Question 1hardmultiple choice
Full question →hardmultiple choiceObjective-mapped
A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Distractor review
Require multifactor authentication (MFA)
MFA strengthens authentication but does not restrict actions like downloading once access is granted.
B
Distractor review
Require compliant device (Intune compliance policy)
Requiring a compliant device may block unmanaged devices entirely; it does not allow selective download blocking.
C
Best answer
Use app control with Microsoft Defender for Cloud Apps session policy
Session policies in Microsoft Defender for Cloud Apps allow granular controls, such as blocking download while permitting read-only access, based on device state.
D
Distractor review
Block access
Block access would prevent any access, which is too restrictive as the requirement is to allow read-only but block downloads.
Common exam trap
Common exam trap: ACLs stop at the first match
ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.
Technical deep dive
How to think about this question
ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.
KKey Concepts to Remember
- Standard ACLs match source addresses.
- Extended ACLs can match source, destination, protocol and ports.
- The first matching ACL entry is used.
- There is usually an implicit deny at the end.
TExam Day Tips
- Check inbound versus outbound direction.
- Read the ACL from top to bottom.
- Look for a broader permit or deny above the intended line.
Related practice questions
Related SC-900 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?
Question 2
A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to the shared responsibility model, which security responsibility is primarily handled by the customer?
Question 3
A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?
Question 4
A company runs a consumer-facing e-commerce website and wants to allow customers to sign in using their existing social media accounts such as Google, Facebook, or LinkedIn. Which Microsoft Entra ID solution should they implement?
Question 5
A company has a hybrid identity environment with Active Directory synchronizing to Microsoft Entra ID. They want users to be able to reset their own on-premises passwords via the cloud SSPR portal. What is the minimum license required for this capability?
Question 6
A company uses a cloud-based Customer Relationship Management (CRM) system that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, which security responsibility is primarily handled by the customer?
FAQ
Questions learners often ask
What does this SC-900 question test?
Standard ACLs match source addresses.
What is the correct answer to this question?
The correct answer is: Use app control with Microsoft Defender for Cloud Apps session policy — Conditional Access, when integrated with Microsoft Defender for Cloud Apps, supports session policies via app control. The session policy can monitor and restrict specific actions like block download, block copy/paste, etc., on unmanaged devices. Option A (Require MFA) does not control downloads. Option B (Require compliant device) could block all access but not provide read-only granularity. Option D (Block access) would deny all access, not allow read-only.
What should I do if I get this SC-900 question wrong?
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Discussion
Loading comments…
Sign in to join the discussion.