Question
A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications.
The customer discovers that several endpoints are infected with malware.
The customer suspends access attempts from the infected endpoints.
The malware is removed from the endpoints.
Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. The client access tokens are refreshed. Correct
- B. Microsoft Intune reports the endpoints as compliant. Correct
- C. A new Azure Active Directory (Azure AD) Conditional Access policy is enforced.
- D. Microsoft Defender for Endpoint reports the endpoints as compliant.
Explanation
Defender for Endpoint gives each device a risk level and sends it to Intune. Intune compares that risk level with the device compliance policy and marks the device compliant or noncompliant. Conditional Access then uses this Intune compliance state to allow or block access. When the malware has been removed, Defender for Endpoint lowers the device's risk level, so Intune reports the device as compliant again (B). Conditional Access is checked when a token is issued, so the client must refresh its access tokens (A). The new tokens are issued against the device's compliant state, and only then can users reach the apps again. Defender for Endpoint does not report compliance itself (it reports risk), so D is wrong. No new Conditional Access policy is needed because the existing policy already allows compliant devices, so C is wrong.
