Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?
⚠ Common exam trap
A common mix-up: candidates confuse user risk policies with sign-in risk conditions, or they default to per-user MFA or location-based policies, missing the precise combination of application scoping and risk-based conditions that the question requires.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA
It uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Microsoft Entra ID Protection user risk policy to require MFA
Why it's wrong here
A Microsoft Entra ID Protection user risk policy evaluates the probability that a user account is compromised based on historical behavior patterns, not the real-time risk of a specific sign-in event. Because it targets user risk rather than sign-in risk, it cannot detect or respond to risk signals associated with the authentication attempt itself. Additionally, user risk policies apply tenant-wide and cannot be scoped to specific applications like the financial apps, so this approach would not satisfy the requirement to protect those apps based on sign-in risk.
- ✗
Enable MFA per user for all users in the financial team
Why it's wrong here
Enabling MFA per user is a static, blanket configuration that forces MFA for every authentication attempt by the assigned users, regardless of the risk level of that specific sign-in. It does not evaluate sign-in risk in real time, nor can it be scoped to particular applications—the MFA requirement applies to all apps the user accesses. This would cause unnecessary friction for low-risk sign-ins and fails to align with the stated requirement of using sign-in risk as a conditional trigger for the financial applications.
- ✗
Create a Conditional Access policy that targets all users, includes a named location, and requires MFA
Why it's wrong here
A Conditional Access policy with a named location condition enforces access based on network geography or IP ranges, not on the real-time risk assessment of the sign-in. Targeting all users avoids the need to identify the financial applications as separate policy targets, so the policy would apply broadly rather than specifically to the financial apps. Requiring MFA solely due to location does not incorporate sign-in risk, which is the explicit condition required in the scenario, making this option incorrect.
- ✓
Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA
Why this is correct
A Conditional Access policy can be precisely scoped to the financial applications as the assigned target resources, while using sign-in risk as a condition to trigger MFA. Sign-in risk is calculated in real time by Microsoft Entra ID Protection, and Conditional Access allows it to be set to a threshold such as Low, Medium, or High. When a sign-in to a financial app has a risk level that meets the threshold, MFA is required, directly fulfilling the requirement for risk-based MFA protection on the financial applications without affecting unrelated apps or users.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.