User1 is a cloud-only account, so authentication is performed entirely in Azure AD and never depends on the on-premises network. The Azure AD Connect settings in the exhibit show Password Hash Synchronization (PHS) enabled. User3 is a synchronized account whose password hash has been copied to Azure AD; authentication is therefore executed in Azure AD and still succeeds when the on-premises environment is offline. User2 is configured for Pass-through Authentication (PTA). PTA requires Azure AD to contact an on-premises Authentication Agent to validate the password against Active Directory. Because the on-premises network has lost Internet connectivity, the agent cannot be reached and User2’s sign-in fails.

B User3 (PHS) can also authenticate; limiting the answer to User1 is incomplete. C User2 uses PTA; without Internet connectivity the authentication agent is unreachable, so User2 cannot sign in. D User2 cannot authenticate for the reason above; including User2 makes the option wrong.

1. Microsoft, “Choose the right authentication method for your hybrid identity,” section “Password hash synchronization sign-in flow,” para. 1-3 (docs.microsoft.com/azure/active-directory/hybrid/choose-ad-authn).

2. Microsoft, “How pass-through authentication works,” section “Sign-in flow,” para. 4 (docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-pta).

3. Microsoft, “Password hash synchronization with Azure AD Connect,” Overview, para. 2-3 (docs.microsoft.com/azure/active-directory/hybrid/whatis-phs).