ExamworthyExamworthy
Open the appStart free

SC-300 - Plan and Implement Workload Identities - Section 3.2

Plan, implement, and monitor the integration of enterprise applications including on-premises and SaaS apps.

Integrate SaaS apps and on-premises web apps via Microsoft Entra Application Proxy into the enterprise application gallery and configure single sign-on methods including SAML, OIDC, and password-based SSO. Define application roles and monitor provisioning and sign-in activity for integrated apps.

enterprise application settingsMicrosoft Entra Application ProxySaaS app integrationsingle sign-on configurationapplication roles

Practice question for this objective

Free samplePlan and Implement Workload Identitiesmedium

An on-premises web application uses Integrated Windows Authentication against Active Directory and is published through Microsoft Entra Application Proxy with Microsoft Entra ID pre-authentication. After signing in to Microsoft Entra, users must be silently signed in to the back-end application using their Windows identity, without entering credentials again. Which single sign-on method should the administrator configure for the published application?

  • AConfigure SAML token-based single sign-on so the connector presents a signed assertion to the back-end and the application signs the user in using their Windows identity
  • BConfigure Kerberos constrained delegation so the connector obtains a Kerberos ticket on the user's behalf and the application signs them in using their Windows identity Correct
  • CConfigure header-based single sign-on so the connector injects identity headers and the application signs the user in using their Windows identity from those headers
  • DConfigure password-based single sign-on so the connector replays each user's stored credentials into the application and signs the user in using their Windows identity
Kerberos constrained delegation lets the Application Proxy connector obtain a Kerberos ticket for a pre-authenticated user, giving silent single sign-on to Integrated Windows Authentication apps. For an Integrated Windows Authentication back-end behind Application Proxy, Kerberos constrained delegation is the single sign-on method. After Microsoft Entra pre-authentication, the connector uses constrained delegation to obtain a Kerberos ticket on the user's behalf, so the application signs the user in with their Windows identity without a second prompt.

Why A is wrong: SAML single sign-on requires the back-end application to consume SAML assertions; an Integrated Windows Authentication app expects Kerberos, so a SAML assertion will not silently sign the user in.

Why B is correct: Integrated Windows Authentication back-ends accept Kerberos tickets, and Kerberos constrained delegation lets the Application Proxy connector obtain a ticket for the pre-authenticated user, delivering silent single sign-on with their Windows identity.

Why C is wrong: Header-based single sign-on suits applications that read identity from HTTP headers; an Integrated Windows Authentication back-end expects a Kerberos ticket rather than headers, so it does not provide silent sign-in here.

Why D is wrong: Password-based single sign-on replays credentials into an HTML login form and still depends on stored passwords; it does not perform Kerberos delegation for an Integrated Windows Authentication back-end.

See more SC-300 practice questions, answers explained.

More in this domain

Back to all Plan and Implement Workload Identities objectives, or the SC-300 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.