Design security operations, identity, and compliance capabilities →hardMultiple Choice

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "Block high-risk sign-ins",
    "conditions": {
      "userRiskLevels": ["high"],
      "signInRiskLevels": []
    },
    "grantControls": {
      "builtInControls": ["block"]
    }
  }
}
```

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. Based on the JSON snippet, what is the most likely outcome when a user with high user risk attempts to sign in?

⚠ Common exam trap

Test-takers frequently confuse user risk with sign-in risk, assuming both must be high for a block to occur, or mistakenly think that high user risk only triggers MFA rather than a block, when the policy explicitly specifies 'block' as the control.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The sign-in is blocked because user risk is high

The Conditional Access policy shown in the JSON snippet includes a condition for 'userRiskLevels' set to 'high', and the grant control is 'block'. When a user with high user risk attempts to sign in, the policy evaluates the user risk level and, since it matches the condition, applies the block action, preventing the sign-in entirely.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The sign-in is blocked because user risk is high
Why this is correct
The Conditional Access policy explicitly assigns the 'High' user risk condition to the 'Block access' grant control, meaning any sign-in event where the user's risk level is assessed as High will be immediately denied. User risk is derived from identity protection signals such as leaked credentials or anomalous behavior, and once it meets the configured threshold, the policy's block action applies without regard to other conditions. In the exhibit, no sign-in risk condition is configured, so user risk alone is sufficient to trigger the block.
✗
The sign-in is blocked only if sign-in risk is also high
Why it's wrong here
This option incorrectly assumes that user risk and sign-in risk must both be High to trigger the block. In the exhibit, the sign-in risk condition is not configured at all, leaving it empty and therefore unevaluated. The user risk condition is set to High and mapped directly to the block grant control, so the sign-in is blocked based solely on user risk, not on a combination of both risk types.
✗
The sign-in is allowed because sign-in risk is not high
Why it's wrong here
This option misreads the policy's risk handling by suggesting that a non-High sign-in risk would allow the sign-in. Since the sign-in risk condition is not configured, the policy does not evaluate sign-in risk in any capacity; it treats the condition as not applied. The user risk condition, set to High with a block action, is the decisive factor and forcibly blocks the sign-in regardless of sign-in risk status.
✗
The user is prompted for multi-factor authentication
Why it's wrong here
No multi-factor authentication (MFA) grant control exists in the conditional access policy shown in the exhibit; the only access control configured is 'Block access' when user risk is High. Grant controls in Conditional Access define what must be satisfied to allow access, and since none are listed, MFA is not prompted. Instead, the policy's block action overrides any potential grant behavior, producing a hard denial of the session.

Go deeper

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question