SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?
⚠ Common exam trap
It's easy for candidates to confuse 'user risk' with 'sign-in risk', mistakenly selecting the user risk level condition when the scenario specifically describes blocking a sign-in event based on the IP address's anonymity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign-in risk level condition with 'High'
C is correct because the sign-in risk level condition in Conditional Access allows you to target sign-ins that have been assessed by Microsoft Entra ID Protection as risky. Anonymous IP addresses are a specific sign-in risk detection, and configuring the policy to block sign-ins with a 'High' sign-in risk level will automatically block those sign-ins. This directly addresses the security team's requirement to block sign-ins from anonymous IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User risk level condition with 'Medium'
Why it's wrong here
The 'User risk level' condition in Microsoft Entra Conditional Access policies evaluates the cumulative risk associated with a user's identity over time, based on detections like leaked credentials or impossible travel across multiple sessions. It does not assess the real-time risk of a single sign-in attempt originating from an anonymous IP address. An anonymous IP is a specific attribute of the current sign-in, not a historical risk factor for the user's identity itself.
- ✗
Device condition with 'Compliant'
Why it's wrong here
The 'Device condition' evaluates the state of the device attempting to sign in, such as whether it is marked as 'Compliant' by Microsoft Intune or 'Hybrid Azure AD joined'. This condition focuses on the device's managed status and health, not on the inherent risk associated with the sign-in attempt's origin, like an anonymous IP address. A compliant device can still be used from a risky network location.
- ✓
Sign-in risk level condition with 'High'
Why this is correct
The 'Sign-in risk level' condition directly assesses the risk associated with a specific authentication attempt in real-time, leveraging detections from Microsoft Entra ID Protection. An 'Anonymous IP address' is a prominent detection that contributes to a 'High' sign-in risk level, as it often indicates an attempt to obscure the user's true location, which is frequently associated with malicious activity. This condition is precisely designed to respond to such real-time anomalies.
- ✗
Location condition with 'Any IP'
Why it's wrong here
The 'Location condition' in Conditional Access policies is designed to enforce access based on predefined 'Named locations,' which are specific trusted or untrusted IP ranges or countries. It does not dynamically detect or categorize an 'Anonymous IP address' as a risk signal. Selecting 'Any IP' for a location condition simply means the policy applies regardless of the IP address, rather than identifying or responding to anonymous IPs as a high-risk factor.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.