Examkin

Soru

Zorluk: OrtaMicrosoft Entra ID Authentication and Conditional Access

Aetheris Biotech is designing an identity and access management strategy for its Microsoft Entra ID tenant to comply with new pharmaceutical data protection standards. The cloud architecture team has identified four distinct security requirements for different groups of users and applications. Match each security and compliance requirement on the left to the most appropriate Microsoft Entra ID Conditional Access configuration or feature on the right that achieves the requirement with the least administrative effort.

  • Require external consultants to perform MFA and accept a data-sharing agreement every 30 days when accessing internal research portals.A Conditional Access policy utilizing session controls (Sign-in frequency) and grant controls (Terms of Use).
  • Enforce MFA for all off-site employee connections, while excluding requests that originate from the corporate headquarters' public IP addresses.A Conditional Access policy leveraging location conditions with Named Locations configured as excluded IP ranges.
  • Prevent access to the sensitive drug-formulation database if Entra ID detects abnormal sign-in patterns, such as travel to an unexpected location.A Conditional Access policy utilizing the Sign-in risk condition set to High with a Block access control.
  • Ensure administrators can only manage Azure resources if they are using a corporate-managed device that is registered and marked as healthy.A Conditional Access policy requiring a device to be marked as compliant or hybrid Microsoft Entra joined.

Cevap

The correct matches align each security requirement to its respective Microsoft Entra ID Conditional Access control. Specifically: external consultants re-verifying every 30 days maps to sign-in frequency and terms of use; enforcing MFA except for physical office IPs maps to location conditions with named location exclusions; preventing access on abnormal sign-in patterns maps to high sign-in risk condition; and requiring managed healthy devices maps to device compliance grant control.
Each business requirement correlates directly with a built-in Conditional Access capability: periodic re-validation uses Sign-in frequency and Terms of Use; office network bypass uses Named Location exclusions; abnormal behavior blocks use high sign-in risk evaluation; and managed/healthy devices utilize the device compliance grant control.

Adım Adım Çözüm

1
Map the requirement for external consultants re-authenticating and signing an agreement every 30 days.
This requires session duration limits (Sign-in frequency) and legal/policy acceptance (Terms of Use).
Sign-in frequency controls how often a user must sign in again, and Terms of Use ensures compliance agreements are accepted.
2
Map the requirement for enforcing MFA off-site but bypassing it on-site.
This requires location conditions using Named Locations as an exclusion.
Named Locations define trusted IP ranges, and excluding these ranges from the MFA policy allows seamless on-premises access.
3
Map the requirement for blocking access due to abnormal travel and sign-in behavior.
This requires configuring a Sign-in risk level policy targeting High risk.
Microsoft Entra ID Protection calculates real-time sign-in risk (such as atypical travel), which can be evaluated in Conditional Access policies to block access.
4
Map the requirement for administrative device health and management.
This requires device compliance or hybrid joined grant controls.
Requiring a device to be marked as compliant ensures the device meets organization health policies before allowing access.

Anahtar Kavram

Microsoft Entra ID Authentication and Conditional Access
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Microsoft Entra ID Authentication and Conditional Access