SC-100 Practice Question: Design solutions that align with security best practices and priorities
Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?
⚠ Common exam trap
Watch out — candidates often think blocking legacy authentication must be done at the protocol level (e.g., disabling in Exchange Online or firewall) rather than using a Conditional Access policy, which is the recommended and more comprehensive method in a Zero Trust architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.
It directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Microsoft Entra ID Identity Governance with access reviews. Use Conditional Access to require hybrid Microsoft Entra ID joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.
Why it's wrong here
Access reviews via Microsoft Entra ID Identity Governance are periodic certifications and do not provide real-time enforcement for risk events; they are for access lifecycle, not immediate threat response. Restricting to hybrid Microsoft Entra ID join enforces device state but ignores user-centric risk signals such as compromised credentials or anomalous sign-in location. Disabling legacy protocols in Exchange Online only protects the Exchange workload, leaving SharePoint, Skype, and other legacy endpoints still exposed to password-based attacks. Omitting Defender XDR integration also forfeits cross-domain telemetry and automated investigation, making Sentinel a log repository rather than a true SOC platform.
- ✗
Use Microsoft Entra B2B for external users only. Configure Conditional Access with MFA for all users. Use Microsoft Entra ID Protection for risk. Block legacy authentication at the firewall level.
Why it's wrong here
Microsoft Entra B2B is designed for external collaboration, so applying it as an internal security measure is an architectural mismatch that doesn't address authentication posture. While MFA for all users is a foundational control, it is not adaptive and cannot block risky sessions transiently based on real-time risk scores. Microsoft Entra ID Protection is useful, but its risk signals must be wired into Conditional Access policies with session controls; otherwise, they are not acted upon. Blocking legacy authentication at the firewall is too coarse, as it cannot distinguish legacy protocols crossing different channels or apply user-specific policies, and it fails to provide the per-protocol, per-user blocking that a Conditional Access policy offers.
- ✗
Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.
Why it's wrong here
Intune compliance verifies device health and OS patch state, but it does not detect user risk, session anomalies, or compromised identity signals in real time, so it cannot drive dynamic access decisions during a breach. Furthermore, a generic "Conditional Access to block legacy protocols" lacks the specificity needed to block Exchange ActiveSync and other legacy clients; without explicit client-type targeting, such policies remain ineffective. Relying solely on Microsoft Defender for Identity (formerly Azure ATP) narrows visibility to on-premises identity threats, missing user risk from Entra ID Protection and cloud app session risks from Defender for Cloud Apps. A comprehensive approach must integrate multiple risk sources and enforce policy at the session layer.
- ✓
Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.
Why this is correct
This solution combines real-time risk assessment from Microsoft Entra ID Protection with adaptive Conditional Access policies, allowing sign-in risk to trigger MFA, block, or session restrictions dynamically. Session controls from Microsoft Defender for Cloud Apps enable granular cloud app session monitoring and policy enforcement, such as blocking download of sensitive files based on user risk. Blocking legacy authentication explicitly via a Conditional Access policy on client apps 'Exchange ActiveSync' and 'Other clients' is the documented method to prevent credential replay attacks. Finally, integrating Microsoft Sentinel with Defender XDR centralizes alerts from across the identity, endpoint, and cloud app domains, enabling advanced hunting and a unified incident response workflow.
Visual reference
Go deeper
Related to this question
Learn chapter
Designing Network and Hybrid Infrastructure Security
Key term
Microsoft 365 Security Design
Microsoft 365 Security Design is the process of planning and configuring built-in security features in Microsoft 365 to protect data, identities, and devices from cyber threats.
Key term
SOC Architecture
SOC Architecture is the structured design of people, processes, and technology in a Security Operations Center to detect, analyze, and respond to cyber threats.
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.