A company using Cisco Duo wants login requirements to tighten automatically when context is risky, for example when users connect from countries where it has no staff or through anonymizing networks, while normal office logins stay simple. Which Duo feature should be configured?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a bouncer who's relaxed with regulars but asks more questions when a stranger shows up through the back door. Adaptive Access policies check where you're coming from and how, and they ratchet up the requirements when the story looks risky. Bypass and longer remember windows only loosen things.
Full Explanation
Duo Adaptive Access policies let administrators define conditions under which authentication is allowed, stepped up or denied. Conditions include user location by country, authorized networks, anonymous networks such as Tor and anonymizing proxies, device attributes and risk signals, and policies can be applied globally, per application or per user group. A policy can deny or require stronger factors for logins from countries with no staff or from anonymizing networks while leaving trusted office networks with a simpler flow, which matches the requirement for context-dependent tightening. Self-service portal settings control how users manage their own authentication devices; they do not evaluate login context. Bypass status lets specified users skip MFA entirely, which loosens security and does not tighten anything for risky contexts. Lengthening the remembered-devices window reduces prompts everywhere, which weakens protection uniformly rather than adapting to risk. Exam caveat: adaptive policy is a preventive control at login, whereas Trust Monitor surfaces anomalies afterward for review; exam scenarios use the words enforce, block or require to signal policy. Operational check: authenticate through a test anonymizing network and confirm the login is blocked or stepped up as the policy specifies, while an office login remains unchanged.