Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Apex Autonomy is designing a secure identity and access management strategy in Microsoft Entra ID. You need to match the specific security and operational access requirements to the corresponding Microsoft Entra Conditional Access settings.

To answer, match each security requirement on the left to the correct Conditional Access setting on the right.

  • Require external contractors to use phishing-resistant multi-factor authentication (MFA) when accessing sensitive source code repositories.Grant controls: Require authentication strength
  • Prevent users from copying, pasting, or downloading files when they access Exchange Online from unmanaged personal devices.Session controls: Use Conditional Access App Control
  • Force administrators to re-authenticate if they attempt to access the Azure portal after their session has been active for more than 4 hours.Session controls: Sign-in frequency
  • Block access to the enterprise resource planning (ERP) system if a user attempts to log in from a location not defined by IP ranges or GPS coordinates.Conditions: Location

Answer

To satisfy the security requirements:
- Requiring phishing-resistant MFA is accomplished by selecting the Grant controls: Require authentication strength setting.
- Restricting actions like downloading or copying files on unmanaged devices is achieved via the Session controls: Use Conditional Access App Control setting.
- Forcing administrative re-authentication after a set period is controlled by the Session controls: Sign-in frequency setting.
- Restricting access based on coordinates or IP ranges uses the Conditions: Location setting.
Each security requirement aligns with a specific component of a Microsoft Entra Conditional Access policy. Re-authentication frequency is managed through the Sign-in frequency session control. Control over device actions such as preventing downloads requires Session controls integrated with Microsoft Defender for Cloud Apps. Phishing-resistant MFA is enforced via Authentication strength in Grant controls. Geolocation or IP limits are managed via Location conditions.

Step-by-Step Solution

1
Analyze the first requirement for enforcing phishing-resistant MFA.
Identify that configuring specific MFA methods (like FIDO2 keys) is handled by Authentication Strength.
Authentication strength is a Grant control configuration that defines which authentication methods are acceptable for a user to access a resource.
2
Analyze the second requirement for preventing file downloads/copying on unmanaged devices.
Identify that restricting in-app actions requires session monitoring and enforcement via Microsoft Defender for Cloud Apps integration.
Conditional Access App Control is a Session control that proxies the web session to restrict real-time user activities like file downloads.
3
Analyze the third requirement for forcing administrator re-authentication after a set time.
Identify the setting that controls session duration lifetime.
Sign-in frequency is a Session control that sets the maximum time a session can remain valid before requiring new credential inputs.
4
Analyze the fourth requirement for restricting access based on geographical boundaries.
Identify the policy evaluation criterion for network origin.
The Location condition evaluates the IP or GPS position of the incoming request to determine whether to apply the policy rules.

Key Concept

Microsoft Entra ID Conditional Access controls and conditions mapping
Estimated Time:2m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access