SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and Intune for device management. The security team wants to create a Conditional Access policy for a sensitive research application. They require that: 1) The user must use a device that is marked as compliant by Intune, and 2) The user must accept the company's terms of use before accessing the app. Which grant control combination should they configure in the policy?
⚠ Common exam trap
It's easy for candidates to confuse 'Require one of the selected controls' with 'Require all the selected controls', mistakenly thinking that 'one of' is sufficient when the question explicitly states both conditions must be met.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require all the selected controls'
The policy requires both conditions—device compliance and terms of use—to be enforced simultaneously. In Microsoft Entra Conditional Access, when multiple grant controls are selected and set to 'Require all the selected controls', the user must satisfy every control to gain access. This matches the security team's requirement that the device must be compliant AND the terms of use must be accepted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require one of the selected controls'
Why it's wrong here
This option is incorrect because choosing 'Require one of the selected controls' creates a logical OR condition. This means a user would be granted access if *either* their device is marked as compliant *or* they have accepted the terms of use. The scenario implicitly requires *both* conditions to be met, making the 'Require one' operator unsuitable as it would allow access even if only one of the two specified requirements is satisfied.
When this WOULD be correct
In a scenario where the security team wants to allow access if the user either has a compliant device OR has accepted terms of use (e.g., for a less sensitive app where flexibility is acceptable), selecting 'Require one of the selected controls' would be correct.
- ✗
Select 'Require multi-factor authentication' and 'Require terms of use' and choose 'Require all the selected controls'
Why it's wrong here
This option is incorrect because it introduces an unnecessary and unrequested requirement. While Multi-Factor Authentication (MFA) is a critical security control, the scenario specifically asks for device compliance and terms of use acceptance, not MFA. Including 'Require multi-factor authentication' as a grant control, even with the 'Require all' operator, would impose an additional hurdle not stipulated in the problem statement, thus failing to precisely address the given requirements.
When this WOULD be correct
In a scenario where the security team requires both multi-factor authentication and acceptance of terms of use, and both must be satisfied, selecting 'Require multi-factor authentication' and 'Require terms of use' with 'Require all the selected controls' would be correct.
- ✓
Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require all the selected controls'
Why this is correct
This is the correct configuration because Microsoft Entra Conditional Access policies use 'Grant controls' to define the specific requirements for access. Selecting both 'Require device to be marked as compliant' (which leverages Intune's compliance policies) and 'Require terms of use' as grant controls, combined with the 'Require all the selected controls' operator, ensures that users must satisfy both prerequisites simultaneously to gain access to resources. This precisely fulfills the scenario's need for both device compliance and terms of use acceptance.
- ✗
Select only 'Require terms of use' and configure device compliance as a condition
Why it's wrong here
This option is incorrect because 'Conditions' in Conditional Access define *when* a policy applies, not *what* is required for access. Configuring device compliance as a condition would only determine if the policy is triggered if the device is compliant, but it would not enforce compliance as a mandatory access requirement. Device compliance must be selected as a 'Grant control' to actively block access for non-compliant devices.
When this WOULD be correct
Option D would be correct if the question asked for a policy that only requires terms of use acceptance, and device compliance is used as a condition to scope the policy (e.g., only apply to non-compliant devices) rather than as a grant control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require all the selected controls'Correct answer▾
Why this is correct
This is the correct configuration because Microsoft Entra Conditional Access policies use 'Grant controls' to define the specific requirements for access. Selecting both 'Require device to be marked as compliant' (which leverages Intune's compliance policies) and 'Require terms of use' as grant controls, combined with the 'Require all the selected controls' operator, ensures that users must satisfy both prerequisites simultaneously to gain access to resources. This precisely fulfills the scenario's need for both device compliance and terms of use acceptance.
✗Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require one of the selected controls'Wrong answer — click to see why▾
Why this is wrong here
The policy requires both device compliance and terms of use to be enforced simultaneously, so 'Require one of the selected controls' would allow access if only one condition is met, violating the requirement.
★ When this WOULD be the correct answer
In a scenario where the security team wants to allow access if the user either has a compliant device OR has accepted terms of use (e.g., for a less sensitive app where flexibility is acceptable), selecting 'Require one of the selected controls' would be correct.
Why candidates choose this
Candidates may confuse 'Require one of the selected controls' with 'Require all the selected controls', thinking it means at least one control is required, but it actually means only one of the selected controls needs to be satisfied.
✗Select 'Require multi-factor authentication' and 'Require terms of use' and choose 'Require all the selected controls'Wrong answer — click to see why▾
Why this is wrong here
The policy requires both device compliance and terms of use, so 'Require all the selected controls' is needed. Option B incorrectly includes multi-factor authentication, which is not required, and uses 'Require one of the selected controls', which would allow bypassing one requirement.
★ When this WOULD be the correct answer
In a scenario where the security team requires both multi-factor authentication and acceptance of terms of use, and both must be satisfied, selecting 'Require multi-factor authentication' and 'Require terms of use' with 'Require all the selected controls' would be correct.
Why candidates choose this
Candidates may confuse multi-factor authentication with device compliance, or mistakenly think that 'Require one of the selected controls' is sufficient when multiple conditions are needed, due to misunderstanding of grant control logic.
✗Select only 'Require terms of use' and configure device compliance as a conditionWrong answer — click to see why▾
Why this is wrong here
Option D is wrong because it omits the 'Require device to be marked as compliant' grant control, which is explicitly required by the policy. Configuring device compliance as a condition only affects when the policy applies, not the grant requirements.
★ When this WOULD be the correct answer
Option D would be correct if the question asked for a policy that only requires terms of use acceptance, and device compliance is used as a condition to scope the policy (e.g., only apply to non-compliant devices) rather than as a grant control.
Why candidates choose this
Candidates may confuse the 'Conditions' section with 'Grant controls', thinking that setting device compliance as a condition satisfies the requirement, without realizing that grant controls enforce the actual access restrictions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.