AZ-140 · Question #110
You have an on-premises network and an Azure subscription. The subscription contains the following: A virtual network An Azure Firewall instance An Azure Virtual Desktop host pool The virtual network
The correct answer is A. a conditional access policy. A Conditional Access policy is the correct and most administratively efficient solution. By defining the on-premises public IP ranges as a Named Location in Azure AD, you can create a Conditional Access policy that blocks access to the Azure Virtual Desktop application from any l
Question
You have an on-premises network and an Azure subscription. The subscription contains the following:
A virtual network An Azure Firewall instance An Azure Virtual Desktop host pool The virtual network connects to the on-premises network by using a site-to-site VPN. You need to ensure that only users from the on-premises network can connect to the Azure Virtual Desktop managed resources in the host pool. The solution must minimize administrative effort. What should you configure?
Options
- Aa conditional access policy
- Ban Azure Firewall rule
- Ca network security group (NSG) rule
- Da user-defined route
How the community answered
(30 responses)- A80% (24)
- B3% (1)
- C10% (3)
- D7% (2)
Explanation
A Conditional Access policy is the correct and most administratively efficient solution. By defining the on-premises public IP ranges as a Named Location in Azure AD, you can create a Conditional Access policy that blocks access to the Azure Virtual Desktop application from any location that is NOT the on-premises named location. This policy is enforced at the identity/authentication plane, meaning it applies to all users and devices automatically without requiring manual maintenance of firewall rules per session host. Azure Firewall rules or NSG rules could work but require more effort to maintain and do not natively integrate with user identity. A user-defined route (UDR) controls routing, not user authentication or access restriction.
Topics
Community Discussion
No community discussion yet for this question.