SC-900 Describe the capabilities of Microsoft Entra Practice Question
This SC-900 practice question tests your understanding of describe the capabilities of microsoft entra. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: device state in Conditional Access evaluates a device's compliance.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Entra ID and Intune for mobile device management. They want to grant access to a confidential project management site only from devices that are encrypted and have the latest anti-malware updates. Which Conditional Access assignment should they configure to enforce this requirement?
Correct. Device state policies can require a device to be marked as compliant, which enforces that it meets Intune-defined requirements like encryption and up-to-date anti-malware.
C
User risk
Why wrong: Incorrect. User risk detects compromised credentials, not device health.
D
Application
Why wrong: Incorrect. The Application assignment targets specific cloud apps but does not enforce device compliance.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device state
Option B (Device state) is correct because Conditional Access policies can use the 'Device state' condition to require that devices are marked as compliant or are hybrid Azure AD joined. Compliance is determined by Intune compliance policies, which can enforce requirements like encryption and up-to-date anti-malware. By setting the 'Device state' condition to 'Compliant device' or 'Hybrid Azure AD joined device', access to the confidential site is granted only to devices meeting those security baselines.
Key principle: Device state in Conditional Access evaluates a device's compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
Correct. Device state policies can require a device to be marked as compliant, which enforces that it meets Intune-defined requirements like encryption and up-to-date anti-malware.
Related concept
Device state in Conditional Access evaluates a device's compliance.
✗
User risk
Why it's wrong here
Incorrect. User risk detects compromised credentials, not device health.
✗
Application
Why it's wrong here
Incorrect. The Application assignment targets specific cloud apps but does not enforce device compliance.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'Device state' (which enforces device compliance like encryption and anti-malware) with 'Sign-in risk' or 'User risk', which are identity-focused risk detections unrelated to device health.
Detailed technical explanation
How to think about this question
Under the hood, Intune compliance policies evaluate device settings via the Microsoft Intune Management Extension and the Windows Health Attestation Service (for TPM-backed encryption). The Conditional Access engine checks the device's compliance status token (issued by Intune) during authentication; if the token is missing or expired, access is blocked. In a real-world scenario, a device that was compliant but later has its encryption disabled will have its compliance status revoked at the next Intune check-in, and subsequent access attempts will be denied.
KKey Concepts to Remember
Device state in Conditional Access evaluates a device's compliance.
Requires integration with an MDM like Microsoft Intune.
Intune defines and assesses device compliance policies (e.g., encryption, anti-malware).
Conditional Access grants or denies access based on the device's reported compliance status.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Device state in Conditional Access evaluates a device's compliance.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Review device state in Conditional Access evaluates a device's compliance., then practise related SC-900 questions on the same topic to reinforce the concept.
Describe the capabilities of Microsoft Entra — This question tests Describe the capabilities of Microsoft Entra — Device state in Conditional Access evaluates a device's compliance..
What is the correct answer to this question?
The correct answer is: Device state — Option B (Device state) is correct because Conditional Access policies can use the 'Device state' condition to require that devices are marked as compliant or are hybrid Azure AD joined. Compliance is determined by Intune compliance policies, which can enforce requirements like encryption and up-to-date anti-malware. By setting the 'Device state' condition to 'Compliant device' or 'Hybrid Azure AD joined device', access to the confidential site is granted only to devices meeting those security baselines.
What should I do if I get this SC-900 question wrong?
Review device state in Conditional Access evaluates a device's compliance., then practise related SC-900 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Device state in Conditional Access evaluates a device's compliance.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.