Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution that ensures all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. However, some legacy apps still require basic authentication. What should you recommend?
⚠ Common exam trap
A common mix-up: candidates confuse 'blocking legacy authentication' with 'disabling basic authentication' in Exchange Online or other services, but the correct approach is to use the tenant-wide Conditional Access policy to block all legacy authentication protocols, which is a distinct setting in Microsoft Entra ID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable authentication policies in Microsoft Entra ID to block legacy authentication
Enabling authentication policies in Microsoft Entra ID to block legacy authentication ensures that all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. Legacy authentication protocols (e.g., POP3, IMAP, SMTP, basic auth) bypass modern authentication and Conditional Access, so blocking them forces clients to use modern protocols (OAuth 2.0, OpenID Connect) that are subject to Conditional Access evaluation. This directly addresses the requirement while allowing legacy apps to be updated or replaced over time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable authentication policies in Microsoft Entra ID to block legacy authentication
Why this is correct
Enabling authentication policies in Microsoft Entra ID, such as the legacy authentication block, is the correct approach because legacy protocols like POP3, IMAP4, and SMTP do not support modern authentication and thus cannot be evaluated against Conditional Access policies. Blocking these protocols forces clients to use modern authentication (OAuth 2.0, OpenID Connect, SAML), ensuring multi-factor authentication and device compliance checks are enforced on every sign-in.
- ✗
Configure Active Directory Federation Services (AD FS) as the identity provider
Why it's wrong here
Configuring AD FS as the identity provider alone does not resolve the legacy authentication bypass because AD FS primarily handles authentication for claims-aware applications and federated trust. Legacy authentication clients, such as those using IMAP4 or POP3, do not interact with AD FS in a way that enforces Conditional Access, allowing them to bypass MFA and other conditional policies. AD FS can pass through or issue claims but does not act as a gatekeeper for these non-interactive protocols.
- ✗
Deploy Microsoft Entra Application Proxy for all legacy apps
Why it's wrong here
Deploying Microsoft Entra Application Proxy for all legacy apps provides secure remote access by publishing apps through the cloud, but it does not block or modify the underlying authentication protocols used by clients. Application Proxy performs pre-authentication and can require modern auth for the proxy itself, yet legacy clients that don't support modern auth can still authenticate natively to the app, bypassing Conditional Access. Its primary purpose is access, not protocol enforcement.
- ✗
Enable pass-through authentication (PTA) to forward authentication requests
Why it's wrong here
Enabling pass-through authentication (PTA) simply validates user passwords against on-premises Active Directory without introducing any capability to block legacy authentication. PTA operates at the authentication event level, but legacy authentication protocols like POP3 and IMAP4 still use the same protocol flows and can bypass Conditional Access because they are not capable of carrying claims for MFA. Microsoft explicitly recommends that PTA be combined with legacy authentication blocking to enforce Conditional Access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.