Which store option should be selected when you need contractors who are onsite and not Active Directory users to access resources securely?

Which store option should be selected when you need contractors who are onsite and not Active Directory users to access resources securely?

• A. HTTP Basic
• B. Unauthenticated
• C. Smart card
• D. Pass-through

Answer: (B)

When users don’t have Active Directory identities, you need an authentication path that doesn’t rely on AD credentials. The option labeled unauthenticated is the one that allows access without requiring an AD login, which aligns with contractors who are onsite and not AD users. This approach focuses on granting access through other controls (like device posture, network restrictions, or separate authorization mechanisms) rather than tying permissions to AD accounts. The other methods depend on some form of credential or credential mapping to an identity. HTTP Basic would transmit credentials (even if over TLS) and isn’t ideal for security. Smart card requires issuing and handling physical cards and a PKI setup. Pass-through relies on the endpoint’s Windows credentials, which typically come from AD. So for contractors without AD identities, unauthenticated access is the one that fits the scenario, provided you implement strong secondary security controls to compensate for the lack of AD-based identity.

When users don’t have Active Directory identities, you need an authentication path that doesn’t rely on AD credentials. The option labeled unauthenticated is the one that allows access without requiring an AD login, which aligns with contractors who are onsite and not AD users. This approach focuses on granting access through other controls (like device posture, network restrictions, or separate authorization mechanisms) rather than tying permissions to AD accounts.

The other methods depend on some form of credential or credential mapping to an identity. HTTP Basic would transmit credentials (even if over TLS) and isn’t ideal for security. Smart card requires issuing and handling physical cards and a PKI setup. Pass-through relies on the endpoint’s Windows credentials, which typically come from AD. So for contractors without AD identities, unauthenticated access is the one that fits the scenario, provided you implement strong secondary security controls to compensate for the lack of AD-based identity.