Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
You are designing a security solution for a hybrid identity environment that uses Microsoft Entra ID and on-premises Active Directory. The company wants to enforce Zero Trust principles by continuously verifying user access. Which feature should you implement?
⚠ Common exam trap
Many candidates confuse 'Conditional Access policies' (which are static, policy-based controls evaluated at sign-in) with 'continuous access evaluation' (which dynamically re-evaluates access during an active session), leading them to choose a generic MFA or device join option instead of the real-time evaluation feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Conditional Access policies that evaluate session risk in real time using continuous access evaluation
Continuous access evaluation (CAE) is the correct feature because it enforces Zero Trust by evaluating access decisions in real time when critical events occur (e.g., user risk changes, device compliance loss, or token revocation), rather than relying on token lifetime. This ensures that session risk is continuously verified, aligning with the Zero Trust principle of 'never trust, always verify'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Microsoft Entra Hybrid Join for all devices
Why it's wrong here
Microsoft Entra Hybrid Join registers the device with Microsoft Entra ID, enabling device-based Conditional Access, but the resulting device identity is a static attribute checked at initial sign-in. It does not evaluate user risk or session context in real time, so a user whose risk score spikes or whose privileges change retains access until token expiry or sign-in. Therefore, it fulfills identity verification for device posture, not continuous user access monitoring.
- ✓
Implement Conditional Access policies that evaluate session risk in real time using continuous access evaluation
Why this is correct
Continuous Access Evaluation (CAE) is the correct mechanism because it forces Microsoft Entra ID to re-evaluate Conditional Access policies when critical events occur, such as user account disablement, password reset, or session revocation, rather than waiting for token expiration. It uses a multi-party token that carries a time-limited claim, and resource providers listen for cancellation signals, allowing access to be cut off within minutes. This is true continuous verification because both the token lifetime is shortened and the risk or compliance state is rechecked proactively.
- ✗
Implement Microsoft Entra Seamless Single Sign-On
Why it's wrong here
Microsoft Entra Seamless SSO is an authentication method that silently signs the user in through an integrated Windows Kerberos ticket, eliminating password prompts for a better user experience. However, it only handles the initial authentication event; after that, standard token lifetimes govern the session. It has no mechanism to observe session risk, revocation signals, or user state changes, so it cannot provide continuous verification of user access, only frictionless sign-on.
- ✗
Implement Microsoft Entra ID Protection to require multi-factor authentication for all users
Why it's wrong here
Microsoft Entra ID Protection with an MFA requirement is risk-based at sign-in time: it may force a challenge if user risk or sign-in risk is high, but once the user completes MFA, the resulting session remains valid until token expiry or sign-in refresh. MFA is a strong point-in-time authentication step, not an ongoing process. It does not revoke or re-verify access when conditions change mid-session, so it fails the continuous verification requirement despite being a robust security control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.