SC-100 Design security solutions for infrastructure Practice Question
Your company is designing a hybrid identity solution using Microsoft Entra ID. You need to ensure that users can access on-premises applications using modern authentication methods. The solution must support multi-factor authentication and Conditional Access policies. What should you implement?
⚠ Common exam trap
SC-100 often tests the confusion between identity synchronization (Entra Connect), managed domain services (Microsoft Entra Domain Services), and application publishing (application proxy) — candidates must map the requirement 'modern auth to on-prem apps' to application proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra application proxy
Microsoft Entra application proxy publishes on-premises web applications to the cloud, letting remote users reach them through Entra ID. Because authentication flows through Entra ID, it natively supports modern authentication, MFA, and Conditional Access policies. This is the correct solution for hybrid access to on-prem apps with modern identity controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Connect
Why it's wrong here
Microsoft Entra Connect is a directory synchronization engine that copies identity objects such as users, groups, and password hashes between on-premises Active Directory and Microsoft Entra ID. It supports password hash synchronization, pass-through authentication, and federation, but it has no capability to accept inbound HTTP requests or proxy traffic to internal applications. Publishing an on-premises web service externally requires a reverse proxy that terminates client sessions and forwards requests, which is not a function of the sync engine, making this option incorrect.
- ✓
Microsoft Entra application proxy
Why this is correct
Microsoft Entra application proxy is the correct choice because it publishes on-premises web applications to external users through an outbound connector installed on an internal server. The connector establishes an outbound connection to Microsoft Entra ID, eliminating the need for inbound firewall rules; users authenticate against Entra ID with support for MFA, conditional access, and modern protocols, after which requests are routed via the connector to the internal application. This enables secure remote access to legacy apps without a VPN.
- ✗
Microsoft Entra Domain Services
Why it's wrong here
Microsoft Entra Domain Services (now Microsoft Entra Domain Services) provides a managed domain with LDAP, Kerberos/NTLM authentication, and domain join capabilities for Azure VMs, but it does not function as an application publishing gateway. It offers identity and authentication services for legacy workloads, yet it cannot accept inbound client traffic from the internet or proxy requests to internal applications. Since external app access requires a reverse proxy, this service does not satisfy the requirement.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based endpoint management platform focused on mobile device management (MDM) and mobile application management (MAM), including compliance policies, app deployment, and device configuration. It does not offer a reverse proxy, URL-based publishing, or any HTTP session brokering mechanism to expose on-premises applications to external users. While Intune can enforce security policies on devices that access applications, it cannot route or forward web requests, making it irrelevant for this hybrid access scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.