AZ-500 Manage identity and access Practice Question
A company uses Microsoft Entra Conditional Access. They need to restrict access to a cloud application such that users with unmanaged devices can only view data but cannot download it. Which Conditional Access session control should they enable?
⚠ Common exam trap
A common mix-up: candidates confuse session controls (like sign-in frequency or persistence) with app-level data protection controls, leading candidates to pick a control that manages authentication behavior rather than data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Conditional Access App Control
Conditional Access App Control (Microsoft Defender for Cloud Apps) provides session-level controls that can enforce restrictions like 'Block Download' based on device compliance. This allows administrators to apply policies that restrict data exfiltration from unmanaged devices while still permitting read-only access to the cloud application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sign-in frequency
Why it's wrong here
Sign-in frequency in Conditional Access is a session control that specifies how long a user's session remains valid before reauthentication is required, typically configured in hours or days. While this setting forces users to periodically re-enter credentials, it does not examine or restrict what actions users perform after they are authenticated. A user could still download large amounts of data during the active session, so sign-in frequency alone cannot satisfy the requirement to block data downloads.
- ✓
Use Conditional Access App Control
Why this is correct
Conditional Access App Control, also known as session control, integrates with Microsoft Defender for Cloud Apps by routing the user's session through a reverse proxy in real time. This allows administrators to create session policies that block or restrict specific activities, such as downloading, uploading, copying, or printing files, based on conditions like user risk or location. For the requirement to restrict data downloads, this is the correct and only option among those listed that provides true session-level enforcement.
- ✗
Session persistence
Why it's wrong here
Session persistence is a Conditional Access setting that determines whether a user's sign-in session remains active after the browser is closed, offering convenience by not requiring reauthentication on return. It does not limit or monitor user actions during the session; it only controls the duration of the authentication state. Restricting data downloads requires a session-level control, while session persistence merely changes when sign-in is prompted again.
- ✗
Application consent policy
Why it's wrong here
Application consent policy in Microsoft Entra ID is designed to regulate which applications users or administrators can consent to, controlling whether an app can request delegated permissions to access organizational data. This policy operates at the application permission level and does not affect what a user can do with data inside a web session. It is an administrative decision about app access, not a real-time session control, so it cannot restrict downloads or copy/paste actions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.