Microsoft Certified: Identity and Access Administrator Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  In this hybrid identity setup with Azure AD Connect: Pass-through Authentication (PTA) is enabled (with 2 agents), and Password Hash Synchronization (PHS) is also enabled. PTA is the primary authentication method and takes precedence. PTA requires real-time communication between Azure AD and the on-premises PTA agents (which validate credentials against on-premises Active Directory). When connectivity from the on-premises domain to the internet is lost, the PTA agents cannot communicate with Azure AD. This prevents PTA-based authentication for directory-synced users (User2). Failover to PHS is not automatic; it requires manual intervention via Azure AD Connect.

• Chose C1

  c is correct

• Chose A1

  When PTA is in use and on-prem connectivity is down: Cloud-only and guest users can still authenticate to Azure AD. Directory-synced users cannot authenticate because PTA cannot validate their credentials.