SC-300 Certification Practice Question #16

Question

You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant. The tenant uses pass-through authentication.
A corporate security policy states the following:
✑ Domain controllers must never communicate directly to the internet.
✑ Only required software must be installed on servers.
The Active Directory domain contains the on-premises servers shown in the following table.

You need to ensure that users can authenticate to Azure AD if a server fails.
On which server should you install an additional pass-through authentication agent?

Accepted Answer

To get PTA failover you must add a *standalone* authentication agent on a server in the same Active Directory forest, and MS Learn explicitly says to put it on a server other than the one running Entra Connect. Server3 (the Entra Connect server) already hosts the primary agent, so it cannot provide the redundancy. Server1 and Server2 are domain controllers, which the corporate policy forbids from talking to the internet and from running non-required software, so installing the agent there violates the policy. Server4 is the only unassigned member server, making it the correct target. Suggested Answer, an overwhelming Most Voted (31), and MS Learn all agree, with no credible dissent.

More SC-300 practice questions