streaming component.
Azure Event Hubs acts as the real-time event pipeline for routing logs to third-party SIEM tools.
Log Analytics and Storage accounts are not designed for direct real-time push streaming to external non-Azure SIEM systems.
4
Match long-term compliance storage to the most cost-effective option.
Azure Storage accounts with lifecycle management policies provide the lowest cost for long-term retention (e.g., 5 years) compared to Log Analytics workspaces.
Log Analytics has higher ingestion and retention costs, making Storage accounts the preferred choice for compliance archiving.
5
Match tenant-level logs to their appropriate diagnostic scope.
Microsoft Entra ID logs are tenant-level resources and require tenant-level diagnostic settings to be sent to a Log Analytics workspace.
Subscription-level diagnostic settings do not capture tenant-wide directory audit or sign-in logs.

Key Concept

Selecting appropriate Azure log routing mechanisms based on log scope (guest, platform, tenant) and operational targets (KQL analysis, low-cost archive, real-time SIEM streaming).
Estimated Time:3m 0s
Question 12Question →

An enterprise is designing a comprehensive monitoring and log routing architecture for various workloads across Azure subscriptions. You need to match the administrative and operational requirements with the most appropriate Azure Monitor destination or feature to minimize costs and administrative overhead.

Match the requirements on the left to their corresponding destinations or features on the right.

Click a left item, then click its matching right item

Items

Retain application diagnostic logs for seven years to meet regulatory compliance while minimizing storage costs.
Collect, correlate, and run complex Kusto Query Language (KQL) queries on resource telemetry across multiple subscriptions.
Stream Azure resource logs in near-real-time to an external third-party Security Information and Event Management (SIEM) system.
Monitor IP traffic patterns, identify traffic hotspots, and analyze security group rule hits for virtual networks.

Matches

Show answer & explanation

Answer

The correct matches are: (1) Retaining logs for seven years to minimize costs matches Azure Storage account; (2) Running KQL queries and correlating telemetry matches Azure Monitor Log Analytics workspace; (3) Streaming logs to an external SIEM matches Azure Event Hubs; (4) Monitoring IP traffic patterns and NSG rules matches Azure Network Watcher Traffic Analytics.
Each requirement maps to a specific destination in Azure Monitor: Azure Storage accounts provide low-cost long-term archiving; Log Analytics workspaces enable centralized KQL querying; Azure Event Hubs provides near-real-time integration with external SIEMs; and Traffic Analytics processes NSG flow logs to analyze network traffic patterns.

Step-by-Step Solution

1
Analyze the log retention and cost requirement.
Identify that seven-year retention requires cold storage to minimize costs. Azure Storage accounts with lifecycle management are the most cost-effective choice for long-term archiving.
Log Analytics workspaces charge significant fees for data retention beyond the default period, whereas Azure Storage Archive tier is highly cost-effective.
2
Analyze the correlation and query requirement.
Identify that running Kusto Query Language (KQL) queries across subscriptions requires a centralized repository.
Azure Monitor Log Analytics workspace provides the KQL engine and native cross-workspace or cross-subscription querying capabilities.
3
Analyze the integration requirement for external SIEM.
Identify the mechanism for streaming logs in near-real-time to third-party endpoints.
Azure Event Hubs serves as the event ingestor and message bus used to route diagnostic logs to external systems like Splunk or QRadar.
4
Analyze the network security and flow logging requirement.
Identify the tool that visualizes and analyzes NSG flow logs.
Azure Network Watcher Traffic Analytics uses NSG flow logs to provide dashboard visualizations of traffic patterns and security rule behaviors.

Key Concept

Matching Azure log sources and regulatory requirements to the correct Azure Monitor diagnostic destinations.
Estimated Time:2m 0s
Question 13Question →

An organization is designing a hybrid identity architecture to connect their on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID. How should you match each security or authentication requirement to the correct Microsoft Entra ID authentication or Conditional Access feature?

Click a left item, then click its matching right item

Items

Require multi-factor authentication (MFA) when users access cloud applications from outside the corporate office network.
Validate user credentials against the on-premises Active Directory using a lightweight local agent, without storing password hashes in the cloud.
Verify user identity in the cloud by comparing credential hashes against synchronized password hashes stored in Microsoft Entra ID.

Matches

Show answer & explanation

Answer

Require MFA outside corporate network matches Conditional Access policy with location and grant controls; Validate credentials on-premises without cloud hashes matches Pass-through Authentication (PTA); Verify identity with synchronized cloud hashes matches Password Hash Synchronization (PHS).
Conditional Access policies evaluate network location signals and enforce MFA grant controls. Pass-through Authentication (PTA) routes credential checks directly to on-premises AD via local agents without storing cloud hashes. Password Hash Synchronization (PHS) synchronizes user password hashes to enable cloud-native authentication.

Step-by-Step Solution

1
Analyze the first requirement: requiring MFA when users connect from outside the corporate network.
This requires checking the user's location (network signal) and enforcing an access control (MFA), which is a key capability of Conditional Access policies.
Conditional Access evaluates signals like location to enforce organization policies.
2
Analyze the second requirement: validating credentials against on-premises Active Directory using a lightweight local agent without storing hashes in the cloud.
This aligns with Pass-through Authentication (PTA), which forwards the authentication request to an on-premises agent.
PTA keeps credentials validation on-premises and does not store user passwords or hashes in the cloud.
3
Analyze the third requirement: verifying user identity in the cloud using synchronized password hashes.
This aligns with Password Hash Synchronization (PHS), which synchronizes a hash of the user's on-premises Active Directory password hash.
PHS allows authentication to occur directly in Microsoft Entra ID using stored hashes.

Key Concept

Microsoft Entra ID hybrid authentication and Conditional Access policy design
Question 14Question →

Apex Orion Logistics is designing a hybrid identity and multi-tenant access solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, apex-orion.internal (containing 8,400 users), with a new Microsoft Entra ID tenant. The design must satisfy the following constraints:
- Authentication: Users must log in to cloud resources using their on-premises credentials. Under normal conditions, password validation must occur on-premises, and passwords or password hashes must not be stored in the cloud.
- Business Continuity: The authentication solution must support an automated standby mechanism that allows cloud logins to succeed even if the on-premises domain controllers or network connections become completely unavailable.
- Self-Service: Hybrid users must be able to reset their own passwords using self-service password reset (SSPR) in the cloud, and the changes must immediately update the on-premises AD DS.
- External Collaboration: Users from partner organizations who use their own Microsoft Entra ID tenants must be able to access internal resources securely, governed by granular inbound and outbound trust policies.

Match each business or technical requirement of the Apex Orion Logistics hybrid architecture to the most appropriate Microsoft Entra ID feature.

Click a left item, then click its matching right item

Items

The primary authentication mechanism that validates credentials directly against on-premises domain controllers without storing passwords or password hashes in the cloud.
The secondary authentication mechanism configured as a standby backup to ensure users can log in to cloud resources if the on-premises infrastructure goes offline.
The synchronization feature required to write back password updates made via the Microsoft Entra ID self-service password reset (SSPR) portal to the on-premises AD DS.
The configuration used to define granular inbound and outbound trust policies for collaboration with partner Microsoft Entra ID tenants.

Matches

Show answer & explanation

Answer

The correct matches are: The primary authentication mechanism maps to Pass-Through Authentication (PTA); the standby backup authentication mechanism maps to Password Hash Synchronization (PHS); the SSPR writeback capability maps to Password Writeback; and the granular trust policy configuration maps to Cross-Tenant Access Settings.
The correct pairings match each requirement to the optimal hybrid feature: Pass-Through Authentication (PTA) validates passwords on-premises without cloud hash storage; Password Hash Synchronization (PHS) functions as a standby backup for high-availability; Password Writeback synchronizes cloud SSPR changes to on-premises AD DS; and Cross-Tenant Access Settings govern trust boundaries with partner tenants.

Step-by-Step Solution

1
Analyze the primary authentication constraint.
Since password validation must occur on-premises and hashes cannot be stored in the cloud under normal conditions, select Pass-Through Authentication (PTA) as the primary mechanism.
PTA routes authentication requests directly to on-premises agents without cloud storage of passwords or hashes.
2
Analyze the business continuity and failover requirements.
Select Password Hash Synchronization (PHS) as the standby backup.
PHS can be configured alongside PTA, allowing Microsoft Entra ID to fall back to cloud-based hash validation if on-premises agents or domain controllers become unavailable.
3
Analyze self-service and external collaboration constraints.
Select Password Writeback for SSPR synchronization, and Cross-Tenant Access Settings to define trust policies with partner tenants.
Password Writeback updates the local AD DS when users reset passwords in the cloud, while Cross-Tenant Access Settings control trust and access flow with external Entra ID tenants.

Key Concept

Designing a secure hybrid identity infrastructure with high-availability, self-service password capabilities, and multi-tenant access controls.
Question 15Question →

A financial services firm is designing its hybrid identity infrastructure using Microsoft Entra ID. The firm has an on-premises Active Directory Domain Services (AD DS) environment and requires a secure, resilient access management design. Which Microsoft Entra ID authentication methods and Conditional Access features should you select to meet each business and security requirement?

Click a left item, then click its matching right item

Items

Validate user authentication directly against on-premises Active Directory in real-time, ensuring that no password representations or hashes are stored in the cloud under any circumstances.
Ensure that users can authenticate to cloud resources using their domain credentials even during a complete WAN outage that isolates the on-premises domain controllers.
Require external consultants accessing a specific project portal to re-authenticate every 8 hours and enforce access only from devices registered as compliant in Microsoft Intune.
Enforce multi-factor authentication (MFA) only when Entra ID detects anomalous behavior associated with the specific sign-in attempt, such as access from an unfamiliar IP address.

Matches

Show answer & explanation

Answer

Validate on-premises in real-time matches Microsoft Entra Pass-through Authentication (PTA). Authenticate during WAN outage matches Microsoft Entra Password Hash Synchronization (PHS). Re-authenticate every 8 hours and compliant device matches Conditional Access session controls and grant controls. MFA on anomalous sign-in attempts matches Conditional Access sign-in risk policy.
Pass-through Authentication (PTA) routes user authentication requests directly to on-premises Active Directory domain controllers via local agents, keeping all password hashes out of Microsoft Entra ID. Password Hash Synchronization (PHS) syncs password hashes to the cloud, enabling cloud-based authentication even if the on-premises network or agents are down. Conditional Access session controls manage session lifetimes (like sign-in frequency), and grant controls enforce specific rules (like requiring compliant devices). Conditional Access sign-in risk policies detect session-specific anomalies, such as an unfamiliar IP address or location, during authentication.

Step-by-Step Solution

1
Analyze the real-time on-premises validation requirement.
Identify that Pass-through Authentication (PTA) passes the authentication request to local agents without storing any credentials in the cloud, fulfilling the zero-cloud-hash constraint.
To satisfy security policies that prohibit cloud storage of password hashes.
2
Evaluate the offline resilience requirement.
Identify that Password Hash Synchronization (PHS) synchronizes password hashes to the cloud, allowing Entra ID to authenticate users independently of the on-premises infrastructure status.
To ensure business continuity during an on-premises network or domain controller outage.
3
Determine the features needed for session limit and device compliance.
Determine that sign-in frequency (session controls) handles the 8-hour limit, and compliant device checks (grant controls) enforce the MDM requirement.
To combine session lifetime configuration with device-state verification using Conditional Access.
4
Assess the anomalous sign-in requirement.
Identify that sign-in risk policies evaluate anomalies for a specific authentication session (like atypical location), whereas user risk policies evaluate overall credential compromise likelihood.
To target session-specific anomalies dynamically during authentication.

Key Concept

Selecting hybrid authentication methods and designing Conditional Access policies based on security, availability, and session requirements.
Estimated Time:2m 30s
Question 16Question →

Obsidian Systems is designing a hybrid identity and multi-tenant collaboration solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, obsidian.local, with multiple Microsoft Entra ID tenants. The solution must adhere to strict authentication, provisioning, and business continuity requirements. Match each business requirement on the left to the most appropriate Microsoft Entra ID technology or configuration on the right.

Click a left item, then click its matching right item

Items

Evaluate on-premises account status and sign-in hours in real-time for cloud sign-ins without deploying Active Directory Federation Services (AD FS).
Provide cloud authentication that continues working during on-premises network outages with the least amount of infrastructure overhead.
Automate user account provisioning and lifecycle management across multiple distinct internal Microsoft Entra ID tenants.
Enable users from an external vendor using a non-Azure identity provider to authenticate using their own credentials without manual guest invitations.

Matches

Show answer & explanation

Answer

1 matches Pass-through Authentication (PTA), 2 matches Password Hash Synchronization (PHS), 3 matches Microsoft Entra Cross-Tenant Synchronization, and 4 matches SAML/WS-Fed Direct Federation.
Pass-through Authentication validates passwords on-premises in real-time to respect sign-in hours without AD FS. Password Hash Sync enables authentication to continue during local internet outages. Cross-Tenant Synchronization automates provisioning across internal Entra ID tenants. SAML/WS-Fed Direct Federation allows external users to authenticate using their non-Azure identity provider.

Step-by-Step Solution

1
Analyze real-time security policy evaluation requirements.
Identify that Pass-through Authentication (PTA) delegates password validation to on-premises AD DS in real-time, enforcing sign-in hours instantly without AD FS infrastructure.
To satisfy the constraint of evaluating sign-in hours in real-time without AD FS.
2
Analyze business continuity and high availability requirements.
Identify that Password Hash Synchronization (PHS) handles authentication in the cloud, remaining active during local network outages with minimal agent overhead.
To satisfy the requirement that cloud authentication must not fail when the connection between the on-premises network and Azure is lost.
3
Analyze multi-tenant provisioning requirements.
Select Microsoft Entra Cross-Tenant Synchronization as it automates user synchronization and lifecycle management between Entra ID tenants.
To satisfy the need for automated provisioning of guest accounts across multiple internal tenants.
4
Analyze external partner authentication requirements.
Select SAML/WS-Fed Direct Federation to delegate authentication to the partner's non-Azure identity provider without manual invitation overhead.
To satisfy the external partner access requirement.

Key Concept

Selecting appropriate Microsoft Entra ID hybrid identity and multi-tenant solutions based on security, availability, and provisioning constraints.
Estimated Time:2m 30s
Question 17Question →

You are designing a data storage solution using Azure Cosmos DB for a multi-region retail application. The application requires global distribution across three Azure regions, a 99.999% availability SLA for both reads and writes, and a 90/10 read-to-write ratio. Match each application workload to the most appropriate Azure Cosmos DB API.

Click a left item, then click its matching right item

Items

API for NoSQL
API for MongoDB
API for Gremlin

Matches

Show answer & explanation

Answer

API for NoSQL matches the customer order catalog; API for MongoDB matches the shopping cart session service migrating from MongoDB; API for Gremlin matches the recommendation engine traversing relationships.
The API for NoSQL is the native document model using SQL query syntax. The API for MongoDB supports wire-protocol compatibility for existing MongoDB codebases. The API for Gremlin supports graph databases using vertices and edges.

Step-by-Step Solution

1
Identify the data model and query language requirements for the customer order catalog workload.
The catalog requires JSON document storage and SQL querying, which directly aligns with the native Azure Cosmos DB API for NoSQL.
Matching workloads to their native APIs minimizes translation layers and provides the best performance and tooling support.
2
Identify the compatibility requirements for the shopping cart session service.
The workload is migrating from MongoDB and requires compatibility without application code changes, which maps to the API for MongoDB.
The API for MongoDB implements the wire protocol of MongoDB, allowing existing drivers and tools to work out-of-the-box.
3
Identify the relationship and traversal requirements for the recommendation engine.
The engine requires traversing relationships between entities, representing a graph data structure, which maps to the API for Gremlin.
The API for Gremlin supports property graphs and the Gremlin query language, which is standard for graph database traversals.

Key Concept

Azure Cosmos DB API selection based on workload data models and compatibility requirements.
Question 18Question →

An enterprise is designing a secure identity and access management infrastructure. You are tasked with mapping specific access control requirements to their corresponding Microsoft Entra ID or Conditional Access configuration. Match each requirement on the left to the most appropriate configuration on the right to satisfy the requirement.

Click a left item, then click its matching right item

Items

Ensure that external consultants can only access corporate web apps from compliant devices or trusted locations, and force them to re-authenticate after 4 hours of inactivity.
Require administrative users to use FIDO2 security keys to manage Azure resources, and grant them high-privilege roles only for a maximum duration of 8 hours upon manager approval.
Guarantee that the tenant remains manageable if a major service outage affects Entra MFA, while ensuring any sign-in by these recovery accounts is immediately notified to security operations.
Detect when an employee's password has been leaked on the dark web and immediately prevent them from signing in until an administrator resets their password.

Matches

Show answer & explanation

Answer

Match the external consultant session timeout to the Conditional Access policy with grant and session controls; the administrative FIDO2 and PIM role activation to the PIM role settings combined with CA authentication strengths; the tenant management resilience to the emergency access accounts excluded from CA policies and monitored; and the leaked password detection to the Microsoft Entra ID Protection User risk policy.
The requirement for external consultant session limits maps to Conditional Access session controls. Enforcing phishing-resistant MFA and approval-based elevation maps to Privileged Identity Management (PIM) integrated with CA authentication strengths. Tenant resiliency during MFA outages maps to emergency access accounts excluded from CA policies. Automated blocking for leaked credentials maps to the Microsoft Entra ID Protection User risk policy.

Step-by-Step Solution

1
Analyze requirement for external consultants.
Identified the need for conditional access based on device compliance/location and session expiration (4-hour frequency limit).
Enforcing location/compliance and a 4-hour timeout requires a Conditional Access policy using both grant and session controls.
2
Analyze requirement for developer administrative access.
Identified the need for phishing-resistant MFA (FIDO2) and approval-based, time-bound privilege activation.
FIDO2 authentication strength is enforced via Conditional Access, and temporary, approved role assignment is managed via Microsoft Entra Privileged Identity Management (PIM).
3
Analyze requirement for emergency lockout resilience.
Identified the need for emergency access (break-glass) accounts that bypass CA policies, coupled with alert monitoring.
Excluding emergency accounts from CA prevents lockout during MFA outages, and monitoring their login activity via Azure Monitor ensures security visibility.
4
Analyze requirement for dark web credential leaks.
Identified the need to block compromised users immediately.
Microsoft Entra ID Protection detects leaked credentials as high user risk, triggering the configured User risk policy to block access.

Key Concept

Microsoft Entra ID Authentication and Conditional Access
Estimated Time:3m 0s
Question 19Question →

An educational technology provider is designing a monitoring and audit log routing architecture for its multi-tenant platform. You need to match each workload telemetry source or monitoring requirement to its most appropriate Azure destination or storage configuration to optimize cost, performance, and capability.

Click a left item, then click its matching right item

Items

Microsoft Entra ID sign-in logs that must be sent to an external, third-party SIEM system
Virtual machine boot diagnostics screenshots and serial logs that are rarely accessed
Subscription-level deployment and management events that must be kept for 90 days at zero extra cost
Container performance metrics and console logs that require complex correlation using Kusto Query Language (KQL)

Matches

Show answer & explanation

Answer

The correct matches are: Microsoft Entra ID sign-in logs match with Azure Event Hubs; Virtual machine boot diagnostics match with Azure Storage account; Subscription-level events match with Azure Activity Log default store; Container logs requiring KQL match with Azure Log Analytics workspace.
The solution correctly pairs each monitoring telemetry source with the destination that matches its functional and cost constraints. Third-party SIEM integration is achieved via Azure Event Hubs. Boot diagnostics utilize Azure Storage for cost-effective unstructured storage. Activity logs are kept in their default store for 90 days for free. Container logs requiring complex queries are routed to a Log Analytics workspace.

Step-by-Step Solution

1
Analyze the real-time external integration requirement.
Streaming logs to a third-party SIEM requires a message ingestion service, making Azure Event Hubs the correct choice.
Azure Event Hubs serves as the standard pipeline for forwarding log data to non-Azure monitoring systems.
2
Determine the lowest-cost option for boot diagnostics.
Boot diagnostics consist of screenshots and serial console text, which are stored as unstructured files in an Azure Storage account.
Using a Log Analytics workspace for boot diagnostics would incur unnecessary ingestion and retention costs.
3
Evaluate the subscription audit log retention constraint.
The Azure Activity Log platform store keeps the last 90 days of management events free of charge.
Since the requirement is 90 days of history at zero extra cost, routing them to another workspace or storage account is unnecessary.
4
Identify the target for KQL querying and metrics analytics.
A Log Analytics workspace is required to run KQL queries.
KQL is the query language for Azure Monitor Logs stored within Log Analytics workspaces.

Key Concept

Selecting log routing destinations based on query, cost, retention, and integration requirements.
Question 20Question →

An enterprise is designing a hybrid and multi-tenant identity solution to integrate their on-premises Active Directory Domain Services (AD DS) forest with Microsoft Entra ID. The solution must support various user populations, access control policies, and authentication methods. Match each business and security requirement on the left to the most appropriate Microsoft Entra identity technology or feature on the right that satisfies it.

Click a left item, then click its matching right item

Items

Authenticate users in Microsoft Entra ID using synced credentials, ensuring sign-in capability even if the on-premises WAN link is offline, and allowing Microsoft Entra ID Protection to identify leaked credentials.
Authenticate users in real-time against on-premises AD DS to enforce local policies and account states, without hosting federation servers in a perimeter network.
Delegate user authentication to an on-premises identity provider to support third-party hardware security modules (HSMs) and smart cards for logging on.
Enable external partners to collaborate by logging in to corporate resources using their own organization's credentials, without managing their lifecycle in the local Active Directory.

Matches

Show answer & explanation

Answer

The requirement for offline authentication and leaked credential detection matches Password Hash Synchronization (PHS). The requirement for real-time authentication against local AD DS to enforce policies without federation servers matches Pass-Through Authentication (PTA). The requirement for third-party HSM and smart card authentication matches Active Directory Federation Services (AD FS). The requirement for external partner collaboration using their own corporate credentials matches Microsoft Entra B2B collaboration.
The requirements are matched based on the native capabilities of Microsoft Entra ID hybrid identity models: Password Hash Synchronization (PHS) enables offline sign-in and leaked credential detection; Pass-Through Authentication (PTA) enables real-time local AD DS validation and policy enforcement without federation servers; Active Directory Federation Services (AD FS) supports advanced on-premises authentication requirements like HSMs and smart cards; Microsoft Entra B2B collaboration allows secure external collaboration without managing partner credentials.

Step-by-Step Solution

1
Analyze the first requirement for offline sign-in capability and leaked credential detection.
Password Hash Sync (PHS) stores password hashes in the cloud, enabling offline authentication and letting Microsoft Entra ID Protection inspect hashes against leaked credentials database.
Only PHS stores a hash of the user's password hash in Microsoft Entra ID, which is a prerequisite for Azure AD Identity Protection's leaked credential detection.
2
Analyze the second requirement for real-time local AD DS validation and enforcing account states/logon hours without federation infrastructure.
Pass-Through Authentication (PTA) fulfills this by using a simple local agent to validate passwords directly against on-premises Domain Controllers, ensuring real-time policy evaluation.
PTA redirects the authentication request to local domain controllers in real-time, enforcing local restrictions without requiring a heavy AD FS infrastructure.
3
Analyze the third requirement for leveraging local HSMs and smart cards for federation-based sign-in.
Active Directory Federation Services (AD FS) redirects users to the on-premises federation endpoints where advanced local authentication methods (like smart cards and HSM integration) are executed.
Federated solutions like AD FS delegate the entire authentication process to the on-premises identity provider, which is required for custom on-premises authentication mechanisms.
4
Analyze the fourth requirement for external partner collaboration using their own credentials.
Microsoft Entra B2B collaboration enables sharing resources with external users who sign in with their own tenant credentials, removing the need for local lifecycle management.
B2B collaboration allows guest users to sign in with their external identity provider (such as another Entra ID tenant, Google, or SAML/WS-Fed IdP).

Key Concept

Selecting the correct hybrid identity authentication sync method and tenant collaboration mechanism based on business continuity, authentication policies, and multi-tenant requirements.
Estimated Time:2m 0s
Page 1 / 4Next