Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. You have an Azure subscription named Sub1 that is associated to an Azure Active Directory…

Question

Options

• Afederated identity with Active Directory Federation Services (AD FS)
• Bpassword hash synchronization with seamless single sign-on (SSO)
• Cpass-through authentication with seamless single sign-on (SSO)

• A
  5% (1)
• B
  19% (4)
• C
  76% (16)

Explanation

Explanation

Pass-through authentication (PTA) with seamless SSO is correct because it validates passwords directly against the on-premises Active Directory in real time, meaning that on-premises password policies (complexity, expiration) and logon restrictions (logon hours, account lockout) are enforced at the moment of authentication - not just at sync time. PTA only requires a lightweight agent installed on existing servers, minimizing infrastructure overhead compared to alternatives.

Option A (AD FS) is wrong because, while it does enforce on-premises policies, it requires deploying dedicated AD FS servers and typically Web Application Proxy servers, significantly increasing the number of servers required - violating the "minimize servers" requirement.

Option B (Password Hash Synchronization) is wrong because it copies a hash of the password to Azure AD and authenticates users in the cloud, meaning on-premises logon restrictions (such as logon hours or account disablement outside of sync cycles) are not enforced in real time - failing the password policy/restriction requirement.

Memory Tip: Think of PTA as a "live phone call" to on-premises AD for every login - policies are checked every time. PHS is more like a "voicemail snapshot" - policies were checked when the hash was copied, but not necessarily right now. If the question mentions enforcing policies in real time with minimal servers, PTA is your answer.

No community discussion yet for this question.