Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Zenith Financial Services is designing an identity security strategy using Microsoft Entra ID. The design must meet specific access control requirements for various user roles and device states.

Match each business security requirement to the correct Microsoft Entra ID Conditional Access or authentication control.

  • Require user sign-in sessions to Microsoft 365 applications to prompt for re-authentication every 12 hours.Conditional Access session control: Sign-in frequency
  • Limit web-based email access to read-only mode and block attachment downloads on unmanaged personal devices.Conditional Access session control: App enforced restrictions
  • Allow access to cloud applications only from devices that are registered in Microsoft Entra ID and meet corporate security baselines.Conditional Access grant control: Require device to be marked as compliant
  • Enforce the use of FIDO2 security keys or Windows Hello for Business when administrators access the Azure portal.Conditional Access grant control: Require authentication strength

Answer

The correct matches are: 1) Prompting for re-authentication every 12 hours matches 'Conditional Access session control: Sign-in frequency'. 2) Blocking attachment downloads on personal devices matches 'Conditional Access session control: App enforced restrictions'. 3) Restricting access to compliant devices matches 'Conditional Access grant control: Require device to be marked as compliant'. 4) Requiring FIDO2 or Windows Hello for Business matches 'Conditional Access grant control: Require authentication strength'.
The correct matches map the specific technical capabilities of Microsoft Entra ID to the corresponding business scenarios. Requiring re-authentication after a set timeframe is handled by the Sign-in frequency session control. Restricting specific app actions like downloading email attachments is managed via App enforced restrictions. Allowing access only to healthy devices is enforced through the 'Require device to be marked as compliant' grant control. Restricting the login methods to phishing-resistant mechanisms such as FIDO2 is handled by the 'Require authentication strength' grant control.

Step-by-Step Solution

1
Analyze the requirement for prompting user sessions to re-authenticate every 12 hours.
This relates to session lifetime and re-authentication intervals, which is controlled by the Sign-in frequency session control.
Sign-in frequency determines how long a user's session token is valid before they must authenticate again.
2
Analyze the requirement to restrict email attachment downloads on unmanaged personal devices.
This requires collaborating with the underlying application (Exchange Online) to restrict in-app features based on device compliance, which is managed via App enforced restrictions.
App enforced restrictions allow application-level session controls to be applied dynamically based on the device's status.
3
Analyze the requirement to restrict access only to registered and compliant devices.
This represents a binary grant decision (allow or deny) based on device compliance, which maps to the 'Require device to be marked as compliant' grant control.
Device compliance verification requires MDM enrollment (like Microsoft Intune) to evaluate and report on compliance status.
4
Analyze the requirement to mandate FIDO2 or Windows Hello for Business.
This restricts the permitted authentication methods to phishing-resistant options, which is configured via the 'Require authentication strength' grant control.
Authentication strength allows defining specific authentication method requirements, including custom or pre-defined phishing-resistant policies.

Key Concept

Microsoft Entra ID Authentication and Conditional Access controls (Grant controls vs Session controls)
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access