mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company uses Azure AD Conditional Access to…
A company uses Azure AD Conditional Access to enforce MFA for all cloud apps. They have some users who are physically located in countries that are considered high-risk by the security team. The team wants to require device compliance (as defined by Intune) for sign-ins from those specific countries, while still requiring MFA from all other locations. How should the administrator configure the Conditional Access policy?
⚠ Common exam trap
Test-takers frequently think a single policy can combine multiple location conditions with an 'AND' operator, but Conditional Access treats multiple locations within one policy as an 'OR' condition, making it impossible to enforce different grant controls for different location groups in one policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA
Conditional Access policies are evaluated independently, and each policy can target specific conditions with distinct grant controls. By creating two separate policies—one for high-risk countries requiring both MFA and device compliance, and another for all other locations requiring only MFA—the administrator can enforce the exact requirements per location group. This approach avoids conflicts and ensures that users in high-risk countries are subject to stricter controls while others are not.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA
Why this is correct
A Conditional Access policy applies one set of grant controls to all users who match its conditions; it cannot vary those controls (e.g., MFA vs. MFA + device compliance) depending on which location matched. By creating two policies with distinct named locations — one for the specified high-risk countries and one for all other locations (with those countries excluded) — you ensure that users in the high-risk countries only match the first policy and must satisfy both MFA and device compliance, while users elsewhere match only the second policy and are only challenged with MFA. This design respects the logic that each policy is evaluated independently and grants are additive when multiple policies apply.
- ✗
Create a single Conditional Access policy that includes both conditions (locations) and grant controls (MFA and device compliance) with an 'OR' operator
Why it's wrong here
An OR operator across location conditions (e.g., including both the high-risk country named location and all other locations) means any sign-in that matches at least one location triggers the policy. Since every sign-in originates from some location, the policy applies to all users, and the single set of grant controls (MFA plus device compliance) is enforced universally. This fails the requirement to demand device compliance only for the high-risk countries; separate policies are needed to assign different grant controls to different location conditions.
- ✗
Use Azure AD Identity Protection to automatically evaluate location risk, and let Conditional Access apply the same policy to all users
Why it's wrong here
Azure AD Identity Protection evaluates real-time risk signals such as impossible travel or anomalous sign-in behavior, but it does not classify entire countries as 'high-risk' based on a predefined geographic list. The requirement is for a static set of high-risk countries (implemented as named locations), not a dynamic risk score, so Identity Protection cannot provide the necessary location-based differentiation. Even if you used the sign-in risk condition in Conditional Access, the policy would apply the same grant controls (e.g., MFA) uniformly, without distinguishing between the high-risk countries and all other locations.
- ✗
Configure a single Conditional Access policy with multiple location conditions and multiple grant controls using an 'AND' operator
Why it's wrong here
An AND operator between multiple location conditions would require a user to be simultaneously in two different location sets, which is impossible because a sign-in has a single source IP and thus resolves to exactly one country/location. Consequently, no user would ever satisfy both conditions, and the policy would never enforce MFA or device compliance. Even if the intention were to apply different controls to different locations, a single policy with AND cannot express that; you need separate policies so each location set is tied to its own grant controls.
Go deeper
Related to this question
Learn chapter
Conditional Access Policies
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.