Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization is adopting Microsoft Entra ID as the identity provider for all SaaS applications. The security team wants to enforce multifactor authentication (MFA) for all users accessing these applications. Which approach aligns with security best practices and minimizes user friction?
⚠ Common exam trap
A common mix-up: candidates confuse Security defaults (Option C) as the best practice for MFA enforcement, but Security defaults lack the exclusion capabilities of Conditional Access, which is the recommended approach for minimizing friction while maintaining security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.
Conditional Access policies allow granular, risk-based MFA enforcement that excludes trusted locations (e.g., corporate offices) and trusted devices (e.g., compliant or hybrid-joined devices). This aligns with the Zero Trust principle of 'verify explicitly' while minimizing user friction by not prompting for MFA when the user is already in a trusted context. Security defaults (Option C) enforce MFA for all users but lack the ability to exclude trusted locations or devices, which can cause unnecessary friction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable per-user MFA for all users in Microsoft Entra ID.
Why it's wrong here
Per-user MFA forces a static, always-on authentication challenge for every user regardless of context. Because it operates at the user object level, it cannot evaluate sign-in risk, device compliance, or IP/location trust, and it provides no exclusion or break-glass exception paths, leading to unnecessary friction and support overhead while not aligning with a modern, condition-aware security posture.
- ✗
Disable MFA and rely on strong password policies.
Why it's wrong here
Relying solely on strong password policies leaves the tenant exposed to credential-based attacks such as phishing, password spraying, and credential stuffing, which MFA is specifically designed to mitigate. The requirement explicitly mandates MFA enforcement, and disabling MFA would directly violate that explicit compliance and security goal, so this option is not viable.
- ✗
Enable Microsoft Entra ID Security defaults.
Why it's wrong here
Security defaults provide a prescriptive baseline that requires MFA for all users, but it is a fixed, policy-less mode that cannot be customized for trusted locations, excluded users, or specific cloud apps. It also lacks risk-based conditional access controls and session management capabilities, making it an acceptable baseline only for tenants without Premium licenses, not a solution for a requirement that asks for risk-based MFA with exceptions.
- ✓
Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.
Why this is correct
A Conditional Access policy gives granular control to require MFA for all cloud apps while excluding trusted locations and devices, enabling risk-based, context-aware enforcement. It can leverage named locations, device compliance, and sign-in risk, and integrate with session controls, session persistence, and break-glass accounts, directly satisfying both the MFA mandate and the need for exception handling.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.