Examkin

Soru

Zorluk: OrtaHybrid and Multi-Tenant Identity Solutions

Zephyr Aerospace has an on-premises Active Directory Domain Services (AD DS) domain. The company is designing a hybrid identity solution to integrate their on-premises identity infrastructure with Microsoft Entra ID.

The solution must meet the following requirements:
- Users must be able to sign in to cloud services using their on-premises passwords.
- Users must be able to authenticate successfully even if the on-premises network connectivity is temporarily unavailable.
- The security team must be able to identify if any user credentials have been leaked on the public dark web.
- The on-premises infrastructure footprint and administrative overhead must be minimized.

Which hybrid identity authentication method should you recommend?

  1. A
    Active Directory Federation Services (AD FS)
  2. B
    Pass-through Authentication (PTA)
  3. Password Hash Synchronization (PHS)Cevap
  4. D
    Pass-through Authentication (PTA) with Password Hash Synchronization (PHS) configured as a standby failover

Cevap

Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) is the correct choice because it meets all requirements. By storing a hash of the user's password hash in Microsoft Entra ID, authentication is handled entirely in the cloud. This provides resiliency if the on-premises network is offline. It also enables leaked credential detection via Microsoft Entra ID Protection and has the lowest on-premises infrastructure footprint compared to PTA and AD FS.

Adım Adım Çözüm

1
Evaluate the offline availability requirement.
Since users must authenticate even during on-premises network outages, cloud-side authentication is necessary.
Methods requiring real-time on-premises validation (standard PTA and AD FS) are ruled out because they depend on an active connection to on-premises domain controllers.
2
Evaluate the security and threat detection requirement.
Leaked credential detection is required.
Microsoft Entra ID Protection requires Password Hash Synchronization (PHS) to run its leaked credential checks by comparing hashes to compromised lists.
3
Evaluate the management overhead constraint.
The infrastructure footprint must be minimized.
AD FS requires federation servers, proxies, and certificates, while PTA requires multiple agent installations. PHS only requires the sync engine, minimizing overhead.

Anahtar Kavram

Selecting a hybrid identity authentication model that provides cloud-based resiliency, minimal on-premises infrastructure, and integration with advanced security features such as leaked credential detection.
Bu soruyu puanla

Konular

Hybrid and Multi-Tenant Identity Solutions

Bu konudan daha fazla soru