City finance SaaS from home must step up authentication, while the on-campus corporate VLAN may use a lighter method. Which Access feature implements that split?
Select an answer to reveal the explanation.
Short Explanation
Think of network range as the door you walked in: home door asks for a second factor, campus door can be lighter. Access policy reads the source range and picks the method. Duplicating a web clip in UEM does not change how Access authenticates.
Full Explanation
City finance SaaS from home must step up authentication, while the on-campus corporate VLAN may use a lighter method. Add network-range conditions to the Access policy so the home range requires a stronger method than the campus VLAN—network range is the door you walked in. Duplicating the SaaS application twice in UEM and assigning one copy to home users as a web clip fails by concept because web-clip duplication does not change how Access authenticates the session. Creating an NSX-T time-based distributed firewall rule that forces MFA packets from RFC1918 fails because DFW does not implement Access step-up authentication methods. Enabling a Carbon Black Cloud sensor setting named Step-Up from Home fails because no such CBC setting replaces Access network-range policy. Exam caveat: location-based step-up is Access policy network-range conditions selecting authentication methods—not UEM web-clip copies, NSX MFA myths, or CBC settings. Operational check: authenticate to finance SaaS from a home range and confirm stronger method; from campus VLAN confirm lighter method; verify both paths use the same Access application object with range conditions. Maintain accurate home versus campus network-range definitions so VPN egress is classified correctly for finance staff.