Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Conditional Access Enforcing MFA for Zero Trust
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is adopting a Zero Trust security model to protect its cloud applications and data. The security team needs a solution that automatically evaluates sign-in context—such as user identity, application, and device status—and enforces Multi-Factor Authentication (MFA) before granting access to resources.
Which feature should the organization configure to enforce these access requirements?
Explanations
Azure Network Security Groups (NSGs)
Azure Network Security Groups (NSGs)
What Azure Network Security Groups Are
An Azure Network Security Group (NSG) is a networking filter used to control inbound and outbound network traffic to Azure virtual network resources, such as virtual machines and subnets.
Why It Doesn't Meet the Requirement
NSGs operate at Layer 3 and Layer 4 of the OSI model, filtering traffic based on IP addresses, ports, and network protocols (TCP/UDP). They have no awareness of user identity, user sign-in context, or application-level authentication, and they cannot enforce identity controls like Multi-Factor Authentication (MFA).
Key Characteristics and Limitations
- Network-Level Filtering: Inspects source IP, destination IP, port numbers, and protocol.
- No Identity Context: Cannot determine who is initiating network traffic or evaluate user risk.
- No MFA Integration: Incapable of prompting users for secondary authentication factors.
This Answer Would Be Correct If
The requirement was to restrict network traffic between subnets or block incoming internet connections to specific ports on virtual machines.
Additional Context
While network segmentation is a part of defense-in-depth, Zero Trust identity verification relies on identity providers like Microsoft Entra ID rather than purely network-based controls.
Azure Resource Locks
Azure Resource Locks
What Azure Resource Locks Are
Azure Resource Locks are administrative settings applied to subscriptions, resource groups, or individual resources to prevent accidental deletion or modification.
Why It Doesn't Meet the Requirement
Resource Locks operate at the Azure Resource Manager (ARM) management plane. They enforce ReadOnly or CanNotDelete restrictions for administrators and users, but they do not analyze user sign-in conditions, assess identity risk, or trigger Multi-Factor Authentication (MFA).
Key Characteristics and Limitations
- Accidental Deletion Protection: Prevents critical resources from being deleted or modified by authorized users.
- Static Enforcement: Applies uniform protection regardless of user location, device state, or sign-in risk.
- No Contextual Evaluation: Does not process access requests or evaluate real-time signals.
This Answer Would Be Correct If
The organization needed to prevent administrators from accidentally deleting production databases, storage accounts, or virtual networks.
Additional Context
Resource Locks assist with resource governance and operational safeguards, but they are not an identity access management or authentication enforcement tool.
Microsoft Purview sensitivity labels
Microsoft Purview sensitivity labels
What Microsoft Purview Sensitivity Labels Are
Microsoft Purview sensitivity labels are data classification and protection tags used to classify and protect organizational data, such as emails and documents, by applying encryption and access restrictions directly to the content.
Why It Doesn't Meet the Requirement
Sensitivity labels are focused on information protection and data classification. While they can apply rights management encryption to documents, they are not the engine responsible for evaluating sign-in context and enforcing Multi-Factor Authentication (MFA) across cloud application access.
Key Characteristics and Limitations
- Data-Centric Protection: Protects files and emails regardless of where they are stored or shared.
- Content Encryption: Uses Azure Rights Management to restrict who can open, edit, or print labeled files.
- No Sign-In Context Engine: Does not evaluate device platforms or user sign-in risk to grant or block application access.
This Answer Would Be Correct If
The goal was to classify confidential documents and automatically encrypt spreadsheets containing sensitive financial information.
Additional Context
Sensitivity labels can work alongside Microsoft Entra ID to restrict content consumption, but Conditional Access remains the foundational engine for contextual access evaluation and MFA enforcement.
Microsoft Entra Conditional Access policies
Microsoft Entra Conditional Access policies
What Microsoft Entra Conditional Access Is
Microsoft Entra Conditional Access is the policy-based evaluation engine used in Azure to implement Zero Trust security. It functions as an "if-then" decision engine that analyzes real-time identity signals to make automated access control decisions.
How It Meets the Requirements
Conditional Access directly enforces the Zero Trust principle of Verify Explicitly by evaluating context during sign-in attempts. It allows administrators to:
- Analyze Sign-in Signals: Evaluate user identity, group membership, target cloud application, device platform, and location.
- Enforce Access Controls: Require Multi-Factor Authentication (MFA), require managed/compliant devices, or block access entirely based on defined criteria.
Key Advantages and Capabilities
- Automated Decision-Making: Dynamically triggers security requirements like MFA only when specific conditions are met.
- Zero Trust Alignment: Ensures every access request is fully authenticated, authorized, and validated prior to granting access.
- Granular Targeting: Can be assigned to specific users, administrative roles, or cloud applications (such as Azure Data Explorer or Microsoft 365).
- Centralized Security Governance: Configured tenant-wide in Microsoft Entra ID to enforce consistent security controls across cloud resources.
Why This Is Optimal
Conditional Access bridges identity verification and resource security, providing the exact mechanism required to evaluate user context and enforce MFA under a Zero Trust framework.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Just-In-Time Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Managed Identities
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Protection
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Hybrid Cloud Model
Define cloud models, including public, private, and hybrid
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated