StudyByteLearn
← AZ-305: Azure Infrastructure Solutions
AZ-305 · Identity and access

Practice question 71 of 400 · hard

Remote employees need MFA-protected access to an internal Windows-authenticated web application without opening inbound publishing ports. Which two components should be recommended? Select 2 answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.An Azure Reader role as the web app's Kerberos authorization.
  2. B.Removal of all application ACLs because preauthentication grants app access.
  3. C.Application proxy with Entra preauthentication and outbound-connected private network connectors.
  4. D.Correct Kerberos constrained delegation, SPNs, identity mapping, and app permissions.
  5. E.Application proxy as a VPN for every internal protocol.
Show the answer and explanation

✓ Correct answers

  • Application proxy with Entra preauthentication and outbound-connected private network connectors.
  • Correct Kerberos constrained delegation, SPNs, identity mapping, and app permissions.

Application proxy provides the web publishing/preauthentication path, and configured KCD enables integrated Windows SSO for the permitted service. It is not general VPN connectivity. Azure Reader does not supply Kerberos application authorization, and internal app permissions remain necessary. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.