For IndividualsFor Educators
ExpertMinds LogoExpertMinds
ExpertMinds

Ace your certifications with Practice Exams and AI assistance.

  • Browse Exams
  • For Educators
  • Blog
  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Support
  • AWS SAA Exam Prep
  • PMI PMP Exam Prep
  • CPA Exam Prep
  • GCP PCA Exam Prep

© 2026 TinyHive Labs. Company number 16262776.

    PracticeAzure Solutions Architect Expert (AZ-305)Azure Solutions Architect Expert AZ-305 Practice Exam 5Question 09
    Medium1 markMultiple Choice
    Domain 1.2: Authentication and AuthorizationDomain 1IdentityEntra DSMigration

    AZ-305 · Question 09 · Domain 1.2: Authentication and Authorization

    Your company is migrating several legacy applications to Azure Virtual Machines.

    These applications rely on LDAP read/write operations, NTLM authentication, and require servers to be joined to an Active Directory domain. The company has already synchronized their on-premises Active Directory to Microsoft Entra ID using Entra Connect.

    The CIO wants to decommission the on-premises domain controllers and avoid deploying new IaaS domain controllers in Azure to minimize management overhead (patching, backups).

    Which TWO actions should you take to support the legacy applications? (Select TWO)

    Answer options:

    A.

    Deploy Microsoft Entra Domain Services (Entra DS).

    B.

    Configure Microsoft Entra Application Proxy.

    C.

    Join the Azure VMs to the Entra DS managed domain.

    D.

    Join the Azure VMs directly to Microsoft Entra ID.

    E.

    Deploy a Site-to-Site VPN to on-premises.

    How to approach this question

    Recognize that legacy protocols (LDAP, NTLM) require traditional AD DS. If IaaS VMs are forbidden, the PaaS alternative is Entra Domain Services.

    Full Answer

    Deploy Microsoft Entra Domain Services (Entra DS), Join the Azure VMs to the Entra DS managed domain
    Microsoft Entra ID is a modern identity provider and does not support legacy protocols like LDAP, NTLM, or Kerberos. To support legacy applications without managing IaaS domain controllers, you must deploy Microsoft Entra Domain Services (Entra DS). Entra DS provides a managed domain (PaaS) that synchronizes users from Entra ID. You must then join the Azure VMs hosting the applications to this managed domain so they can authenticate using NTLM and query via LDAP.

    Common mistakes

    Confusing Entra ID Join with Entra DS Join. Entra ID Join does not support LDAP/NTLM.
    Question 08All questionsQuestion 10

    Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 5

    55 questions · hints · full answers · grading

    Sign up freeTake the exam

    More questions from this exam

    Q01Contoso Ltd has 50 subscriptions across 3 business units. Each business unit manages its own IT o...EasyQ02You are designing a monitoring solution for a hybrid environment. The environment consists of 200...MediumQ03Your company uses Microsoft Sentinel integrated with a Log Analytics workspace. The workspace ing...HardQ04You are designing an application monitoring strategy using Application Insights. The application ...MediumQ05A highly regulated financial institution is migrating to Microsoft 365 and Azure. They currently ...Hard
    View all 55 questions →