Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?
⚠ Common exam trap
Watch out — candidates often think blocking legacy authentication must be done at the protocol level (e.g., disabling in Exchange Online or firewall) rather than using a Conditional Access policy, which is the recommended and more comprehensive method in a Zero Trust architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.
It directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.
Why it's wrong here
Access reviews via Azure AD Identity Governance are periodic certifications and do not provide real-time enforcement for risk events; they are for access lifecycle, not immediate threat response. Restricting to hybrid Azure AD join enforces device state but ignores user-centric risk signals such as compromised credentials or anomalous sign-in location. Disabling legacy protocols in Exchange Online only protects the Exchange workload, leaving SharePoint, Skype, and other legacy endpoints still exposed to password-based attacks. Omitting Defender XDR integration also forfeits cross-domain telemetry and automated investigation, making Sentinel a log repository rather than a true SOC platform.
- ✗
Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.
Why it's wrong here
Azure AD B2B is designed for external collaboration, so applying it as an internal security measure is an architectural mismatch that doesn't address authentication posture. While MFA for all users is a foundational control, it is not adaptive and cannot block risky sessions transiently based on real-time risk scores. Azure AD Identity Protection is useful, but its risk signals must be wired into Conditional Access policies with session controls; otherwise, they are not acted upon. Blocking legacy authentication at the firewall is too coarse, as it cannot distinguish legacy protocols crossing different channels or apply user-specific policies, and it fails to provide the per-protocol, per-user blocking that a Conditional Access policy offers.
- ✗
Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.
Why it's wrong here
Intune compliance verifies device health and OS patch state, but it does not detect user risk, session anomalies, or compromised identity signals in real time, so it cannot drive dynamic access decisions during a breach. Furthermore, a generic "Conditional Access to block legacy protocols" lacks the specificity needed to block Exchange ActiveSync and other legacy clients; without explicit client-type targeting, such policies remain ineffective. Relying solely on Microsoft Defender for Identity (formerly Azure ATP) narrows visibility to on-premises identity threats, missing user risk from Entra ID Protection and cloud app session risks from Defender for Cloud Apps. A comprehensive approach must integrate multiple risk sources and enforce policy at the session layer.
- ✓
Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.
Why this is correct
This solution combines real-time risk assessment from Microsoft Entra ID Protection with adaptive Conditional Access policies, allowing sign-in risk to trigger MFA, block, or session restrictions dynamically. Session controls from Microsoft Defender for Cloud Apps enable granular cloud app session monitoring and policy enforcement, such as blocking download of sensitive files based on user risk. Blocking legacy authentication explicitly via a Conditional Access policy on client apps 'Exchange ActiveSync' and 'Other clients' is the documented method to prevent credential replay attacks. Finally, integrating Microsoft Sentinel with Defender XDR centralizes alerts from across the identity, endpoint, and cloud app domains, enabling advanced hunting and a unified incident response workflow.
Visual reference
Go deeper
Related to this question
Learn chapter
Zero Trust Principles and Strategy Development
Key term
SOC Architecture
SOC Architecture is the structured design of people, processes, and technology in a Security Operations Center to detect, analyze, and respond to cyber threats.
Key term
XDR Strategy
An XDR strategy is a plan to use extended detection and response tools that collect and analyze data from multiple security layers to stop cyberattacks more effectively.
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.