Quick Answer

The answer is Microsoft Entra ID Application Proxy and Conditional Access, along with two other features that collectively define its identity and access management capabilities. Application Proxy is correct because it allows secure access to on-premises web applications without a VPN by routing traffic through Entra ID’s cloud service and enforcing pre-authentication, which validates the user’s identity before reaching the app. Conditional Access is correct as it evaluates real-time signals like user identity, device compliance, location, and application risk to enforce policies such as MFA, providing granular, context-aware access control. On the MS-102 exam, this topic tests your ability to distinguish between core Entra ID features and third-party or deprecated tools; a common trap is confusing Application Proxy with Azure AD Domain Services or assuming Conditional Access only applies to cloud apps. Remember the mnemonic “PACE” for the four key features: **P**roxy, **A**ccess (Conditional), **C**onditional, and **E**ntra ID Protection—each directly supports identity-driven security without requiring additional infrastructure.