Design security operations, identity, and compliance capabilities →easyMultiple Choice

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "policyType": "IdentityProtection",
    "displayName": "MFA for risky sign-ins",
    "conditions": {
      "userRiskLevels": ["medium", "high"],
      "signInRiskLevels": ["high"]
    },
    "grantControls": {
      "builtInControls": ["mfa"]
    }
  }
}

The exhibit shows a conditional access policy from Microsoft Entra ID Identity Protection. When will this policy require MFA?

⚠ Common exam trap

Watch out — candidates often confuse the AND operator with OR, assuming that either risk condition alone would trigger MFA, but the exhibit explicitly shows both conditions must be satisfied simultaneously.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

When user risk is medium or high AND sign-in risk is high

The conditional access policy shown in the exhibit uses the 'Require MFA' grant control with conditions set for user risk (medium or high) AND sign-in risk (high). In Microsoft Entra ID Identity Protection, when both risk levels are evaluated together with an AND operator, MFA is only triggered when both conditions are met simultaneously. This ensures that MFA is enforced only when the user account itself is compromised (medium/high user risk) and the current sign-in session is also risky (high sign-in risk), providing a layered security response.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
When user risk is medium or high AND sign-in risk is high
Why this is correct
In Microsoft Entra Conditional Access, when both user risk and sign-in risk are specified as conditions, they are evaluated together using AND logic. The policy only applies when the user risk is medium or high and the sign-in risk is high simultaneously, so both conditions are required to trigger access controls. This matches the policy configuration exactly.
✗
When either user risk is medium or sign-in risk is high
Why it's wrong here
This option incorrectly interprets the policy as using OR logic, where a user risk of medium or high alone or a sign-in risk of high alone would satisfy the trigger. However, Conditional Access evaluates multiple conditions with AND semantics, meaning both conditions must be met for the policy to apply. By stating 'either' instead of 'and,' the option broadens the policy's trigger incorrectly, which could result in unintended access restrictions.
✗
When user risk is medium or high, regardless of sign-in risk
Why it's wrong here
This choice drops the sign-in risk requirement entirely, focusing only on user risk. In the actual policy, sign-in risk is a separate condition that must also be true, so ignoring it would allow the policy to trigger when user risk is medium or high even if sign-in risk is low or absent. The phrase 'regardless of sign-in risk' directly contradicts the policy's requirement that both conditions be satisfied, making this answer incorrect.
✗
When sign-in risk is high, regardless of user risk
Why it's wrong here
This option omits the user risk condition, assuming only sign-in risk is evaluated. The actual policy includes both user risk and sign-in risk, so high sign-in risk alone is insufficient because the user risk level must simultaneously be medium or high. By disregarding user risk, this answer fails to reflect the combined nature of the conditional access policy, misrepresenting when the policy takes effect.

Go deeper

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question