SC-300 Certification Practice Question #279

Question

How should the access be setup to the on-premises applications?
Hot Area:

Accepted Answer

Microsoft Entra Password Protection's proxy service runs on a member server (SERVER2), never on a domain controller (DCs must not have internet, a stated design principle) and not on SERVER1 (Application Proxy installs an incompatible version of the Agent Updater, per the docs warning the community quotes). The custom/global banned password list is configured and stored in Microsoft Entra ID; the proxy merely maintains a downloaded copy for the DC agents, so there is no "configure the list on DC1." Both the two Highly Voted answers (23 and 10 👍) and the strongest reasoned comments (8 + 8 👍) converge on SERVER2 + Azure AD, fully aligned with MS Learn. Confidence is held at 90% (not higher) because there is no official answer image and a minority pushed DC1.

More SC-300 practice questions