SC-100 Design security solutions for infrastructure Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

  Why it's wrong here

  Defender for Cloud Apps session policies are designed to monitor and control sessions in real time using app or OU controls, but they are not an access-gate mechanism; they do not evaluate device compliance or block a sign-in before a session begins. Conditional Access policies are the correct enforcement point to reject access based on location or device state. A session policy that merely 'monitors' non-compliant devices provides visibility only and fails to enforce the required block.

• ✓

  Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.

  Why this is correct

  Create two separate Conditional Access policies to achieve the required granularity. The first policy targets 'All cloud apps' but excludes Microsoft 365 and uses the 'Block' grant control for untrusted locations, preventing access to non-Microsoft 365 apps from risky networks. The second policy targets Microsoft 365 and requires a compliant device, allowing compliant devices to reach M365 even from untrusted locations. Since the policies are evaluated separately, they cooperate to enforce distinct requirements per app group.

• ✗

  Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

  Why it's wrong here

  A single Conditional Access policy cannot apply different grant controls to different included applications. If you include 'All cloud apps' and configure 'Require compliant device' as the grant, that same requirement is applied to every app in scope, including Microsoft 365. To enforce a compliant-device requirement only for Microsoft 365, you must create a policy exclusively targeting Microsoft 365, leaving other apps untouched by that control.

• ✗

  Configure a conditional access policy that blocks access from untrusted locations for all apps.

  Why it's wrong here

  Blocking access from untrusted locations for all apps indiscriminately denies Microsoft 365 to users on compliant devices who happen to be in an untrusted location. The desired outcome explicitly allows compliant devices to access Microsoft 365 regardless of location, so this blanket location block is too coarse. Excluding Microsoft 365 from the location-based block—and handling that app with a separate device-compliance policy—is what makes the two-policy approach correct.

Go deeper

Related to this question