Conditional Access Rules for MFA Fatigue in Enterprise Environments

Contextual Risk vs. Absolute Security The core tension in this scenario is balancing user experience (reducing MFA fatigue) with security posture. The question explicitly demands a change that does not reduce the security of user accounts. This constraint eliminates any option that weakens authentication factors or broadens access indiscriminately.

Analysis of Option A Option A suggests creating a conditional access rule that exempts MFA when activity originates from the corporate network. While this addresses the "continuous prompting" issue by leveraging trusted location context, it fundamentally reduces security. If an attacker compromises a corporate device or gains physical access to the network perimeter, they can log in without MFA. This violates the explicit constraint of maintaining account security. Furthermore, Zero Trust principles (Objective 2.6) generally discourage trusting the network perimeter as a sole factor for bypassing strong authentication.

Analysis of Option B Option B removes MFA for all logins regardless of location. This is a severe security regression and clearly fails the "without reducing security" constraint.

Analysis of Option C Option C restricts MFA requirement only to the company email provider. This creates a massive attack surface for other applications (e.g., ERP, CRM, development tools) which would then be accessible with just a password. It reduces overall security by leaving non-email systems unprotected.

Analysis of Option D Option D requires MFA for all logins but removes some password complexity requirements. While lowering password complexity is a negative security trade-off, requiring MFA for every login significantly mitigates the risk of credential stuffing and password spraying attacks. Compared to Options A, B, and C, which remove MFA entirely for specific contexts or users, Option D maintains the strongest layer of identity verification (the second factor). In many certification contexts, "security of user accounts" prioritizes the strength of the authentication mechanism (MFA) over the entropy of the first factor (password), especially when the alternative is removing MFA entirely. However, note that best practice usually involves keeping both. But among the flawed choices, retaining universal MFA is often considered less risky than allowing unauthenticated (or single-factor) access from internal networks or non-email apps.

Wait, let's re-evaluate based on common exam logic. Actually, there is a nuance. Option A is often cited in older exams as "trusted network." But modern CAS-005 emphasizes Zero Trust. Let's look closer at the prompt: "most secure" while addressing the issue. If we look at Option A: It reduces security because it allows single-factor auth from inside. If we look at Option D: It reduces security by weakening passwords. Which reduction is "less" of a reduction? Or is there a better interpretation?

Let's reconsider the "issue": Users are continuously prompted. This implies MFA is annoying. The goal is to stop the prompts without losing security.

Actually, Option A is frequently the "distractor" that sounds like good UX but is insecure. Option D is also insecure due to weak passwords.

Is there a mistake in my reading? Let's look at Option C again. Requiring MFA only for email? No, that leaves other apps open.

Let's look at the comments. One user voted A. Another voted D.

In many CompTIA scenarios, Conditional Access based on Risk or Location is preferred over blanket rules. However, exempting internal traffic from MFA is a known vulnerability. \n Let's look at the phrasing "does not reduce the security of user accounts." If I use Option A, my accounts are less secure from insider threats or compromised endpoints. If I use Option D, my accounts are less secure from password guessing.

However, there is a third possibility: Is there a typo in my analysis of Option A? Some vendors consider "Corporate Network