SC-300 Certification Practice Question #10

Question

Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

All the users work remotely.
Azure AD Connect is configured in Azure AD as shown in the following exhibit.

Connectivity from the on-premises domain to the internet is lost.
Which users can sign in to Azure AD?

Accepted Answer

The exhibit confirms PTA is enabled (2 agents) with PHS also enabled, but the question only says on-prem-to-internet connectivity is lost — it is not a manual sign-in-method switch. Per MS Learn, PHS does NOT automatically fail over for PTA, so the directory-synced User2 (validated live against on-prem AD via PTA) cannot authenticate during the outage. User1 (cloud-only, `Directory synced = No`) and User3 (guest, authenticates via home tenant) have no on-prem dependency and can still sign in. The strong "C" community minority hinges on the misconception that enabled PHS auto-fails-over, which MS Learn explicitly refutes; this lowers confidence somewhat but the official answer, top votes, and docs all align on A.

More SC-300 practice questions