AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company wants to allow remote users to access an internal web application hosted on-premises without opening inbound firewall ports. They need seamless single sign-on (SSO) using Microsoft Entra ID credentials. Which Azure service should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Entra ID Application Proxy with a VPN or DirectAccess solution, but the key differentiator is that Application Proxy requires no inbound firewall rules and uses outbound-only connectivity, which is a common exam scenario for secure remote access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Application Proxy
Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications without requiring inbound firewall ports. It works by establishing an outbound connection from the on-premises Application Proxy connector to the Entra ID service, then routing user traffic through that tunnel. It integrates with Entra ID for pre-authentication and supports seamless SSO using the user's existing Entra ID credentials via Kerberos constrained delegation (KCD) or header-based authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Application Proxy
Why this is correct
Microsoft Entra ID Application Proxy is a reverse proxy that securely publishes on-premises web applications to remote users through the Microsoft Entra ID service. It uses a lightweight connector on the internal network that initiates outbound connections, eliminating the need for inbound firewall ports or VPN. This enables seamless single sign-on and integration with Conditional Access policies, making it the ideal solution for internal app access.
- ✗
Microsoft Entra ID B2C
Why it's wrong here
Microsoft Entra ID B2C is a customer identity and access management service intended for external-facing applications, allowing customers to register and sign in with local or social accounts. It focuses on managing customer identities and authentication flows, not on publishing internal corporate web applications to employees. Its feature set does not include reverse proxy capabilities or integration with an existing on-premises app for remote employee access.
- ✗
Microsoft Entra ID Domain Services
Why it's wrong here
Microsoft Entra ID Domain Services provides managed domain infrastructure, including domain join, LDAP, Kerberos, and group policy support for Azure virtual machines. It does not function as an application proxy or web publishing gateway, and it cannot expose an internal web app to external users. Its purpose is to offer classic directory services for applications and VMs that require domain authentication, not remote access to web apps.
- ✗
Microsoft Entra ID Connect
Why it's wrong here
Microsoft Entra ID Connect is a hybrid identity synchronization tool that replicates on-premises user, group, and password hashes to Microsoft Entra ID for consistent identities across both environments. It does not have any mechanism to broker external access to an on-premises web application; it simply synchronizes directory data. Allowing remote users to reach an internal app requires a publishing or reverse proxy solution, not identity sync.
Go deeper
Related to this question
About these practice questions
One of 204 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.