Exam AZ-140 topic 3 question 33 discussion

First of all we should disable security defaults, then we can create a condition access policy and only after that we can configure MFA

It's a trick question, in my opinion. If you look closely, it asks what should be done first. Keep in mind that we don't know if the tenant has Entra ID P1, so we can't be sure if Conditional Access (CA) can be configured. However, what is universally true is that by default, all new tenants have Security Defaults enabled. So, the first step should be to disable Security Defaults, and the second step would be to configure Conditional Access.

Conditional Access is what lets you set a custom sign‐in frequency (e.g., every six hours). Even though in a brand‐new tenant you often must disable Security Defaults first to create any custom Conditional Access policy, the exam (and Microsoft documentation) typically views “Create a Conditional Access policy” as your first major configuration step for sign‐in frequency. So while real‐world practice often includes disabling Security Defaults before advanced Conditional Access, the standard (and correct) exam answer to achieve six‐hour reauthentication is: A. Create a Conditional Access policy

If your tenant was created on or after October 22, 2019, security defaults might be enabled in your tenant. To protect all of our users, security defaults are being rolled out to all new tenants at creation. Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults. https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

Security Defaults are enabled on new Azure subscriptions by default and must be disabled before Conditional Access policies can be used. https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

A. Create a Conditional Access policy. Conditional Access policies allow you to set the sign-in frequency, which can be configured to require reauthentication every six hours. This approach ensures that users are prompted to reauthenticate at the specified interval, enhancing security.

create condition access policy first and then config MFA

Correct

Should be A