Exam SC-300 topic 6 question 2 discussion

@spinnetho - the correct answer is A - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#common-questions

The question is Tricky! it mentions "meet authentication requirements" and if you just read this and go back up to read the "Authentication Requirements" there is nothing that mentioned anything related to needing PHS. HOWEVER!!!!!! If you read the whole question again "You need to meet the authentication requirements FOR LEAVK CREDENTIALS", you realize there is nothing that mentioned LEAKED CREDENTIALS on the "Authentications Requirements" related to it. The answer is A because none of the other ones has anything to do with LEAKED CREDENTIALS. You don't use B for anything related to LEAKED CREDENTIALS - You would use this one for addressing the requirement You don't use C for anything related to LEAKED CREDENTIALS You don't use D for anything related to LEAKED CREDENTIALS I had to read this multiple times!!! LOL

Correct Answer is PHS required for leaked credentials, because Password Protection compares against a fixed list. On-premises deployment of Microsoft Entra Password Protection uses the same global and custom banned password lists that are stored in Microsoft Entra ID. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad-on-premises

Protect against leaked credentials and add resilience against outages The simplest and recommended method for enabling cloud authentication for on-premises directory objects in Microsoft Entra ID is to enable password hash synchronization (PHS).

I think A actually makes a lot of sense since the case study mentions they use pass-through auth with hash sync disabled. This would mean that Azure AD doesn't know the password hash and can't compare it with the hashes from the leaked credentials list. Once you enable the hash sync, Azure can start comparing the password hashes to the hashes from the leaked creds list.

Enabling PTH sync does nothing to solve for question. Automatically detect and remediate externally leaked credentials. It is needed to allow for other steps that do. Yet another bad question that forces you make unstated assumptions to determine the "best" answer.

Catch is " leaked credentials" . B is correct.

A. Enable password hash synchronization in Azure AD Connect.

The Users with leaked credentials report in Azure AD warns of username and password pairs, which have been exposed publically. An incredible volume of passwords is leaked via phishing, malware, and password reuse on third-party sites that are later breached. Microsoft finds many of these leaked credentials and will tell you, in this report, if they match credentials in your organization – but only if you enable password hash sync or have cloud-only identities. https://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity#protect-against-leaked-credentials-and-add-resilience-against-outages

Password hash synchronization "Risk detections like leaked credentials require the presence of password hashes for detection to occur. For more information about password hash synchronization, see the article, Implement password hash synchronization with Azure AD Connect sync." https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#password-hash-synchronization

Password Hash Sync also enables leaked credential detection for your hybrid accounts. Microsoft works alongside dark web researchers and law enforcement agencies to find publicly available username/password pairs. If any of these pairs match those of our users, the associated account is moved to high risk.

just pass the exam today. This came in the question.

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#leaked-credentials

It's A. Everyone knows that leaked credentials detection comes with PHS, right? Not sure why all the debate. Next question...

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises#design-principles The software isn't dependent on other Azure AD features. For example, Azure AD password hash sync (PHS) isn't related or required for Azure AD Password Protection.

This clearly states that PSH isn't required https://docs.microsoft.com/en-us/learn/modules/manage-user-authentication/5-deploy-manage-password-protection

Azure ad password protection is configured when there is requirement of including Banned password. how can anyone configure leaked credential in banned password section so the answer should be Password Hash Synchronization. as a same time if there was no password hash synchronization option in answer section the it should be answer D