A lock-operator shop has no Entra-joined laptops but can issue device certificates from its CA for VPN clients. Which point-to-site authentication method fits that shop?
Select an answer to reveal the explanation.
Short Explanation
No Entra-joined laptops? Hand them certs from the shop CA—or RADIUS if NPS is already humming. P2S can authenticate with certificates; Entra is the other lane for joined gear, not a client-secret paste job.
Full Explanation
Azure VPN Gateway point-to-site supports Microsoft Entra ID, Azure certificate authentication, and RADIUS options. A lock-operator shop with no Entra-joined laptops but a CA that can issue device certificates should use Azure certificate authentication for P2S (or RADIUS if NPS already exists), contrasting with Entra ID authentication for joined devices.
Claiming Microsoft Entra ID authentication only is required because certificate authentication is unsupported fails—certificate auth is a supported P2S method. Pasting an app-registration client secret into each VPN client fails as a tunnel credential model. Assigning subscription Owner so operators open ports without VPN authentication fails least privilege and abandons encrypted remote access.
Exam caveat: know which P2S auth methods map to which device estates on AZ-500. Operational check: issue client certificates from the shop CA, configure root cert on the gateway, connect a non-joined laptop, and revoke a test cert to prove offboarding works. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.