Section: [none]
Explanation:
With Pass-through Authentication the on-premises passwords are never stored in the cloud in any form.
Scenario:
* Prevent user passwords or hashes of passwords from being stored in Azure.
* Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
* Minimize administrative effort whenever possible.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta Testlet 3 Case Study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam.
You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview. General Overview
Litware, Inc. is a medium-sized finance company. Litware recently acquired a financial services company named Fabrikam, Ltd.
Overview. Physical Locations
Litware has a datacenter in Boston. Fabrikam has a datacenter in San Francisco.
Existing Environment. Identity Environment
The network of Litware contains an Active Directory forest named Litware.com that syncs to an Azure Active Directory (Azure AD) tenant named Litware.com by using Azure AD Connect.
Azure AD Seamless Single Sign-on (Azure AD Seamless SSO) is enabled for the Litware.com tenant.
Users at Litware have a UPN suffix of Litware.com
Litware has an internal certification authority (CA) that is trusted by all devices.
The network of Fabrikam contains an Active Directory forest named fabrikam.com. Users at Fabrikam have a UPN suffix of fabrikam.com.
Existing Environment. Azure Environment
Litware has an Azure subscription named Sub1 that is linked to the Litware.com tenant. Sub1 contains the resources shown in the following table.

Litware has Azure Resource Manager (ARM) templates that deploy Azure Policy definitions and assignments to a management group.
Fabrikam does NOT have an Azure environment.
Existing Environment. On-Premises Environment
The on-premises network of Litware contains the resources shown in the following table.

The on-premises network of Fabrikam contains a domain member server named SERVER1 that runs Windows Server 2019.
Existing Environment. Network Environment
Litware has a site-to-site VPN connection to VNet1.
The Litware and Fabrikam datacenters are not connected.
Requirements. Planned Changes
Litware plans to implement the following changes:
* Establish a trust relationship between the Litware and Fabrikam forests.
* Migrate data from the on-premises NoSQL datastores to Azure Table storage.
* Containerize WebApp1 and deploy the app to an Azure Kubernetes Service (AKS) cluster on VNet1.
* Create an Azure blueprint named BP1 and use the blueprint to provision a resource group named RG1.
Requirements. Deployment Requirements
Litware identifies the following deployment requirements:
* The existing ARM templates must be used for deployments to Sub1.
* WebApp1 must be deployed to the AKS cluster without having to change the source code.
Requirements. Authentication and Authorization Requirements
Litware identifies the following authentication and authorization requirements:
* The Fabrikam users must be able to authenticate to the Litware.com tenant by using Azure AD Seamless SSO.
* The Fabrikam users and the Litware users must be able to manage the Azure resources in Sub1.
* Company policy must prohibit the creation of guest user accounts in the Litware.com tenant.
* You must be able to configure deny permissions for RG1 and for the resources in RG1.
* WebApp1 running on the AKS cluster must be able to retrieve secrets from KV1.
Requirements. Security Requirements
Litware identifies the following security requirements:
* On-premises Litware users must access KVI by using the private IP address of the key vault.
* Azure virtual machines must have all their disks encrypted, including the temporary disks.
* Azure Storage must encrypt all data by using keys issued by the internal CA of Litware.
* Inbound HTTPS traffic to WebApp1 must be inspected for SQL injection attacks.
* The principle of least privilege must be used.

Explanation

Azure Functions deployment slots allow your function app to run different instances called "slots". Slots are different environments exposed via a publicly available endpoint. One app instance is always mapped to the production slot, and you can swap instances assigned to a slot on demand.
There are a number of advantages to using deployment slots. The following scenarios describe common uses for slots:
* Different environments for different purposes: Using different slots gives you the opportunity to differentiate app instances before swapping to production or a staging slot.
* Easy fallbacks: After a swap with production, the slot with a previously staged app now has the previous production app. If the changes swapped into the production slot aren't as you expect, you can immediately reverse the swap to get your "last known good instance" back.
* Prewarming
Reference:
https://docs.microsoft.com/en-us/azure/azure-functions/functions-deployment-slots

Explanation

Box 1: Azure Application Gateway
You can create an application gateway with URL path-based redirection using Azure PowerShell.
Box 2: Path-based redirection and Websockets
Reference:
https://docs.microsoft.com/bs-latn-ba/azure//application-gateway/tutorial-url-redirect-powershell

Reference:
https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-cosmosdb-portal