Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft Defender for Cloud Apps as the primary policy enforcement point because of its session monitoring capabilities, but it is actually a downstream consumer of Conditional Access decisions, not the engine that evaluates user, device, location, and risk signals in real time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access
Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Azure AD that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Conditional Access
Why this is correct
Microsoft Entra ID Conditional Access is the direct policy engine for access control in a Zero Trust architecture. It continuously evaluates signals such as user identity, group membership, location, device compliance, and real-time risk (from Entra ID Protection) to enforce granular decisions like allow, deny, or require MFA. Because it applies these conditions to every sign-in and session in real time, it is the core mechanism for implementing 'explicit verification' in Zero Trust.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on shadow IT discovery, data loss prevention, and session-level controls for cloud applications once a user already has access. While it can integrate with Conditional Access through Conditional Access App Control to enforce session policies or block downloads, it does not itself evaluate sign-in conditions or make the initial access decision. Thus, it complements but cannot replace the policy-enforcement role of Conditional Access.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune provides mobile device management (MDM) and mobile application management (MAM), allowing IT to deploy configurations, enforce device compliance policies, and manage applications across endpoints. Its primary output is the device compliance state that Conditional Access can consume as a signal, but Intune does not itself evaluate conditional conditions or decide whether a user is granted access to an application. It is a device and application management tool, not an access-control decision engine.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a comprehensive portfolio for data security, governance, and compliance, including information protection, data loss prevention, eDiscovery, and audit. Its purpose is to help organizations classify, label, and protect data at rest and in motion, and it can react to access events or enforce DLP rules after a file is accessed or shared. However, Purview does not evaluate sign-in requests or enforce authentication and authorization decisions, making it unrelated to the core access-denial or MFA-challenge logic of Conditional Access.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.