A BYOD pilot enforces app protection for one mail app. Users can access the same corporate data through another client that does not participate in the protection design. What is the most appropriate architecture change?

Choose the single best answer.

A.Remove app protection because BYOD cannot be secured
B.Assume the protection automatically follows every client
C.Configure an app PIN in the original app only
D.Validate supported clients and enforce the intended protected access path with Conditional Access

Show the answer and explanation

✓ Correct answer

Validate supported clients and enforce the intended protected access path with Conditional Access

Supported client validation and access enforcement close the bypass path. App protection does not automatically govern every app, abandoning all protection is unnecessary, and a PIN in one app leaves the other route open.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.