SC-100 Certification Practice Question #25

Question

You have the following on-premises servers that run Windows Server:

•	Two domain controllers in an Active Directory Domain Services (AD DS) domain
•	Two application servers named Server1 and Server2 that run ASP.NET web apps
•	A VPN server named Served that authenticates by using RADIUS and AD DS

End users use a VPN to access the web apps over the internet.

You need to redesign a user access solution to increase the security of the connections to the web apps. The solution must minimize the attack surface and follow the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA).

What should you include in the recommendation?

Accepted Answer

The scenario is the textbook MCRA / Zero Trust "remote users reach on-premises web apps over a VPN" pattern. Microsoft's own Zero Trust RaMP checklist prescribes exactly this answer: publish the web apps through Microsoft Entra application proxy so remote users access a single pre-authenticated app (with Conditional Access and MFA) instead of opening the entire network via VPN. This minimizes the attack surface and requires no inbound firewall ports. Option B only swaps the VPN's identity provider — the broad VPN attack surface remains. C and D are detection/protection layers, not the access-redesign the question asks for. Suggested Answer, a unanimous Most Voted, the top community comment, and MS Learn all agree, so confidence is high.

More SC-100 practice questions