SC-100 Design security solutions for infrastructure Practice Question
A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy requiring compliant device
Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Microsoft Entra application proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra application proxy
Why it's wrong here
Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through an Microsoft Entra ID entry point. It handles authentication and authorization routing, but it does not evaluate device health, compliance, or Intune enrollment status. A device compliance check occurs in Conditional Access at sign-in, not in Application Proxy's publishing layer; thus it cannot block non-compliant devices from mailbox access.
- ✗
Windows Defender Firewall rules
Why it's wrong here
Windows Defender Firewall rules govern inbound and outbound network traffic on a single Windows device, permitting or blocking by port, protocol, or app. They are host-based and locally configured; they have no awareness of Microsoft Entra ID device identity or Intune compliance state. Because the block/allow logic is entirely local, it cannot enforce a centralized, device-trust-based requirement for Exchange Online access across the organization.
- ✗
Microsoft Defender for Cloud Apps session policy
Why it's wrong here
Microsoft Defender for Cloud Apps session policies are enforced as reverse-proxy controls that act after the user is already authenticated and the app session is established, such as disabling copy/paste or preventing document download. They do not perform a pre-access device compliance evaluation; that is the job of Conditional Access during the authentication request. Since session policies only modulate behavior within an allowed session, they cannot reject a non-compliant device before it tries to access email.
- ✓
Conditional Access policy requiring compliant device
Why this is correct
A Conditional Access policy requiring a compliant device blocks sign-in from devices that are not Intune-enrolled and verified against compliance policies, such as requiring disk encryption or an up-to-date OS. When the user attempts to access Exchange Online, Microsoft Entra ID evaluates the device's compliance claim from Intune and either grants, blocks, or triggers remediation in real time. For Microsoft 365 Business Premium, Intune is included, so this is the appropriate mechanism to prevent non-compliant devices from reading email.
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.