SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company uses Microsoft Entra ID for authentication. The security team wants to enforce that users can only access Microsoft 365 applications from compliant devices and trusted locations. They also want to require multi-factor authentication when users access from untrusted networks. Which feature should they configure?
⚠ Common exam trap
The trap here is selecting Intune compliance policies because they relate to device compliance, but they do not enforce access controls; Conditional Access is the enforcement point.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Conditional Access
Microsoft Entra Conditional Access is the policy engine that evaluates signals like device compliance, location, and user risk to make access decisions. It can require compliant devices, trusted locations, and MFA based on conditions. Intune compliance policies and ID Protection provide input signals, but Conditional Access is the feature that enforces the access requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Conditional Access
Why this is correct
Microsoft Entra Conditional Access allows organizations to create policies that enforce access controls based on conditions such as user, device compliance, location, and risk. It can require compliant devices, trusted locations, and multi-factor authentication for specific scenarios. This precisely matches the requirement to restrict access to compliant devices and trusted locations while enforcing MFA from untrusted networks.
- ✗
Microsoft Entra Authentication Methods policies
Why it's wrong here
Authentication Methods policies control which authentication methods are available to users, such as enabling MFA or passwordless authentication. They do not evaluate conditions like device compliance or location to make access decisions. While they are important for configuring MFA, they do not provide the conditional access logic required to enforce access based on device state or network location.
- ✗
Microsoft Intune compliance policies
Why it's wrong here
Microsoft Intune compliance policies define the rules for device compliance, such as requiring a PIN or encryption, and report compliance status to Entra ID. However, they do not enforce access controls directly. Intune works with Conditional Access to enforce device compliance, but the actual access decision is made by Conditional Access. Intune alone cannot restrict access based on location or require MFA.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection detects and remediates identity risks, but it does not enforce access controls like requiring compliant devices or trusted locations. It can feed risk signals into Conditional Access, but it is not the policy engine that grants or blocks access. ID Protection is focused on risk detection and reporting, not on conditional access enforcement.
Go deeper
Related to this question
Learn chapter
Azure Policy and Initiatives
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.