Task 1.2: Design authentication and authorization solutions

• APass-through authentication

  Incorrect

  With this method, cloud sign-in stops when the datacenter is offline.

• BFederation with AD FS

  Incorrect

  AD FS adds a farm of servers on-premises and sign-in depends on it.

• CPassword hash synchronization

  Correct

  Sign-in happens in the cloud without on-premises dependencies, and it's required for leaked credential detection in ID Protection.

• DSeamless single sign-on on its own

  Incorrect

  Seamless SSO only signs in domain-joined devices silently; it's a companion to a sign-in method, not one by itself.

Password hash synchronization needs the least effort, keeps cloud sign-in working when on-premises systems are down, and enables leaked credential reports. Pass-through authentication and federation rely on on-premises components at sign-in time.

• AA system-assigned managed identity on the scale set and on each VM

  Incorrect

  System-assigned identities are tied to each resource's lifecycle, so each needs its own role assignment.

• BOne user-assigned managed identity attached to the scale set and both VMs

  Correct

  A user-assigned identity is its own resource, can be shared by many resources and outlives them, so one role assignment covers all.

• CA service principal whose client secret is stored in an app setting

  Incorrect

  The client secret would sit in configuration, which the requirement forbids, and it must be rotated.

• DA shared access signature for the key vault in each instance's configuration

  Incorrect

  Key Vault doesn't use shared access signatures, and a stored token is a secret in configuration.

Managed identities remove credentials from code. A user-assigned managed identity is created as a standalone resource, can be assigned to several resources at once, and its role assignments stay when those resources are deleted, which suits instances that come and go.

• AAzure Key Vault Managed HSM

  Correct

  Managed HSM is a fully managed, single-tenant HSM pool validated to FIPS 140-3 Level 3, and the customer owns its security domain.

• BAzure Key Vault Standard with software-protected keys

  Incorrect

  Standard vaults protect keys in software, not in a dedicated single-tenant HSM.

• CAzure Key Vault Premium with HSM-protected keys

  Incorrect

  Premium vaults use multi-tenant HSMs, so they miss the single-tenant requirement.

• DAzure App Configuration with encrypted key-values

  Incorrect

  App Configuration isn't an HSM key store for customer-managed keys.

Managed HSM gives each customer a dedicated HSM pool with a security domain the customer controls, validated to FIPS 140-3 Level 3, and it works as the key source for customer-managed keys in Azure services.

• AAn Azure VPN Gateway with point-to-site connections for the staff

  Incorrect

  A point-to-site VPN is the VPN the requirement rules out.

• BA public load balancer in Azure in front of the intranet server

  Incorrect

  Publishing the server directly needs inbound connectivity and gives no Entra pre-authentication.

• CMicrosoft Entra application proxy with a connector on-premises

  Correct

  The connector makes outbound connections only, Entra ID pre-authenticates users with Conditional Access, and Kerberos constrained delegation covers Integrated Windows Authentication.

• DMicrosoft Entra B2B collaboration for the remote staff

  Incorrect

  B2B invites external users into the tenant; it doesn't publish an on-premises app.

Application proxy publishes on-premises web apps through Microsoft Entra ID. The connector only makes outbound connections, users are authenticated by Entra ID first (so Conditional Access applies), and single sign-on to Windows-authenticated apps uses Kerberos constrained delegation.

• AConditional Access for admin roles with a phishing-resistant authentication strength

  Correct

  Authentication strengths let a Conditional Access policy demand specific methods, such as phishing-resistant MFA, for chosen users.

• BSecurity defaults turned on for the tenant

  Incorrect

  Security defaults require MFA broadly but can't demand a phishing-resistant method for one group.

• CPer-user MFA enforced on each administrator's account

  Incorrect

  Per-user MFA requires a second factor but doesn't restrict which methods may satisfy it.

• DA sign-in frequency control of one hour in a Conditional Access policy for all administrators

  Incorrect

  Sign-in frequency changes how often users reauthenticate, not which methods they use.

Conditional Access authentication strengths define which combinations of methods satisfy a policy. The built-in phishing-resistant MFA strength, targeted at directory roles, forces FIDO2 keys, Windows Hello for Business or certificate-based methods for admins only.

• AA service principal whose client secret is kept as a GitHub encrypted secret

  Incorrect

  An encrypted GitHub secret is still a stored secret that must be rotated.

• BA system-assigned managed identity on a self-hosted runner VM, given Owner on the subscriptions

  Incorrect

  Owner on whole subscriptions breaks the least-privilege scope, and it ties deployments to one VM.

• CA federated identity credential on an app registration, with Contributor per resource group

  Correct

  Workload identity federation lets GitHub exchange its OIDC token for a short-lived Entra token, so no secret is stored.

• DA personal account of the DevOps lead signed in with az login in the workflow

  Incorrect

  A user's credentials in a pipeline are a stored secret and a shared human identity.

With workload identity federation, an app registration or user-assigned managed identity trusts tokens issued by GitHub for a specific repository and branch or environment. The workflow gets short-lived access tokens without any secret, and RBAC at resource group scope limits what it can change.

• AAccounts created by administrators in the workforce tenant

  Incorrect

  Admin-created workforce accounts allow no self-service sign-up and mix customers with employees.

• BB2B collaboration guests in the workforce tenant

  Incorrect

  Guests in the workforce tenant mix customers with employees, which the requirement rules out.

• CMicrosoft Entra External ID in an external tenant

  Correct

  An external tenant holds consumer accounts separately from the workforce and supports self-service sign-up, social identity providers and branding.

• DMicrosoft Entra Domain Services with a customer OU

  Incorrect

  Domain Services isn't a customer identity service: it offers no self-service sign-up and no branded sign-in pages.

Microsoft Entra External ID covers external identities. For consumer apps it uses an external tenant, separate from the workforce tenant, with self-service sign-up, social and email sign-in and custom branding.

• AAzure RBAC with Key Vault Secrets User for each identity on its vault

  Correct

  Azure RBAC is the recommended model, and Key Vault Secrets User allows reading secret contents only.

• BVault access policies that grant Get and List on secrets to each identity

  Incorrect

  Access policies are the legacy model and sit outside Azure role assignments and PIM.

• CKey Vault Administrator assigned to each identity on its vault

  Incorrect

  Key Vault Administrator grants all data actions, far more than reading secrets.

• DContributor assigned to each identity on the resource group

  Incorrect

  Contributor manages the vault resource but doesn't grant reading secret contents under the RBAC model.

Azure RBAC is the recommended authorization model for Key Vault data planes. Built-in roles such as Key Vault Secrets User give least privilege, and assignments work with PIM and Azure activity logging.

• AAD DS domain controllers on Azure VMs in a new forest

  Incorrect

  Self-managed domain controllers are the servers the team doesn't want to patch and back up.

• BMicrosoft Entra join of each app server

  Incorrect

  Entra join doesn't provide LDAP binds or Kerberos and NTLM for legacy apps.

• CMicrosoft Entra Domain Services in the apps' virtual network

  Correct

  Domain Services provides managed domain join, LDAP, Kerberos and NTLM using identities synchronized from Microsoft Entra ID.

• DMicrosoft Entra application proxy in front of the apps

  Incorrect

  Application proxy doesn't give servers a domain to join.

Microsoft Entra Domain Services provides managed domain services such as domain join, group policy, LDAP and Kerberos or NTLM authentication, compatible with AD DS, without deploying or managing domain controllers.

• AB2B guest accounts for each engineer in every customer tenant

  Incorrect

  Guest accounts in 40 tenants are the overhead the provider wants to avoid.

• BAzure Lighthouse delegated resource management

  Correct

  Lighthouse projects customer subscriptions or resource groups into the provider's tenant with the roles each customer delegates.

• CA shared administrator account created in each customer tenant

  Incorrect

  Shared accounts remove accountability and still need an identity in every tenant.

• DCross-tenant synchronization of the engineers into each customer tenant

  Incorrect

  Synchronization still creates the engineers as users in every customer tenant.

Azure Lighthouse enables delegated resource management: customers delegate subscriptions or resource groups to a provider's tenant, and the provider's users act on them with the Azure built-in roles in the delegation, from their own tenant.