AZ-700 · Question #379
You have an Azure subscription that contains a virtual network named VNet1. You plan to deploy Point-to-Site (P2S) VPN access to VNet1. You need to recommend an authentication method for the…
The correct answer is B. Microsoft Entra. To meet the requirements of FIDO2 security key support, user sign-in behavior analysis, and password change enforcement for risky sign-ins for Point-to-Site VPN, Microsoft Entra authentication should be recommended.
Question
You have an Azure subscription that contains a virtual network named VNet1. You plan to deploy Point-to-Site (P2S) VPN access to VNet1. You need to recommend an authentication method for the deployment. The solution must meet the following requirements:
- Require the use of a FIDO2 security key
- Analyze user sign-in behavior
- Require a user to change their password if their sign-in behavior is
identified as risky What should you recommend?
Options
- ARADIUS
- BMicrosoft Entra
- Csmart card
- DAzure certificate
How the community answered
(17 responses)- A12% (2)
- B76% (13)
- C6% (1)
- D6% (1)
Why each option
To meet the requirements of FIDO2 security key support, user sign-in behavior analysis, and password change enforcement for risky sign-ins for Point-to-Site VPN, Microsoft Entra authentication should be recommended.
RADIUS authentication can integrate with various identity providers but does not natively provide the specific FIDO2 key support, advanced sign-in behavior analysis, or direct enforcement of password changes based on risk assessment as required.
Microsoft Entra authentication for Point-to-Site VPNs can leverage Microsoft Entra Conditional Access policies and Identity Protection. This allows for enforcing FIDO2 security key usage as a strong authentication method, analyzing user sign-in behavior for anomalies, and triggering actions like password changes for risky sign-ins, directly meeting all specified requirements.
Smart card authentication is a strong method but does not inherently provide FIDO2 support, real-time sign-in behavior analysis, or automated password change requirements for risky sign-ins without additional complex integrations.
Azure certificate authentication is a simple and common method for P2S VPNs but lacks support for FIDO2 security keys, advanced sign-in behavior analysis, and automated risk-based password change enforcement.
Concept tested: P2S VPN authentication with Microsoft Entra ID
Source: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-azure-ad
Community Discussion
No community discussion yet for this question.