Exam AZ-500 topic 2 question 24 discussion

Actual exam question from Microsoft's AZ-500

Question #: 24
Topic #: 2

HOTSPOT -
You create a new Azure subscription that is associated to a new Azure Active Directory (Azure AD) tenant.
You create one active conditional access policy named Portal Policy. Portal Policy is used to provide access to the Microsoft Azure Management cloud app.
The Conditions settings for Portal Policy are configured as shown in the Conditions exhibit. (Click the Conditions tab.)

The Grant settings for Portal Policy are configured as shown in the Grant exhibit. (Click the Grant tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1: Yes -
The Contoso location is included in the policy and MFA is required.

Box 2: No -
The policy applies to the Azure portal and Azure management endpoints. The policy does not apply to web services host in Azure.

Box 3: No -
The policy applies only to users in the Contoso location. The policy does not apply to users external to the Contoso location.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

by gsidhwani77 at July 5, 2021, 2:43 p.m.

Comments

Submit Cancel

Orel123

Highly Voted 2 years, 4 months ago

YES - Contoso location requires MFA to use AZ Portal NO - Contoso location does not require MFA to use web NO - External users from Contoso location are not required to use MFA for AZ portal https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa?toc=/azure/active-directory/conditional-access/toc.json&bc=/azure/active-directory/conditional-access/breadcrumb/toc.json#configure-the-conditions-for-multi-factor-authentication https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#microsoft-cloud-applications

upvoted 24 times

...

Dushank

Highly Voted 2 years, 6 months ago

Given answer is correct. 1) Yes - B'cos the users are accessing from Contoso location and it's included in the condition. 2) No - The cloud App is selected as "Microsoft Azure Management cloud app" . The question asks when users are accessing "Web services hosted in Azure subscription" 3) No - No other location other than "Contoso" location is selected. So when users connect from other locations, it will not prompt for MFA.

upvoted 11 times

...

2 years, 5 months ago

For me answers are: n n n Portal Policy is used to provide access to the Microsoft Azure Management cloud app. Policy is not limit access to portal. It limits access to cloud app only. Unfortunately we don't know the name of used Cloud App but it definitely not Web or Portal.

upvoted 1 times

kakakayayaya

2 years, 5 months ago

I was wrong! The Microsoft Azure Management application includes Azure portal! So provided answers are correct. https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps

upvoted 6 times

us3r

1 year, 9 months ago

2 years, 6 months ago

All should be yes. As Approved Apps are not selected. All Apps used from Contoso Location should be allowed access MFA. In case of Location Constraint - If coming from outside Contoso then MFA is mandatory.

upvoted 2 times

...