Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company uses Microsoft Intune to manage devices. They want to ensure that only devices that have passed health attestation can access corporate email. Which method should they use?
⚠ Common exam trap
Watch out — candidates often confuse device compliance policies (which evaluate and report health state) with device configuration policies (which only apply settings), leading candidates to pick Option D, which cannot enforce access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a device compliance policy for health attestation and use Conditional Access to require compliant devices
It combines a device compliance policy that evaluates health attestation (e.g., BitLocker status, Secure Boot, code integrity) with a Conditional Access policy that grants access to corporate email only when the device is marked as compliant. This is the standard Microsoft approach for enforcing health attestation before granting access to cloud resources like Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Microsoft Defender for Endpoint to block devices that fail health attestation
Why it's wrong here
Defender for Endpoint is an endpoint detection and response (EDR) platform that provides threat discovery, antivirus, and vulnerability management, but it does not evaluate the Windows Device Health Attestation (DHA) report that Intune consumes. While Microsoft Defender for Endpoint can share risk scores with Conditional Access as an additional signal, blocking devices that fail health attestation is not a native endpoint blocking function—enforcement requires an Intune compliance policy. Consequently, relying solely on Defender for Endpoint would leave the access decision unauthoritative.
- ✓
Create a device compliance policy for health attestation and use Conditional Access to require compliant devices
Why this is correct
Device compliance policies in Microsoft Intune include a 'Device Health Attestation' section that reports security boot, BitLocker, and code integrity state from supported Windows devices. After the policy is evaluated, Conditional Access can require 'Device to be marked as compliant' as a grant control, preventing sign-in from devices that fail attestation checks. This pairing is the correct sequence: Intune establishes the health baseline and Conditional Access enforces access, making it the only option here that actually gates authentication.
- ✗
Create an app protection policy to require device health attestation
Why it's wrong here
App protection policies (APP) focus on how data is handled inside managed applications—requiring PINs, preventing copy/paste, encrypting app containers—and are deployed without full device enrollment. The APP framework has its own threat checks like jailbreak/root detection, but it does not consume the Device Health Attestation (DHA) signals used by Intune's compliance engine. Therefore, an APP cannot require device health attestation because attestation is a device-level, pre-access check, not an in-app data protection control.
- ✗
Create a device configuration policy to enforce health attestation
Why it's wrong here
Device configuration policies push settings such as Wi-Fi profiles, password policies, and feature restrictions, but they do not perform conditional evaluation of state; they simply apply desired settings. Health attestation is an assessment of device integrity (secure boot, BitLocker, etc.) rather than a setting that can be 'pushed.' Enforcement that blocks access to resources only occurs when a compliance policy works with Conditional Access—a configuration policy has no authentication-gating mechanism and therefore cannot enforce health attestation by itself.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.