Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?
⚠ Common exam trap
It's easy for candidates to confuse Identity Protection's risk detection capabilities with the enforcement mechanism, but Identity Protection alone cannot block access based on device health or enforce conditional policies—it only provides signals that must be consumed by Conditional Access to make a decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access
Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Domain Services
Why it's wrong here
Microsoft Entra ID Domain Services provides managed domain services such as Kerberos, NTLM, and LDAP, which are legacy authentication protocols. It acts as an identity provider for traditional on-premises-style authentication, but it does not evaluate real-time signals like user risk, device compliance, or location. Zero Trust requires policy enforcement based on these signals, and Domain Services offers no such dynamic access decisions, making it unsuitable for your stated goal of verifying device health and continuous compliance.
- ✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Identity Protection assesses sign-in risk and user risk to trigger automated remediation, but it does not enforce device health checks or continuous verification of device compliance before access. It is tempting because it addresses user identity risk, which is a component of Zero Trust; it would be the correct choice if the scenario focused solely on detecting compromised credentials rather than requiring device health verification.
- ✓
Microsoft Entra ID Conditional Access
Why this is correct
Microsoft Entra ID Conditional Access is the correct answer because it is the policy engine that evaluates real-time signals—such as user identity, group membership, location, device compliance, and sign-in risk—to allow or restrict access. It enables Zero Trust policies like requiring compliant devices, enforcing multi-factor authentication, and blocking sessions when risk is detected. Conditional Access also integrates with continuous access evaluation (CAE) to revoke access in near real-time when conditions change, directly aligning with the 'never trust, always verify' principle and your requirement for device health verification before access.
- ✗
Microsoft Entra ID Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) focuses on managing, activating, and auditing privileged role assignments, providing just-in-time access and approval workflows for administrative roles. It does not evaluate device health, sign-in risk, or enforce policies on end-user access to applications. PIM is a governance tool for who can hold elevated roles and when, not an access control point for verifying device compliance or continuously re-assessing risk during every session. Thus it complements Conditional Access but is not the mechanism that would enforce device health requirements in your Zero Trust adoption.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.