Examkin

Soru

Zorluk: Çok zorMicrosoft Entra ID Authentication and Conditional Access

An organization is designing a hybrid identity and security governance strategy for its Microsoft Entra ID tenant. The organization has 10,000 users across multiple on-premises offices. The architecture must meet the following requirements:
1. On-premises Active Directory Domain Services (AD DS) user passwords must never be stored in the cloud in any form, including reversible or irreversible hashes, to comply with local financial regulations.
2. Users must be prompted for multi-factor authentication (MFA) when accessing cloud resources, except when they are working from physical corporate offices.
3. Access to privileged administrative roles in Entra ID must follow a zero-trust model requiring justification and manager approval, and administrators must be protected against tenant lockout in the event of an MFA service outage.

Which identity and access management design should the organization recommend?

  1. A
    Configure Microsoft Entra Connect Pass-through Authentication (PTA) with seamless single sign-on. Design a Conditional Access policy that requires MFA for all users, excludes corporate network IP ranges defined as trusted locations, and excludes a dedicated emergency access account from the policy. Configure Privileged Identity Management (PIM) with permanently active role assignments.
  2. B
    Configure Active Directory Federation Services (AD FS) to handle authentication federated with on-premises. Design a Conditional Access policy that requires MFA for all users, excludes corporate network IP ranges defined as trusted locations, and excludes a dedicated emergency access account from the policy. Configure Privileged Identity Management (PIM) with eligible role assignments.
  3. C
    Configure Microsoft Entra Connect Pass-through Authentication (PTA) with seamless single sign-on. Design a Conditional Access policy that requires MFA for all users and excludes corporate network IP ranges defined as trusted locations, ensuring the policy applies to all administrative accounts without exception. Configure Privileged Identity Management (PIM) with eligible role assignments.
  4. Configure Microsoft Entra Connect Pass-through Authentication (PTA) with seamless single sign-on. Design a Conditional Access policy that requires MFA for all users, excludes corporate network IP ranges defined as trusted locations, and excludes a dedicated emergency access account from the policy. Configure Privileged Identity Management (PIM) with eligible role assignments.Cevap

Cevap

Configure Microsoft Entra Connect Pass-through Authentication (PTA) with seamless single sign-on. Design a Conditional Access policy that requires MFA for all users, excludes corporate network IP ranges defined as trusted locations, and excludes a dedicated emergency access account from the policy. Configure Privileged Identity Management (PIM) with eligible role assignments.
The correct strategy integrates Microsoft Entra Connect Pass-through Authentication (PTA) to keep credential validation on-premises without cloud hash storage, meeting the security and regulatory mandate. Excluding the corporate network IP ranges from the Conditional Access MFA rule ensures location-specific bypass. Applying Privileged Identity Management (PIM) with eligible assignments enforces zero-trust controls by requiring justification and approval for role activation. Finally, excluding a dedicated emergency access account from the Conditional Access policy ensures administrative access is maintained during an MFA outage.

Adım Adım Çözüm

1
Select the appropriate hybrid authentication method to satisfy compliance.
Pass-through Authentication (PTA) is selected instead of Password Hash Synchronization (PHS) because PTA validates user credentials directly on-premises without copy-syncing password hashes to the cloud. AD FS is rejected because it adds unnecessary on-premises server footprint and infrastructure complexity.
Compliance dictates that no password hashes, reversible or irreversible, can exist in the cloud.
2
Configure location-based MFA exclusions using Conditional Access.
Define corporate network IP ranges as Trusted Locations and exclude them from the MFA grant control in the Conditional Access policy.
This configuration satisfies the requirement to prompt for MFA except when users are located in physical corporate offices.
3
Design emergency access mitigation within the Conditional Access policy.
Exclude a dedicated emergency access (glass-breaker) account from the Conditional Access policy that enforces MFA.
Without this exclusion, if the MFA service becomes unavailable, administrators could be locked out of the tenant with no method to authenticate.
4
Configure administrative role governance using Privileged Identity Management (PIM).
Define administrative role assignments as eligible rather than active.
Eligible assignments enforce a zero-trust model by requiring users to activate roles on-demand, providing justification and seeking manager approval, whereas active assignments grant privileges permanently.

Anahtar Kavram

Designing a secure hybrid identity infrastructure requires balancing strict compliance constraints (preventing cloud password storage via PTA), zero-trust administrator governance (using PIM eligible assignments), and tenant availability safeguards (excluding emergency glass-breaker accounts from Conditional Access MFA policies).
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Microsoft Entra ID Authentication and Conditional Access