Which two controls best reduce unauthorized BYOD access risk?

Given a scenario, apply security concepts to the design of access, authentication, and authorization systems. Given a scenario, integrate appropriate controls in the design of a secure architecture.

During a gap assessment, an organization notes that BYOD usage is a significant risk. The organization implemented administrative policies prohibiting BYOD usage. However, the organization has not implemented technical controls to prevent the unauthorized use of BYOD assets when accessing the organization's resources. Which of the following solutions should the organization implement to best reduce the risk of BYOD devices? (Choose two.)

Cloud IAM, to enforce the use of token-based MFA
Conditional access, to enforce user-to-device binding Correct Answer
NAC, to enforce device configuration requirements Correct Answer
PAM, to enforce local password policies
SD-WAN, to enforce web content filtering through external proxies
DLP, to enforce data protection capabilities

Answer Correct answer: B, C — Enforce user-to-device binding with Conditional Access and device compliance/health checks with NAC to block unauthorized BYOD assets.

Community Insight

The exam tests the difference between administrative prohibition and technical enforcement; the trap is choosing identity, DLP, or network-transport tools that do not bind access to an approved or compliant device.

This CA1-005 question tests how technical controls close a BYOD policy gap. The page establishes that Conditional Access user-to-device binding (B) and NAC device health enforcement (C) are the two controls that best block unauthorized BYOD access.

A common mistake is selecting Cloud IAM with token-based MFA (A), which strengthens authentication but still lets a personal BYOD device access resources once the user authenticates.

Community Discussion (3 comments)

BWH9492 👍 1 Selected: BC

Network Layer Control NAC (Network Access Control). Identity / Application Layer Control Conditional Access (User-to-Device Binding / Managed Device Attestation).

dangerousdave 👍 1 Selected: BC

Network Access Control (NAC) (C) would limit 'unknown' (in this case the user's own device) devices from connecting to a network. Therefore, this will block the connection at Layer 3 itself. Conditional Access (B) would limit the usage of even valid domain accounts only to a specific device.

rvv1978 👍 2 Selected: BC

Conditional Access (B) ensures only approved and compliant devices can access sensitive resources by checking the device’s identity and security context. This prevents personal BYOD devices from logging in unless they meet organizational requirements. Network Access Control (NAC) (C) enforces security policies at the network layer by assessing device health (e.g., antivirus status, patch levels) before allowing access. Devices failing to meet these requirements are blocked or quarantined, further mitigating BYOD risks.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

B and C are correct because the gap is not a missing policy but a missing technical enforcement point. Conditional Access enforces user-to-device binding, so a valid account can be restricted to a managed or approved device rather than any personal phone or laptop. NAC enforces device configuration and health requirements at the network layer, blocking unknown or noncompliant endpoints before they reach organizational resources. Together they cover identity/application-layer and network-layer BYOD risk, which matches the question's demand for two solutions.

Why the Other Options Are Wrong

A only adds token-based MFA through Cloud IAM; it improves authentication strength but does not stop an authenticated user from using an unmanaged BYOD device. D's PAM-focused local password policies address privileged credential hygiene, not BYOD device authorization. E's SD-WAN web content filtering through external proxies may reduce browsing risk but does not prevent unauthorized devices from accessing resources. F's DLP protects data handling and exfiltration but is not a device-access gate, so it does not close the BYOD policy gap.

Community Comment Notes

Community voters converged on B and C, with rvv1978 noting that Conditional Access ensures "only approved and compliant devices can access sensitive resources." dangerousdave added that NAC would limit unknown devices from connecting to a network, blocking the connection at Layer 3, while B restricts valid domain accounts to a specific device. BWH9492 framed the pair as a network-layer NAC control plus an identity/application-layer Conditional Access control. These comments align with the technical distinction between device compliance/health enforcement and user-to-device binding.

Official Reference

Exam Strategy

For multi-select BYOD questions, separate administrative policy from technical enforcement and pick one identity/application-layer control plus one network-layer device control. Conditional Access and NAC are the only options here that actually gate access based on device identity or health, so do not be distracted by stronger MFA, DLP, or SD-WAN filtering.

Frequently Asked Questions

Why is Cloud IAM with token-based MFA not enough to stop BYOD devices?

Token-based MFA verifies the user's authentication strength, but a personal device can still complete MFA and reach resources unless Conditional Access or NAC checks device identity and compliance.

How do Conditional Access and NAC divide BYOD enforcement?

Conditional Access binds identities to approved or managed devices at the application layer, while NAC evaluates device health and configuration on the network before allowing access.

More CA1-005 FAQ →

Related Analysis

← Back to CA1-005 Study Guide