Question 1

A highly regulated financial institution is migrating to Microsoft 365 and Azure. They currently use an on-premises Active Directory Domain Services (AD DS) forest.

The Chief Security Officer (CSO) mandates the following strict requirements:
1. User passwords or password hashes MUST NOT be synchronized to the cloud under any circumstances.
2. Users must experience Single Sign-On (SSO) from their domain-joined corporate devices.
3. If the on-premises internet connection fails, users must not be able to authenticate to cloud services.
4. The solution must not require inbound ports to be opened on the corporate firewall.

Which hybrid identity solution should you design?

Accepted Answer

Evaluate the constraints: No password hashes in cloud eliminates PHS. No inbound ports heavily discourages AD FS. PTA uses outbound agents and validates against on-prem AD.

Question 2

What mistakes do candidates make on this AZ-305 question?

Accepted Answer

Choosing AD FS. While AD FS keeps authentication on-premises, it requires complex infrastructure and inbound connectivity to the WAP servers, violating the firewall requirement.

How to approach this question

Full Answer

Common mistakes

Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 5

More questions from this exam