Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization is implementing a zero-trust security model and needs to ensure that all access to cloud resources is verified in real-time. You plan to use Microsoft Entra ID Conditional Access. Which policy component enforces real-time verification of user identity and device compliance before granting access?
⚠ Common exam trap
Many exam-takers confuse policy assignment (users/groups) with the enforcement mechanism (conditions and grant controls), thinking that merely assigning a policy to a user group enforces real-time verification, when in fact the conditions and grant controls are the components that perform the actual evaluation and access decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy with conditions and grant controls
Conditional Access policies with conditions and grant controls enforce real-time verification by evaluating signals such as user identity, device compliance (via Microsoft Intune), and location before allowing access to cloud resources. The grant controls block or require multi-factor authentication (MFA) or device compliance, ensuring zero-trust principles of explicit verification and least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Microsoft Secure Score
Why it's wrong here
Microsoft Secure Score is a measurement and benchmarking tool that quantifies an organization's security posture based on configuration improvements. It does not enforce access decisions at runtime; instead, it provides recommendations and tracks progress toward security best practices. As such, it cannot be used to implement zero trust policies because it never evaluates the context of an access request or grants or denies access.
- ✗
Use Azure AD Application Proxy
Why it's wrong here
Azure AD Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy and handling authentication externally. However, it is an application delivery feature, not a policy component; it does not evaluate conditional signals like user risk, device compliance, or sign-in location to make per-request access decisions. While it can integrate with Conditional Access, enabling it alone does not implement zero trust.
- ✓
Conditional Access policy with conditions and grant controls
Why this is correct
Conditional Access policies are the core enforcement mechanism for zero trust in Azure AD. They combine conditions such as user or group membership, location, device state, and sign-in risk with grant controls like requiring MFA, a compliant device, or a hybrid Azure AD joined device. These policies enforce real-time verification for every access attempt, ensuring that access is granted only when all configured conditions and controls are satisfied, aligning with the zero trust principle of 'verify explicitly'.
- ✗
Assign users and groups to the policy
Why it's wrong here
Assigning users and groups to a Conditional Access policy defines the scope of who the policy applies to, but it is only an assignment step in the policy creation process. It does not perform any verification or enforcement itself; the actual zero trust decisions come from the conditions and grant controls that dictate under what circumstances access is allowed. An assignment alone, without conditions and grants, cannot enforce real-time access control.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.