Microsoft Certified: Azure Security Engineer AssociateManage identity and accessHard
A client organization uses Azure AD and has a critical business application that processes highly sensitive customer data. They want to implement a security measure that ensures users accessing this application are not only authenticated but also that their sign-in session is continuously monitored for anomalous behavior. If any suspicious activity is detected during the session, access to the application should be immediately revoked. Which combination of Azure AD features should be implemented?
- AAzure AD PIM and Azure AD Role-Based Access Control (RBAC)
- BAzure AD Identity Protection and Azure AD Conditional Access
- CAzure AD Application Proxy and Azure AD MFA
- DAzure AD B2B collaboration and Azure AD External Identities
Show answer & explanationAnswer & explanation
Correct answer: B. Azure AD Identity Protection and Azure AD Conditional Access
Azure AD Identity Protection can detect anomalous behavior during sign-in and post-sign-in. When integrated with Conditional Access, Identity Protection's risk signals can trigger Conditional Access policies to block access or require re-authentication, thus achieving continuous monitoring and immediate revocation of access upon detection of suspicious activity.
Why the other options are wrong
- A. PIM manages privileged access, and RBAC controls permissions; neither provides continuous session monitoring for anomalous behavior.
- C. Application Proxy provides remote access to on-premises apps, and MFA is a sign-in control, neither directly monitors ongoing sessions for anomalies.
- D. B2B and External Identities manage guest access; they don't provide continuous session monitoring and revocation based on risk.
Continuous Access Evaluation (CAE)
An Azure AD feature that enables real-time enforcement of Conditional Access policies based on security events and policy changes, rather than relying solely on token expiration.
- Revokes access immediately upon critical events (e.g., password change, user disabled).
- Integrates with Identity Protection to respond to risk events.
- Enhances security by reducing the window of opportunity for attackers.
Memory trick: CAE, Identity Protection, and Conditional Access work together for constant vigilance.