Contoso Identity Conditional Access can evaluate the IP address or network location when making policy decisions and Administrators can create policies in Contoso Identity Conditional Access that require multifactor authentication for users assigned to administrative roles are correct.

Conditional Access evaluates signals about the sign in request such as IP address and named locations and uses those signals when making policy decisions. This allows administrators to block access or require additional controls when requests come from risky or unexpected networks.

Administrators can create policies that target privileged roles and require multifactor authentication to reduce the risk of compromise. Requiring MFA for administrative role accounts is a common Conditional Access use case to protect privileged access.

Contoso Identity Conditional Access policies are applied before the initial sign in factor completes is incorrect because Conditional Access policies evaluate as part of the sign in flow after primary authentication signals are processed and then enforce controls such as requiring MFA or blocking access. Policies do not run before the initial authentication factor completes.

The Conditional Access capability is included in the free edition of Contoso Identity is incorrect because Conditional Access is an advanced capability that requires paid licensing in most identity providers. For example Azure Active Directory requires Premium licensing for Conditional Access features.

Full AWS Practitioner Certification Question