SC-900 Grant controls Practice Question
A company uses Microsoft Entra ID. They want to enforce that users accessing the finance app from outside the corporate network must use multifactor authentication (MFA) and access from a device marked as compliant. Additionally, if the user's sign-in risk is medium or higher, access must be blocked. Which component of a Conditional Access policy should the administrator configure to specify the 'Block access' action for high-risk sign-ins?
⚠ Common exam trap
Watch out — candidates often confuse the 'Conditions' section (where sign-in risk is defined as a trigger) with the 'Grant controls' section (where the resulting action of blocking access is configured), leading them to incorrectly select Conditions instead of Grant controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant controls
The 'Block access' action is specified within the Grant controls section of a Conditional Access policy. Grant controls allow administrators to either require specific conditions (like MFA or compliant device) to be met for access to be granted, or to explicitly block access entirely. By selecting 'Block access' in the Grant controls, the policy enforces that any user meeting the policy's conditions (such as high sign-in risk) is denied access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant controls
Why this is correct
Grant controls allow you to either 'Block access' or require specific conditions (e.g., MFA, compliant device) to grant access. The 'Block access' option is located here.
- ✗
Conditions
Why it's wrong here
Conditions are used to define the signals that the policy evaluates (e.g., sign-in risk, location, device). The block action is not set in conditions.
- ✗
Assignments
Why it's wrong here
Assignments define which users, groups, or applications the policy applies to, not the access decision.
- ✗
Session controls
Why it's wrong here
Session controls enforce restrictions after access is granted (e.g., use app-enforced controls, frequency of sign-in). They do not block access.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.