Task 2.4: Implement Global Secure Access

• AOpen inbound port 443 from the internet to the connector server

  Incorrect

  Connectors use outbound connections only; inbound ports don't add availability.

• BPublish the ERP app through Quick Access instead of a per-app application

  Incorrect

  Quick Access still depends on the connectors that serve its segments.

• CInstall a second connector in the connector group that serves the ERP app

  Correct

  Connectors in one group act as a unit for high availability, and Microsoft recommends at least two.

• DMove the connector service to the server that already runs Microsoft Entra Connect Sync

  Incorrect

  Sharing a server doesn't add a second connector, so a restart still breaks access.

Private network connectors make outbound connections to the service. Connectors in a connector group act as a single unit for high availability and load balancing, so each group assigned to an app should have at least two connectors on different servers.

• ARestrictNonPrivilegedUsers set to 0x1

  Correct

  Nonprivileged users can't disable or enable the client; a User Account Control prompt asks for local administrator credentials.

• BHideDisableButton set to 0x1

  Incorrect

  It removes the Disable action from the tray menu, which the help desk wants to keep.

• CHideDisablePrivateAccessButton set to 0x1

  Incorrect

  It hides only the Disable Private Access action; the Disable action that turns off the whole client stays open to every user.

• DIsPrivateAccessDisabledByUser set to 0x0

  Incorrect

  It keeps Private Access enabled on the device; it doesn't stop users from disabling the client.

The Global Secure Access client's registry values control its tray menu. RestrictNonPrivilegedUsers set to 0x1 under HKEY_LOCAL_MACHINE requires local administrator credentials, through a User Account Control prompt, to disable or enable the client, while the Disable action stays visible. The Hide values only show or hide menu actions, and IsPrivateAccessDisabledByUser turns Private Access on or off for the device.

• AThe Internet Access profile acquires it and applies the linked security profiles

  Incorrect

  Traffic available in the Microsoft traffic profile can be acquired only by that profile.

• BIt isn't acquired by Global Secure Access and uses the device's normal route

  Correct

  Bypassed Microsoft traffic skips Global Secure Access even when the Internet Access profile is on.

• CGlobal Secure Access drops it until the rule group is set back to Forward

  Incorrect

  Bypass skips acquisition; it doesn't block traffic.

• DThe Private Access profile acquires it through the nearest connector

  Incorrect

  Private Access carries traffic to private apps, not Microsoft 365 services.

When a Microsoft traffic profile rule is set to Bypass, the Internet Access profile doesn't acquire that traffic either: it skips Global Secure Access and uses the client's own routing to the internet. Traffic that the Microsoft traffic profile can acquire is acquired only there.

• AA block rule for *.fabrikam-games.com in a policy linked to the baseline security profile

  Incorrect

  The wildcard matches subdomains only, so the root domain fabrikam-games.com stays reachable.

• BA block rule for *.fabrikam-games.com,fabrikam-games.com in a policy linked to the baseline security profile

  Correct

  The pair covers the root domain and its subdomains, and the baseline profile applies to client and remote network traffic alike.

• CA block rule for *.fabrikam-games.com,fabrikam-games.com in a security profile linked to a Conditional Access policy for all users

  Incorrect

  Conditional Access links the profile to signed-in client users; remote network traffic is filtered by the baseline profile.

• DA block rule for the site's web category in a policy linked to the baseline security profile

  Incorrect

  A category rule blocks every site in that category, which the stem rules out.

An FQDN entry of the form *.domain.com matches subdomains such as www.domain.com but not domain.com itself, so blocking both takes the comma-separated pair *.fabrikam-games.com,fabrikam-games.com. The baseline security profile applies to all traffic routed through Global Secure Access, client and remote network alike, without a Conditional Access policy; profiles linked through Conditional Access reach users of the client.

• AInspection of internet traffic by web category

  Incorrect

  Category filtering is part of Internet Access.

• BAcquisition of Microsoft 365 traffic through the Microsoft traffic profile

  Incorrect

  Microsoft 365 traffic belongs to the Microsoft traffic profile.

• CAccess to private FQDNs and IP ranges you list, through one app it creates

  Correct

  Quick Access defines private resources broadly and is meant as a VPN replacement step.

• DSingle sign-on to SaaS apps from the gallery

  Incorrect

  SaaS SSO is configured on enterprise applications, not through Private Access.

Quick Access lets you define FQDNs or IP addresses of private resources to include in Private Access traffic, and creates a new enterprise application configured for it. Microsoft positions it as a transition state: after replacing the VPN, move to per-app access for segmentation.

• AWindows, macOS, Android and iOS

  Correct

  Microsoft provides a Global Secure Access client for each of these platforms.

• BWindows and macOS only

  Incorrect

  Mobile platforms have clients too.

• CWindows only

  Incorrect

  Clients exist for more platforms.

• DAny device with a modern browser, with no install

  Incorrect

  Traffic acquisition needs an installed client or a remote network.

Microsoft provides Global Secure Access clients for Windows, macOS, Android and iOS to acquire and route traffic to the service. Devices that can't run a client can be covered through remote networks.

• ASecurity Operator

  Incorrect

  Security Operator manages security events, not Global Secure Access configuration.

• BNetwork Administrator

  Incorrect

  Network Administrator manages Microsoft network location settings, not Global Secure Access.

• CHybrid Identity Administrator

  Incorrect

  This role manages hybrid identity components.

• DGlobal Secure Access Administrator

  Correct

  This role configures Global Secure Access in the Microsoft Entra admin center.

Global Secure Access tasks, such as enabling traffic forwarding profiles and downloading clients, are done in the Microsoft Entra admin center as a Global Secure Access Administrator.

• AThe devices must trust the root certificate used to inspect TLS traffic

  Correct

  Inspected traffic is re-signed, so the root must be trusted, for example deployed with Intune.

• BThe devices must be Microsoft Entra registered rather than joined to the tenant

  Incorrect

  Changing how devices are joined doesn't remove certificate errors; trusting the inspecting root certificate does.

• CThe browsers must disable certificate checking

  Incorrect

  Disabling checks would be unsafe and isn't the requirement.

• DEach website must upload its certificate to the tenant

  Incorrect

  Sites don't send their certificates to your tenant.

TLS inspection needs an active certificate authority (Microsoft-managed or your own), and devices must trust the root certificate that signs inspected traffic. Intune can deploy the trusted certificate to managed Windows devices.