Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Cloud's security policy (which governs cloud resource configurations) with Entra ID's conditional access policy (which governs user access decisions), leading them to select Defender for Cloud as the central policy engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access
Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Conditional Access
Why this is correct
Microsoft Entra ID Conditional Access is the core policy engine for Zero Trust, evaluating signals such as user identity, device health, location, and risk in real time. It enforces 'never trust, always verify' by granting, blocking, or requiring step-up authentication based on conditional policies. As the central access decision point, it integrates with all other Zero Trust pillars and is the primary mechanism for securing user access.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) solution. It focuses on assessing and hardening the security configuration of Azure, on-premises, and multi-cloud workloads through secure score, recommendations, and threat detection. While it helps identify misconfigurations and vulnerabilities, it does not make user access decisions or enforce conditional policies; its role is infrastructure protection, not access control.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR solution that aggregates logs and telemetry from across the enterprise to detect, investigate, and respond to threats. It is an observation and response tool, not a policy enforcement point; it receives data from signals like Conditional Access logs but cannot itself grant or deny user access. While it can automate remediation actions, it does not define or enforce the Zero Trust access policies—it consumes and acts on the output of those policies.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a Unified Endpoint Management (UEM) solution that handles device enrollment, compliance policies, configuration profiles, and application management. In a Zero Trust architecture, Intune provides crucial device health and compliance signals, but it does not evaluate the complete access context or enforce Conditional Access decisions. Conditional Access consumes Intune's compliance state to allow or block access, meaning Intune is a data source for the policy engine, not the policy engine itself.
Go deeper
Related to this question
Learn chapter
Zero Trust Principles and Strategy Development
Key term
Zero Trust Strategy
A security model that requires continuous verification of every user, device, and connection before granting access to any resource, regardless of where the request originates.
Key term
Microsoft 365 Security Design
Microsoft 365 Security Design is the process of planning and configuring built-in security features in Microsoft 365 to protect data, identities, and devices from cyber threats.
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.