AZ-700 Question 106
Single answerYou are a network engineer for a company that employs a globally distributed workforce needing secure remote access to Azure resources. Your organization does not manage an internal public key infrastructure (PKI), and you want employees to use multi-factor authentication without deploying certificates to each device. You are setting up a Point-to-Site (P2S) VPN gateway in Azure. Which authentication method should you select to meet these requirements with minimal overhead?
- A
Azure AD authentication
- B
Certificate-based authentication
- C
SAML with a third-party identity provider
- D
RADIUS authentication with on-premises domain controllers
Show answer and explanation
Correct answer: A
Explanation
When configuring a Point-to-Site VPN in Azure, you can choose Azure AD authentication to leverage built-in multi-factor authentication without managing certificates. This approach simplifies your environment if you do not have a PKI and aligns with recommended practices for remote access security in Azure. For more information, see the official Microsoft documentation on setting up Point-to-Site VPN with Azure AD authentication: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-point-to-site-use-azure-ad.
- A. Correct.
Azure AD authentication is correct because it allows you to leverage Azure multi-factor authentication without deploying or managing certificates. This option is integrated with Azure Active Directory, making it simpler for large workforces that do not have a PKI in place.
- B. Incorrect.
Certificate-based authentication requires you to manage and distribute certificates to each client, which can become cumbersome without a PKI. This does not align with the requirement to avoid certificate management overhead.
- C. Incorrect.
SAML with a third-party identity provider is possible, but it introduces additional configuration complexity and dependency on external IdPs. Since Azure AD is already available and can provide multi-factor authentication, SAML with a separate IdP is not the simplest approach.
- D. Incorrect.
RADIUS authentication with on-premises domain controllers forces you to maintain on-prem infrastructure and does not inherently provide Azure MFA. Additional integrations would be needed to enable multi-factor authentication, making it more complex than direct Azure AD authentication.