AZ-900 Describe Azure management and governance Practice Question
Which Azure feature ensures that users accessing sensitive applications must be on compliant corporate devices?
⚠ Common exam trap
Test-takers frequently confuse Azure AD Identity Protection (which handles risk-based identity threats) with Conditional Access (which enforces broader conditions like device compliance), leading them to pick A instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AD Conditional Access with device compliance
Azure AD Conditional Access with device compliance enforces policies that require users to access sensitive applications only from devices that meet compliance standards (e.g., managed by Intune, patched, encrypted). This integrates with Microsoft Intune to check device health before granting access, ensuring corporate data is protected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD Identity Protection
Why it's wrong here
Azure AD Identity Protection is focused on detecting risky sign-ins such as anonymous IP addresses, impossible travel, or leaked credentials. It produces risk scores that can be used as an input to Conditional Access but does not directly evaluate or enforce device compliance. Conditional Access is the component that actually blocks or allows access based on device compliance policies.
- ✓
Azure AD Conditional Access with device compliance
Why this is correct
Azure AD Conditional Access with device compliance is correct because it enforces policies that require a device to be marked as compliant by Intune before access is allowed to applications. This combines identity signals with device health signals, enabling real-time enforcement of security posture. It is the native Azure AD mechanism for conditionally managing access based on device state.
- ✗
Azure RBAC with device restrictions
Why it's wrong here
Azure RBAC controls access to Azure resources by assigning permissions to users or groups, but it does not evaluate device health or compliance status. RBAC only answers 'who can perform which action on which resource' after authentication, while Conditional Access uses device compliance as a condition to deny access from non-compliant devices. Thus, RBAC cannot enforce device-related access requirements.
- ✗
Azure Firewall with IP restrictions
Why it's wrong here
Azure Firewall is a network-layer security service that filters traffic based on IP addresses, ports, and protocols. It cannot inspect user identity or determine whether a device is compliant with Intune policies. Conditional Access is the identity-driven control that evaluates device compliance state before granting access to applications, which firewalls are not designed to do.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Check
A Check in Azure DevOps is a gating mechanism that evaluates predefined conditions before allowing a pipeline deployment to proceed to a specific environment.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.