Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- What is the basic form of a Conditional Access policy in Microsoft Entra?
a. Role-based assignment
b. If-then statement
c. Mandatory access control
d. Discretionary rule
Answer: b (Conditional Access policies are if-then statements) (Microsoft Learn) - When are Conditional Access policies enforced relative to authentication steps?
a. Before first-factor authentication
b. At the same time as first-factor
c. After first-factor authentication
d. Only during token renewal
Answer: c (Policies are enforced after first-factor authentication) (Microsoft Learn) - Which of the following is not a signal used by Conditional Access to make decisions?
a. User or group membership
b. Device health/compliance
c. Network location (IP)
d. File system permissions on local disk
Answer: d (File system permissions are not a signal used) (Microsoft Learn) - What is one possible result (control) a Conditional Access policy can require under “Grant” conditions?
a. Block access
b. Require multifactor authentication
c. Delete user account
d. Revoke all tokens permanently
Answer: b (Grant control may require MFA) (Microsoft Learn) - Which license is required to include risk-based signals from Microsoft Entra in Conditional Access policies?
a. Free license
b. P1 license
c. P2 license
d. Office 365 E1 license
Answer: c (Risk-based policies require Entra ID P2) (Microsoft Learn) - What happens when multiple Conditional Access policies apply to a user for the same sign-in?
a. Only the first policy is evaluated
b. The least restrictive policy wins
c. All policies must be satisfied
d. Policies are ignored
Answer: c (All applicable policies must be satisfied) (Microsoft Learn) - Which of these is a common “block” control in Conditional Access?
a. Require device to be marked compliant
b. Require terms of use acceptance
c. Block access entirely
d. Require password change
Answer: c (Block access is the restrictive decision) (Microsoft Learn) - Which condition allows an administrator to create trusted IP ranges for policy decisions?
a. Application condition
b. Client app condition
c. Network location / named locations
d. Device platform
Answer: c (Network/location named locations condition) (Microsoft Learn) - What is the “client apps” condition in Conditional Access used for?
a. To choose which OS platform is allowed
b. To specify which types of client applications the policy applies to
c. To define user groups
d. To schedule sign-in times
Answer: b (Client apps condition targets types of client applications) (Microsoft Learn) - Which of the following is recommended to avoid accidental lockout from policies?
a. Apply policy to All users immediately
b. Exclude emergency access (break-glass) accounts
c. Disable report-only mode
d. Use only block policies
Answer: b (Exclude emergency / break-glass accounts) (Microsoft Learn) - What is the role “Conditional Access Administrator” used for?
a. To create or modify Conditional Access policies
b. To manage tenant billing
c. To handle user mailbox settings
d. To manage Intune compliance policies
Answer: a (Conditional Access Administrator can create/modify CA policies) (Microsoft Learn) - Which policy mode allows you to see what a policy would do without enforcing it?
a. Enforced mode
b. Block mode
c. Report-only mode
d. Passive mode
Answer: c (Report-only mode) (Microsoft Learn) - In Conditional Access policy building, “Assignments” refer to which of the following?
a. Access controls
b. Signals
c. Included/excluded users, groups, apps
d. Session controls
Answer: c (Assignments = which users, groups, applications are included/excluded) (Microsoft Learn) - Which of these is not a possible “Grant” control?
a. Require approved client app
b. Require a compliant device
c. Block legacy authentication protocols at policy level
d. Require password change
Answer: c (Blocking legacy authentication is a broader policy decision, not a grant control) (Microsoft Learn) - What is an example of a “session control” that Conditional Access can enforce?
a. Requiring MFA
b. Blocking access
c. Limiting session duration
d. Excluding a user from policy
Answer: c (Session control such as limiting session duration or applying app-level controls) (Microsoft Learn) - Which of the following is a benefit of Conditional Access in IT security?
a. Always prompt MFA for every login
b. Grant blanket access to all devices
c. Dynamically adjust access based on risk and signals
d. Avoid using identity checks
Answer: c (Dynamically adjust access based on risk, device, location) (kelsercorp.com) - What principle of Zero Trust is Conditional Access a foundation for?
a. Trust by default
b. Always trust internal traffic
c. Never trust, always verify
d. Single sign-on without checks
Answer: c (Conditional Access supports Zero Trust: always verify) (threatscape.com) - What is “user risk” in Conditional Access context?
a. The possibility that an account is compromised
b. The chance of a device failing
c. The number of login attempts
d. The type of client application used
Answer: a (User risk is the probability that an identity is compromised) (Microsoft Learn) - What does “sign-in risk” refer to?
a. Device hardware failure risk
b. Probability that authentication request isn’t from the legitimate user
c. Risk associated with session timeout
d. Risk of token expiry
Answer: b (Sign-in risk is the probability the authentication is fraudulent) (Microsoft Learn) - Which device platforms are supported in Conditional Access conditions?
a. Only Windows and macOS
b. Android, iOS, Windows, macOS, Linux
c. Only mobile OS
d. None of the above
Answer: b (Android, iOS, Windows, macOS, Linux) (Microsoft Learn) - What happens if a Conditional Access policy is configured with “block access” control?
a. The user must provide MFA
b. Access is denied regardless of other controls
c. A warning is shown but access is granted
d. Only token refresh is blocked
Answer: b (Block access denies access entirely) (Microsoft Learn) - Which approach is recommended when deploying Conditional Access policies broadly?
a. Deploy to all users immediately
b. Use pilot groups and report-only mode first
c. Use only break-glass accounts
d. Avoid testing
Answer: b (Use pilot groups and report-only mode before full rollout) (Microsoft Learn) - What is the limit on the number of Conditional Access policies per tenant?
a. 100
b. 195
c. 500
d. Unlimited
Answer: b (There is a limit of 195 policies per tenant) (Microsoft Learn) - If two policies conflict (one requires MFA, another blocks access), which takes precedence?
a. The block control wins
b. MFA control wins
c. The older policy wins
d. The random choice
Answer: a (Block controls are enforced first) (Microsoft Learn) - Why should service accounts or managed identities often be excluded from Conditional Access policies?
a. They aren’t used for sign-in
b. They cannot meet MFA or compliance
c. They are always trusted
d. They automatically bypass policies
Answer: b (Because they can’t satisfy user-interactive controls like MFA) (Microsoft Learn) - What is a “named location” in Conditional Access?
a. A user group name
b. Predefined geographical or IP range used as a condition
c. The name of a policy
d. A time-based rule
Answer: b (Named location = a geographic or IP network range used in conditions) (Microsoft Learn) - Which of these is a scenario often implemented by Conditional Access:
a. Requiring MFA only when signing in from outside the corporate network
b. Always blocking mobile clients
c. Never prompting MFA
d. Granting unconditional access
Answer: a (Require MFA when access from outside network) (Microsoft Learn) - What tool helps you simulate a Conditional Access policy outcome for a user?
a. What-If tool
b. Azure CLI only
c. PowerShell simulation
d. Graph Explorer only
Answer: a (The What-If tool) (Microsoft Learn) - Why are legacy authentication protocols problematic under Conditional Access?
a. They support MFA
b. They pass full device signals
c. They don’t support MFA or device state signals
d. They are more secure
Answer: c (Legacy protocols don’t support MFA or device signal data) (Microsoft Learn) - What is the risk of combining “block” and “include all resources” in a single policy?
a. It simplifies management
b. It may lock out administrators
c. It is recommended
d. It has no effect
Answer: b (It may lock out admins) (Microsoft Learn) - What is a common starting “foundation” policy when deploying Conditional Access?
a. Block all access always
b. Enforce MFA registration or block legacy auth
c. Exclude all devices
d. Require device compliance for all apps immediately
Answer: b (Foundation policies: MFA registration, block legacy authentication) (Microsoft Learn) - Which Microsoft service integrates with Conditional Access to provide session-level control over cloud app usage?
a. Microsoft Defender for Cloud Apps
b. Exchange Online only
c. SharePoint only
d. Windows Server
Answer: a (Defender for Cloud Apps integrates session control) (Microsoft Learn) - What is the purpose of the “report-only” mode for a Conditional Access policy?
a. To enforce block only
b. To test effect without enforcing
c. To permanently disable policy
d. To remove the policy
Answer: b (Report-only lets you see what policy would do without enforcement) (Microsoft Learn) - Which of these should not be included in a Conditional Access pilot deployment group?
a. Emergency access accounts
b. Test users
c. A subset of production users
d. Users who must meet the policy
Answer: a (Emergency / break-glass accounts should be excluded) (Microsoft Learn) - Which of these is a best practice regarding naming of Conditional Access policies?
a. Use random names
b. Include sequence, resources, who, when in name
c. Use numbers only
d. Omit descriptive info
Answer: b (Naming standards should reflect sequence, resource, who, when) (Microsoft Learn) - What does “authentication context” refer to in Conditional Access configuration?
a. Location only
b. A special context a policy may reference (e.g. requiring stronger auth)
c. Just the user group
d. The token expiry time
Answer: b (Authentication contexts are contexts that policies can reference to require stronger auth) (Microsoft Learn) - Which of the following signals is not typically dynamic or real-time?
a. IP location
b. User behavior / risk
c. Group membership
d. Sign-in risk
Answer: c (Group membership is relatively static) (Microsoft Learn) - What is the role of Intune in Conditional Access in Microsoft Defender ecosystem?
a. Unrelated
b. Manage device compliance and feed compliance to CA
c. Replace Conditional Access entirely
d. Only manage mobile apps
Answer: b (Intune enforces device compliance state which CA uses) (Microsoft Learn) - When a device is flagged as high risk, what does Conditional Access typically do?
a. Automatically allow all access
b. Block access until remediation
c. Ignore the risk
d. Downgrade policy
Answer: b (Block access until device is remediated) (Microsoft Learn) - Which of these is a reason to disable security defaults before enabling custom Conditional Access policies?
a. They never interfere
b. They conflict with custom policies
c. They are identical
d. They are required together
Answer: b (Security defaults and custom CA policies aren’t meant to be combined) (Microsoft Learn) - In Conditional Access, what is the difference between “Include” and “Exclude” in assignments?
a. Include defines who the policy applies to; Exclude defines who is exempt
b. Include is stronger than Exclude
c. Exclude disables policy
d. No difference
Answer: a (Include part is subject to policy; Exclude part is exempt) (Microsoft Learn) - How do traditional “security defaults” differ from Conditional Access policies?
a. Security defaults are more granular
b. Security defaults are automatic, simpler, less customizable
c. They are the same thing
d. Conditional Access is deprecated
Answer: b (Security defaults are simple, automatic, less customizable) (AdminDroid Blog) - Which Conditional Access condition lets you block access from specific geographical regions?
a. Device compliance condition
b. Named location (IP/location) condition
c. Client app condition
d. User principal name condition
Answer: b (Named location / network location lets you block by region) (Microsoft Learn) - What should be done before fully enabling a new Conditional Access policy?
a. Remove all users
b. Enable immediately for all
c. Test in report-only mode with a pilot group
d. Delete other policies
Answer: c (Test in report-only and pilot groups first) (Microsoft Learn) - Which of these is a potential negative consequence of a poorly configured Conditional Access policy?
a. Improved security
b. Locked out administrators
c. No effect
d. Unlimited access
Answer: b (Misconfiguration can lock out admins) (Microsoft Learn) - What is the recommended strategy for applying Conditional Access to all applications?
a. Create individual policies per app always
b. Use groupings and assign a policy covering many apps
c. Only protect Microsoft 365 apps
d. Do nothing
Answer: b (Group apps with similar requirements and assign one policy) (Microsoft Learn) - Which of these is true about protected actions in Conditional Access?
a. They are not supported
b. They require fresh MFA to change CA policies
c. They disable policies
d. They are unrelated to CA
Answer: b (Protected actions may require fresh MFA before changing CA policies) (Microsoft Learn) - In what scenario might you block access from “other clients / legacy clients” in Conditional Access?
a. When a client supports modern auth
b. To enforce blocking legacy authentication protocols
c. When client is trusted
d. Always allow other clients
Answer: b (Block legacy auth by using “Other clients” condition) (Microsoft Learn) - What is “emergency access (break-glass) account” used for in CA policy planning?
a. Apply restrictive policy
b. Exclude from all policies to ensure administrative access remains
c. Use for normal users
d. Remove it altogether
Answer: b (Break-glass accounts should be excluded so they can restore access in emergencies) (Microsoft Learn) - Which of the following best describes Conditional Access?
a. A static firewall rule engine
b. A policy-driven, real-time access decision engine using multiple signals
c. A replacement for MFA
d. A file-level access control system
Answer: b (Conditional Access is a policy-driven, real-time access decision engine using signals) (Microsoft Learn)
