Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
Implementing Continuous Access Evaluation Using Microsoft Entra ID Conditional Access
Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?
Quick Answer
The answer is Conditional Access. This is the correct feature because it enables continuous access evaluation with conditional access policies that dynamically assess every authentication request against real-time signals like user risk from Identity Protection, device compliance from Microsoft Intune, and location via named IP ranges, directly enforcing the Zero Trust principle of “never trust, always verify.” On the Microsoft Cybersecurity Architect exam, this question tests your understanding of how Conditional Access serves as the policy engine for continuous evaluation, often appearing in scenario-based items where you must distinguish it from static tools like Privileged Identity Management or Identity Governance. A common trap is confusing Conditional Access with Identity Protection alone—remember that Identity Protection provides the risk signal, but Conditional Access is the decision point that acts on it. Memory tip: think of Conditional Access as the “bouncer” that checks ID, risk score, and location at every door, not just once at the entrance.
⚠ Common exam trap
Test-takers frequently confuse Identity Protection (which only detects risk) with Conditional Access (which enforces policies based on that risk), leading them to select Option C instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Governance
Why it's wrong here
Identity Governance manages access reviews and entitlements.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
PIM manages privileged roles, not general access policies.
- ✗
Identity Protection
Why it's wrong here
Identity Protection detects risks but does not enforce access policies.
- ✓
Conditional Access
Why this is correct
Conditional Access enforces policies based on user, device, and location signals.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?
medium- ✓ A.Microsoft Entra ID Conditional Access
- B.Microsoft Intune
- C.Microsoft Sentinel
- D.Microsoft Defender for Cloud
Why A: Microsoft Entra ID Conditional Access is the correct solution because it enables you to enforce access policies based on real-time risk signals, such as user risk, sign-in risk, and device compliance. It integrates with Identity Protection to evaluate dynamic risk levels and can block or require multi-factor authentication (MFA) accordingly, directly supporting the zero-trust principle of 'never trust, always verify'.
Variation 2. Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?
easy- ✓ A.Microsoft Entra ID Conditional Access
- B.Microsoft Defender for Cloud Apps
- C.Microsoft Intune
- D.Microsoft Purview
Why A: Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Azure AD that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.