A company has a conditional access policy that requires MFA for all users when accessing a sensitive app. They also have a policy that requires a compliant device for the same app. A user signs in from a non-compliant device and is prompted for MFA, but after completing MFA, they are still blocked. What is the most likely reason?

The user is not assigned to the compliant device policy.

The MFA policy is configured to block access instead of require MFA.

The user did not complete MFA correctly.

The compliant device policy is also being enforced, and the user's device is not compliant.

How are multiple Conditional Access policies evaluated when a user signs in?

Only the first policy in the list is evaluated, and others are ignored

All policies are evaluated together, and the most restrictive combination of controls is applied

Policies are evaluated in order of creation, and the last one overrides all previous ones

Policies are evaluated in a random order and the first one to match is applied

A security team is designing conditional access policies and wants to minimize the risk of lockouts while maintaining security. Which approach should they take?

Create a single policy that applies to all users and all apps, and require MFA.

Create multiple policies with specific conditions and test them in report-only mode before enabling.

Use only the default policies provided by the cloud provider.

Exclude all administrators from all policies to avoid lockouts.

A company is implementing conditional access policies and wants to ensure that administrators can always access the system even if a policy accidentally locks them out. Which practice should they implement?

Create a dedicated emergency access account that is excluded from all conditional access policies and stored securely.

Create a conditional access policy that requires MFA for all admins, and rely on the default admin accounts.

Create a conditional access policy that blocks all access for admins, and use a separate non-admin account for daily work.

Create a conditional access policy that excludes the global admin accounts from all policies.

Which of the following is an example of a 'condition' that can be configured in a Conditional Access policy?

Assigning the policy to a specific user group

Blocking access from specific locations

Requiring multi-factor authentication

Allowing access to a specific cloud app

GIAC Cloud Security Architecture and Design

Domain 1Objective 4

Conditional Access Policies GCAD Practice Questions (Page 4)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

Questions 16–20

16expert · hard
A company has a conditional access policy that requires MFA for all users when accessing a sensitive app. They also have a policy that requires a compliant device for the same app. A user signs in from a non-compliant device and is prompted for MFA, but after completing MFA, they are still blocked. What is the most likely reason?
Select an answer first
17foundation · easy
How are multiple Conditional Access policies evaluated when a user signs in?
Select an answer first
18application · medium
A security team is designing conditional access policies and wants to minimize the risk of lockouts while maintaining security. Which approach should they take?
Select an answer first
19application · medium
A company is implementing conditional access policies and wants to ensure that administrators can always access the system even if a policy accidentally locks them out. Which practice should they implement?
Select an answer first
20foundation · easy
Which of the following is an example of a 'condition' that can be configured in a Conditional Access policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.