A user successfully reaches the AVD cloud service from home. Traditional smart-card sign-in to an AD-backed host fails. The smart-card certificate is valid, but the client cannot reach a domain-controller KDC and no VPN is available. Which design can supply the required ticket path?

Choose the single best answer.

A.Provide a correctly configured KDC proxy accessible to the client.
B.Grant the user Desktop Virtualization Workspace Contributor.
C.Enable Controlled Folder Access on the session host.
D.Enable NTLM as a replacement for smart-card Kerberos authentication.

Show the answer and explanation

✓ Correct answer

Provide a correctly configured KDC proxy accessible to the client.

Traditional smart-card host authentication requires Kerberos tickets from a KDC. A supported KDC proxy can provide that path when direct or VPN connectivity is unavailable. Option explanations: A. Provide a correctly configured KDC proxy accessible to the client.: A KDC proxy is a documented method for client access to the required KDC. B. Grant the user Desktop Virtualization Workspace Contributor.: Workspace management permissions do not provide Kerberos tickets or Windows authentication. C. Enable Controlled Folder Access on the session host.: File-write protection does not establish the required authentication network path. D. Enable NTLM as a replacement for smart-card Kerberos authentication.: Traditional smart-card host sign-in uses Kerberos; NTLM is not a substitute for its ticket acquisition. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid, not affiliated with or endorsed by Microsoft. Original educational practice questions, not official exam questions or a prediction of an exam result. Use Microsoft Learn and hands-on labs alongside this course.