mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company uses Microsoft Entra ID P2 licenses and…
A company uses Microsoft Entra ID P2 licenses and wants to block all authentication attempts from an internal legacy application that uses POP3 and SMTP protocols. The application cannot be updated and must be blocked from accessing Exchange Online. Which Conditional Access policy setting should the administrator configure?
⚠ Common exam trap
It's easy for candidates to confuse 'Client apps' with device or location conditions, mistakenly thinking that blocking a device platform or location will stop legacy protocol traffic, when in fact legacy authentication bypasses those controls entirely because it does not use modern token-based authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'
The legacy application uses POP3 and SMTP, which are non-modern authentication protocols. In Conditional Access, the 'Client apps' condition includes a setting to block 'Exchange ActiveSync clients and other clients', which specifically targets legacy authentication protocols like POP3, SMTP, and IMAP. This allows the administrator to block all authentication attempts from such clients without affecting modern authentication flows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Under 'Grant', select 'Block access'
Why it's wrong here
Setting the grant to 'Block access' denies all authentication attempts for the targeted policy, regardless of protocol. That means modern clients using OAuth or OpenID Connect would also be blocked, which is far broader than the intended scope of stopping legacy protocols. Since the problem is specifically about POP3/SMTP and other non-modern clients, this control does not isolate the vulnerable authentication methods and would disrupt legitimate access.
- ✓
Under 'Conditions' > 'Client apps', configure to block 'Exchange ActiveSync clients and other clients'
Why this is correct
The 'Client apps' condition in Entra ID Conditional Access directly matches the authentication protocol used by the client. By selecting 'Exchange ActiveSync clients' and 'Other clients' (which cover POP3, IMAP, SMTP, and other non-modern authentication), you can explicitly block those legacy protocols while allowing modern, MFA-capable clients to continue. This is the precise and least disruptive way to enforce the security requirement.
- ✗
Under 'Conditions' > 'Device platforms', select 'Android' and 'iOS' and block them
Why it's wrong here
Blocking Android and iOS via the 'Device platforms' condition would prevent all sign-ins from those operating systems, including modern Outlook and Teams apps that support multi-factor authentication. Legacy authentication is not a property of the device platform; it is a property of the authentication flow itself. POP3 or SMTP clients running on Windows or macOS would remain unaffected, and legitimate mobile users would be locked out.
- ✗
Under 'Conditions' > 'Locations', select 'All trusted locations' and block
Why it's wrong here
The 'Locations' condition filters based on network IP address or named locations, not on the authentication protocol. Selecting 'All trusted locations' would only block legacy authentication attempts that originate from untrusted networks; any attacker inside the corporate network or a trusted VPN would still be able to use POP3/SMTP. Since the goal is to stop legacy authentication everywhere, this option fails to address the actual security gap.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.