MS-100 Hybrid Identity & Authentication 1 — Questions and Answers
Question 1: Which Azure AD Connect synchronization feature allows users to authenticate against on-premises Active Directory while signing into Microsoft 365?
- Password Hash Synchronization
- Pass-through Authentication (Correct answer)
- Federation with AD FS
- Seamless SSO
Correct answer: Pass-through Authentication
Pass-through Authentication (PTA) validates user passwords directly against on-premises AD in real time without storing password hashes in Azure AD.
Question 2: What is the key advantage of Password Hash Synchronization (PHS) over Pass-through Authentication (PTA) in Azure AD Connect?
- PHS is more secure because passwords never leave the on-premises network
- PHS provides authentication continuity if on-premises infrastructure is unavailable (Correct answer)
- PHS supports smarter password policies
- PHS is required for Conditional Access policies
Correct answer: PHS provides authentication continuity if on-premises infrastructure is unavailable
PHS stores a hash of the password hash in Azure AD, allowing cloud authentication to continue even when on-premises AD is offline or unreachable.
Question 3: Which component of Azure AD Connect Health monitors the synchronization health and latency of object changes from on-premises AD to Azure AD?
- AD FS Health agent
- Sync Health agent (Correct answer)
- AD DS Health agent
- Connect Health dashboard
Correct answer: Sync Health agent
The Azure AD Connect Health Sync agent monitors synchronization operations, reports errors, and tracks latency of changes from on-premises AD.
Question 4: An organization uses AD FS for federation with Azure AD. What is the primary role of the Web Application Proxy (WAP) server in this architecture?
- Caching AD FS token requests to improve performance
- Publishing AD FS endpoints to the internet for external authentication (Correct answer)
- Replacing the AD FS proxy role for password-based applications
- Providing load balancing for internal AD FS servers
Correct answer: Publishing AD FS endpoints to the internet for external authentication
Web Application Proxy publishes AD FS endpoints externally, allowing users outside the corporate network to authenticate through AD FS for federated SSO.
Question 5: Which Azure AD Connect feature enables users to access both on-premises and cloud applications with SSO without entering credentials after the initial sign-in?
- Password Hash Synchronization
- Azure AD Seamless SSO (Correct answer)
- Pass-through Authentication
- Hybrid Azure AD Join
Correct answer: Azure AD Seamless SSO
Azure AD Seamless SSO automatically signs in users on domain-joined devices when they are connected to the corporate network, enabling silent SSO to cloud apps.
Question 6: What is the minimum number of AD FS servers recommended for a highly available production federation infrastructure?
- 1 AD FS server + 1 WAP server
- 2 AD FS servers + 2 WAP servers (Correct answer)
- 3 AD FS servers + 2 WAP servers
- 2 AD FS servers + 1 WAP server
Correct answer: 2 AD FS servers + 2 WAP servers
Microsoft recommends a minimum of two AD FS servers behind a load balancer and two Web Application Proxy servers for production high availability.
MS-100 Hybrid Identity & Authentication 1
Which Azure AD Connect synchronization feature allows users to authenticate against on-premises Active Directory while signing into Microsoft 365?