SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a Conditional Access policy that requires MFA for the sensitive applications

  Why this is correct

  A Conditional Access policy is the correct approach because it uses application-based conditions to require MFA selectively for sensitive apps while allowing other apps to use less restrictive authentication. In a hybrid environment, this integrates with on-premises applications via Microsoft Entra application proxy or federated trusts, and supports session controls like sign-in frequency. This granularity aligns with the Zero Trust principle of least privilege, unlike tenant-wide or user-wide MFA enforcement.

• ✗

  Enable Security defaults

  Why it's wrong here

  Enabling Security defaults would force MFA for every user in the tenant, regardless of the application they access, because it is a baseline tenant-level policy. It also blocks legacy authentication and enforces MFA registration for all users, but it cannot exclude or target specific sensitive applications. For a hybrid organization that only needs MFA on sensitive apps, this blanket enforcement disrupts non-sensitive workflows and lacks the conditional logic of a scoped policy.

• ✗

  Enable per-user MFA in Entra ID

  Why it's wrong here

  Per-user MFA in Entra ID is a legacy enforcement model that sets MFA as a property on each user's account, forcing MFA for all authentication events involving that user, irrespective of application. It offers no conditions or exclusions based on app sensitivity, network location, or device state, so it cannot satisfy the requirement to protect only sensitive applications. It also uses an outdated interface and is less secure than Conditional Access, which supports detection of sign-in risk and session control.

• ✗

  Use Microsoft Entra ID Protection user risk policy

  Why it's wrong here

  Microsoft Entra ID Protection's user risk policy triggers MFA or password change based on the computed risk score of a user's sign-in, such as suspected compromise or leaked credentials, not on the sensitivity of the application being accessed. A user with a low risk level could access a sensitive app without MFA, while high-risk users would be challenged on every app including non-sensitive ones, so it does not provide the required app-based MFA. This policy also requires Entra ID P2 licenses and is designed for risk-based remediation, not as a substitute for a granular access control policy.

Go deeper

Related to this question