SY0-701 Question 316
Single answer4.5 Given a scenario, modify enterprise capabilities to enhance security.A company recently adopted a hybrid work model and allows employees to access internal web applications from both managed laptops and personal mobile devices. After a phishing incident involving stolen credentials, the security team wants to reduce the risk of account compromise without blocking legitimate remote access. The company already uses a cloud identity provider that supports conditional access policies. Which action would BEST enhance security while maintaining usability?
- A
Require conditional access policies that enforce MFA for remote logins and block access from unmanaged devices unless they use a secure virtual application or browser session
- B
Disable all remote access to internal web applications and require employees to work only from the corporate office
- C
Increase password complexity requirements from 12 characters to 20 characters and force password changes every 30 days
- D
Allow personal devices to connect directly as long as employees install an antivirus application of their choice
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use conditional access to require MFA and apply device-based restrictions for unmanaged systems. This aligns with Security+ domain 4.5 because it involves modifying enterprise capabilities to enhance security rather than replacing business processes outright. In practice, organizations commonly use conditional access with signals such as user risk, sign-in risk, device compliance, geolocation, and application sensitivity. For unmanaged devices, best practice is often to allow only limited access through virtual desktop infrastructure (VDI), application virtualization, or browser isolation so corporate data is not broadly exposed to personal endpoints. Guidance from NIST zero trust principles and identity security best practices supports making access decisions based on continuous evaluation of identity, device, and session context. MFA is especially important after phishing-related credential theft because passwords alone are no longer sufficient to protect remote access.
- A. Correct.
Correct. Conditional access is an enterprise capability specifically designed to modify access decisions based on context such as device posture, location, risk, and authentication strength. Requiring MFA for remote access directly reduces the impact of stolen passwords, and restricting unmanaged devices unless they access through a controlled virtual application or secure browser session preserves usability while limiting exposure of internal resources. This is a practical, risk-based control commonly used in zero trust and modern identity architectures.
- B. Incorrect.
Incorrect. This would reduce risk, but it is not the best answer because it does not maintain business usability in a hybrid work model. Security+ objectives emphasize modifying enterprise capabilities to enhance security in a way that supports operational needs. Eliminating remote access entirely is a blunt administrative response rather than an appropriate capability enhancement.
- C. Incorrect.
Incorrect. Stronger passwords can help somewhat, but this does not adequately address phishing-resistant access in the scenario. Frequent forced password changes are no longer widely recommended as a primary control unless there is evidence of compromise, because they often lead to weaker user behavior and do not stop attackers from using valid stolen credentials immediately. This option also ignores device trust and contextual access controls.
- D. Incorrect.
Incorrect. Simply allowing personally owned devices to connect if they install any antivirus product does not provide sufficient assurance of device compliance or identity security. It does not verify configuration baselines, patch levels, device health, or session control, and it does not mitigate the main issue in the scenario: stolen credentials used during remote access.