AZ-305 Question 32
Single answerYou are designing a solution for a manufacturing company that needs to grant its remote staff secure access to an internal, on-premises web application. The company wants to use Azure Active Directory for authentication and enforce Conditional Access without opening additional inbound ports besides HTTPS (443). They also want a solution requiring minimal infrastructure changes on-premises. Which approach should you recommend?
- A
Publish the on-premises application through Azure AD Application Proxy
- B
Enable Pass-through Authentication via Azure AD Connect for remote access
- C
Implement a Site-to-Site VPN and route all application traffic through the VPN
- D
Deploy Active Directory Federation Services (AD FS) in a separate perimeter network
Show answer and explanation
Correct answer: A
Explanation
Azure AD Application Proxy is specifically designed to publish on-premises applications to remote users while integrating with Azure AD for authentication and Conditional Access. It requires only outbound connections over port 443 from the on-premises connector, minimizing changes to firewall configurations. For more information, refer to Microsoft’s documentation on Azure AD Application Proxy: https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy.
- A. Correct.
Option 1: Correct. Azure AD Application Proxy allows remote users to securely access on-premises web applications using Azure AD for authentication. It works over port 443, supports Conditional Access policies, and requires minimal changes to the existing infrastructure.
- B. Incorrect.
Option 2: Incorrect. Pass-through Authentication with Azure AD Connect ensures users can authenticate against on-premises domain controllers, but it does not itself provide a reverse proxy for remote access. It addresses identity validation but not the publishing of on-premises apps over the internet.
- C. Incorrect.
Option 3: Incorrect. While a Site-to-Site VPN can provide secure connectivity, it forces all remote traffic to flow back through your on-premises network. This approach adds complexity and may not minimize on-premises infrastructure changes or ports, and it doesn’t directly leverage Conditional Access without additional configuration.
- D. Incorrect.
Option 4: Incorrect. Deploying AD FS in a perimeter network does enable federation with Azure AD, but it generally requires more infrastructure and maintenance. It also involves opening more ports and maintaining additional servers, which does not align with the minimal infrastructure change requirement.