On which server should you install an additional pass-through authentication agent?

You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest. The tenant-uses through authentication.

A corporate security policy states the following:

✑ Domain controllers must never communicate directly to the internet.

✑ Only required software must be- installed on servers.

The Active Directory domain contains the on-premises servers shown in the following table.

You need to ensure that users can authenticate to Azure AD if a server fails.

On which server should you install an additional pass-through authentication agent?
A . Server2
B . Server4
C . Server1
D . Server3

Answer: C