SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?
⚠ Common exam trap
Many exam-takers confuse Session controls (which manage behavior after access is granted) with Grant controls (which enforce requirements before access is granted), leading them to pick a session-based option like 'Sign-in frequency' instead of the correct Grant combination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant - Require MFA and Require terms of use
The Grant control in Conditional Access allows you to require multiple conditions to be satisfied before granting access. By selecting both 'Require MFA' and 'Require terms of use' under Grant, the policy enforces that the user must complete both MFA and accept the terms of use when accessing the HR portal from an unmanaged device. This directly meets the requirement for both authentication and consent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Session control - Use app enforced restrictions
Why it's wrong here
This session control directs traffic through Microsoft Defender for Cloud Apps to apply policies like blocking downloads or preventing copy-paste within an application session. While it can restrict actions during an active session, it does not function as a pre-authentication gate to require multifactor authentication or enforce acceptance of terms of use before the user gains initial access to the resource. Its focus is on in-session behavior, not initial access requirements.
- ✓
Grant - Require MFA and Require terms of use
Why this is correct
This option utilizes two distinct grant controls within a Conditional Access policy, directly addressing the requirements. "Require multifactor authentication" ensures users provide a second verification factor, significantly enhancing security at the point of access. Concurrently, "Require terms of use" mandates that users review and explicitly accept a specified document before they are permitted to access the protected resource, directly fulfilling both stated requirements for initial access.
- ✗
Grant - Require approved client app
Why it's wrong here
The "Require approved client app" grant control ensures that users can only access resources from specific, managed applications, such as Outlook Mobile or Microsoft Teams, which are typically secured by Microsoft Intune. While this enhances data protection by ensuring app-level policies are applied and data is contained, it is solely focused on the application's compliance and does not inherently trigger multifactor authentication or present a terms of use prompt for user acceptance.
- ✗
Session control - Sign-in frequency
Why it's wrong here
Sign-in frequency is a session control designed to dictate how often users must reauthenticate to maintain their active session, typically after a specified duration. While it can involve MFA during reauthentication, its primary purpose is session management and revalidation, not to enforce an initial, mandatory MFA challenge or a one-time acceptance of terms of use before any access is granted. It doesn't act as the initial gate for these specific requirements.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.