Exam AZ-305 topic 1 question 3 discussion

Actual exam question from Microsoft's AZ-305

Question #: 3
Topic #: 1

You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.
You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication.
Some users work remotely and do NOT have VPN access to the on-premises network.
You need to provide the remote users with single sign-on (SSO) access to WebApp1.
Which two features should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Azure AD Application Proxy
B. Azure AD Privileged Identity Management (PIM)
C. Conditional Access policies
D. Azure Arc
E. Azure AD enterprise applications
F. Azure Application Gateway

Show Suggested Answer

Suggested Answer: AE 🗳️

by Eltooth at Dec. 10, 2021, 5:20 a.m.

Comments

Submit Cancel

trap84

Highly Voted 3 years, 7 months ago

A&E is the correct answer. Azure App proxy for connecting without vpn and Enterprise App for SSO

upvoted 71 times

...

itmaster

Highly Voted 10 months, 2 weeks ago

It's required to download connector under (Application Proxy) and create a new application under (Enterprise Application), however for (Pre Authentication) option, you can choose "Passthrough" or "Azure Active Directory", and both will work, but it's recommended to use "Azure Active Directory" so you can take advantage of using conditional access and MFA. Answer is (A) & (E) as they're both required as part of the solution to work, where as (C) is just an optional feature. Reference: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

upvoted 34 times

FrancisFerreira

3 years, 4 months ago

You reasoning looks flawless to me. We need to pay attention to the question's wording: "Which two features SHOULD you include in the solution? EACH CORRECT ANSWER PRESENTS PART OF THE SOLUTION." To do (A) you need (E). So they are both PART of the solution. (C) is an extra step that's recommended by MS. (C) is not PART of the solution, given you don't actually need it to fulfill the requirements, therefore it is also not something you SHOULD do.

upvoted 5 times

...

ch3573r_at

Most Recent 2 months, 1 week ago

Selected Answer: AE

Seriously, this suggests publishing an internal application without Conditional Access to block e.g. foreign countries? I mean, I get that AE are sufficient, but still...

upvoted 1 times

...

stonwall12

10 months, 2 weeks ago

Correct Answer - A: Azure AD Application Proxy Azure AD Application Proxy provides remote access and single sign-on (SSO) capabilities to on-premises web applications. The internal web app can be published to Azure AD, and users can access the app outside the company network. https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy Correct Answer - E: Azure AD enterprise applications Azure AD enterprise applications are essentially app registrations in Azure AD for cloud-based and on-premises applications. This is where we can manage authentication requirements and assign user access. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal Just to clarify, the 'Application Proxy' handles the connection to the on-premises network, and the' Enterprise Applications' manages the authentication and authorization for the app.

upvoted 6 times

...

zellck

10 months, 2 weeks ago

Selected Answer: AE

AE is the answer. https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications. After a single sign-on to Azure AD, users can access both cloud and on-premises applications through an external URL or an internal application portal. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal

upvoted 1 times

...

NotMeAnyWay

10 months, 2 weeks ago

Selected Answer: AE

To provide remote SSO access to an on-premises web app named WebApp1 with Integrated Windows authentication: - Use Azure AD Application Proxy to securely publish on-premises web apps to the internet without the need for a VPN. - Add WebApp1 as an Azure AD enterprise application to enable Azure AD to provide authentication and authorization for the app. - Conditional Access policies, Azure AD PIM, Azure Arc, and Azure Application Gateway are not suitable for this task. - Conditional Access policies allow defining conditions for access to Azure AD-connected apps, but do not provide a solution for remote SSO access to an on-premises web app. - Azure AD PIM is used for managing access to Azure resources, but not for remote SSO access to an on-premises web app. - Azure Arc is a hybrid cloud management solution, and Azure Application Gateway is a web traffic load balancer, neither are relevant to providing remote SSO access to an on-premises web app.

upvoted 6 times

...