SC-100 Practice Question: Design security operations, identity, and compliance capabilities
A company is implementing a zero-trust security model. They need to enforce conditional access policies that require device compliance from Microsoft Intune. However, some users report being blocked when using personal devices that are not enrolled. What is the best approach to allow access while maintaining security?
⚠ Common exam trap
Many exam-takers assume device compliance (via Intune enrollment) is the only way to enforce zero-trust access, overlooking that app protection policies can achieve similar security controls on unmanaged devices without requiring full device enrollment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require app protection policies via Microsoft Intune
Microsoft Intune app protection policies (APP) can enforce data protection and access controls on personal devices without requiring full enrollment. This allows the company to maintain a zero-trust posture by applying conditional access policies that check for app-level compliance, such as requiring a managed browser or blocking copy/paste, while still permitting access from unenrolled personal devices. This approach aligns with the zero-trust principle of 'never trust, always verify' by verifying device health at the application layer rather than the device layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all devices but monitor with Defender for Cloud Apps
Why it's wrong here
Allowing all devices with only monitoring via Defender for Cloud Apps provides post-breach visibility but does nothing to enforce compliance or block risky access in real time. In a zero trust architecture, access is granted based on explicit verification and policy enforcement, not simply observed. Without conditional access rules or remediation actions, non-compliant devices can still connect freely, leaving your data exposed to malware or data exfiltration.
- ✓
Require app protection policies via Microsoft Intune
Why this is correct
App protection policies via Microsoft Intune are correct because they apply conditional access at the app layer, safeguarding corporate data within managed applications even on unenrolled, personally owned devices. These policies enforce PIN, encryption, and restricted copy-paste, and can remotely wipe corporate data selectively. This approach meets zero trust requirements for identity and data protection without the privacy invasive step of full device management.
- ✗
Block all non-compliant devices
Why it's wrong here
Blocking all non-compliant devices is overly rigid and takes an all-or-nothing approach that conflicts with zero trust's principle of least privilege. Users with personal devices that could be brought into compliance through app protection policies are denied access entirely, which harms productivity. It also fails to account for scenarios where a user's device is compliant for business data even if it lacks full management, so a more nuanced, risk-based policy is required.
- ✗
Require device enrollment for all devices
Why it's wrong here
Requiring device enrollment for all devices is impractical in a BYOD environment because users may decline to enroll personal smartphones or tablets due to privacy concerns, leading to an incomplete security umbrella. This option forces a one-size-fits-all management model that is both invasive and misaligned with zero trust's adaptive approach. App-level policies can extend the same controls without enrollment, making this option unnecessarily restrictive and less scalable.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.