Conditional Access Policies GCAD Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational company has a conditional access policy that requires MFA for all users when accessing from outside the corporate network. However, users in the sales department frequently travel and complain about MFA prompts. The security team wants to reduce MFA prompts for these users while maintaining security. Which approach should they take?

   • ACreate a separate policy for the sales department that requires MFA only when risk is medium or high.
   • BKeep the existing policy and ask users to tolerate the MFA prompts.
   • CDisable MFA for all users and rely on passwords.
   • DExclude the sales department from the MFA policy.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following are the three main components of a Conditional Access policy?

   • AAssignments, conditions, and access controls
   • BUsers, groups, and roles
   • CAllow, deny, and session controls
   • DSign-in risk, user risk, and device state
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security architect is designing conditional access policies for a large enterprise. They want to ensure that at least one emergency access account is not blocked by any conditional access policy. The enterprise uses Azure AD. What is the recommended approach?

   • APlace the emergency access account in a group that is excluded from all conditional access policies.
   • BUse a separate Azure AD tenant for emergency access.
   • CEnsure the emergency access account has a strong password and is not excluded from any policies.
   • DCreate a conditional access policy that excludes the emergency access account from all policies.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A user reports that they are being blocked from accessing a cloud app even though they believe they meet all requirements. The admin wants to determine which conditional access policy is causing the block. What should the admin do first?

   • ACheck the user's group memberships to see if they are in any groups that might be excluded from policies.
   • BDisable all conditional access policies and ask the user to try again.
   • CReview the audit logs for policy changes to see if a policy was recently modified.
   • DReview the sign-in logs for the user's sign-in attempt and look at the conditional access policy evaluation details.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A user reports that they are being prompted for MFA every time they access a cloud app, even though the conditional access policy is configured to require MFA only for risky sign-ins. The user's sign-in risk is always low. The administrator wants to troubleshoot the issue. Which log or report should the administrator review first?

   • AAzure AD Sign-in logs
   • BAzure AD Audit logs
   • CMicrosoft Cloud App Security activity logs
   • DAzure AD Identity Protection reports
   Reveal Solution Discussion Select an answer first