Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization needs to enforce multi-factor authentication (MFA) for all users accessing Microsoft Entra ID integrated applications. However, users in the finance department should be exempted from MFA when accessing a specific legacy financial app that does not support modern authentication. What should you design?
⚠ Common exam trap
Candidates often think per-user MFA (Option B) is sufficient for granular exclusions, but it lacks application-level control and would either block the legacy app or leave the entire finance department unprotected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that requires MFA for all cloud apps except the legacy app
Conditional Access policies allow granular control over which applications require MFA. By creating a policy that requires MFA for all cloud apps except the legacy financial app, you can enforce MFA broadly while exempting the specific app that does not support modern authentication. This approach is more flexible and secure than per-user MFA or security defaults, as it can target specific applications and conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable security defaults for all users
Why it's wrong here
Security defaults enforce a baseline set of security policies, including requiring MFA for all users, but they cannot be scoped per application. This means the finance department would be forced to use MFA even when accessing the legacy app, which directly violates the requirement to exempt that specific app. Security defaults are an all-or-nothing configuration with no exclusion rules, making them unsuitable when a targeted application exemption is needed.
- ✗
Enable per-user MFA and exclude the finance department
Why it's wrong here
Per-user MFA is a per-account state that prompts for MFA on every authentication for the enabled user, and it does not support application-level exclusions. Excluding the finance department would disable MFA for them across all cloud apps, including those that must be protected, which is broader than necessary and fails the requirement. Additionally, per-user MFA is a legacy approach that Microsoft recommends replacing with Conditional Access, and it lacks the granular control that app exclusions require.
- ✗
Use Microsoft Entra Identity Protection to require MFA based on risk
Why it's wrong here
Microsoft Entra Identity Protection's risk-based policies are designed to react to detected risk signals, such as risky sign-ins or compromised users, rather than to enforce an unconditional MFA requirement. These policies can require MFA only when a sign-in is identified as risky, so a non-risky sign-in to the legacy app could still bypass MFA, and there is no mechanism to exempt the legacy app specifically. Thus, risk-based policies cannot guarantee that all cloud apps except the legacy app require MFA.
- ✓
Create a Conditional Access policy that requires MFA for all cloud apps except the legacy app
Why this is correct
A Conditional Access policy can include all cloud apps in the 'target resources' assignment and then exclude the legacy application from the same assignment, allowing you to require MFA for every other cloud app. When the finance department is included in the users/groups, they will be prompted for MFA unless the sign-in targets the excluded legacy app, which precisely matches the stated requirement. Conditional Access policies are evaluated at sign-in time and provide the granular, app-level scoping that the other options lack.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.