StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Security · Security | Secure AD DS

Practice question 342 of 506 · easy

An administrator wants banned-password enforcement without transmitting users' new passwords to a cloud service. Which architecture meets this?

Choose the single best answer.

  1. A.Every change sends the plaintext password to Entra ID for approval
  2. B.DC agents validate locally using policy downloaded through proxies
  3. C.The proxy intercepts LDAP and resets the password remotely
  4. D.Only an Azure VM can perform local password validation
Show the answer and explanation

✓ Correct answer

  • DC agents validate locally using policy downloaded through proxies

DC agents evaluate locally using downloaded/cached policy. The password is not sent for live cloud validation; the proxy is a retrieval relay rather than LDAP interception/reset logic. The feature supports on-premises AD DS.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.