SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Intune for mobile device management (MDM). They need to ensure that corporate data on personal devices is encrypted. Which configuration profile type should they deploy?
⚠ Common exam trap
Many exam-takers confuse compliance policies (which only check and report encryption status) with configuration profiles (which actually deploy the encryption setting), leading them to pick Option C instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device restrictions profile
Device restrictions profile in Microsoft Intune allows administrators to enforce device-level security settings, including encryption of corporate data on personal devices. This profile type can require BitLocker (Windows) or FileVault (macOS) encryption, and for mobile devices, it can mandate device encryption via policies that align with platform-specific encryption standards (e.g., Android's full-disk encryption or iOS Data Protection). By deploying a device restrictions profile with encryption settings enabled, the organization ensures that corporate data stored on the device is protected at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Email profile
Why it's wrong here
An Email profile in Microsoft Intune is specifically designed to configure access to corporate email accounts on mobile devices, pre-populating server settings, user names, and authentication methods. While it helps secure email communication through protocols like S/MIME or TLS, its function is limited to the email client configuration and does not manage or enforce device-level data encryption for the entire device storage.
- ✗
Certificate profile
Why it's wrong here
A Certificate profile in Microsoft Intune is used to deploy digital certificates to devices, which are essential for secure authentication to Wi-Fi, VPN, or other corporate resources, and for signing/encrypting emails. While certificates are a cornerstone of security infrastructure, this profile's function is solely to provision and manage the lifecycle of certificates, not to directly configure or enforce device-wide data encryption settings.
- ✗
Compliance policy
Why it's wrong here
A Compliance policy in Microsoft Intune defines the security baselines and health requirements that devices must meet to be considered compliant within an organization. While a compliance policy can assess whether device encryption is enabled and report non-compliance, it does not actively configure or enforce the encryption setting itself. Instead, it flags non-compliant devices, which can then be blocked from accessing corporate resources or subject to remediation actions.
- ✓
Device restrictions profile
Why this is correct
A Device restrictions profile in Microsoft Intune is the appropriate configuration profile for enforcing various security and functional settings on mobile devices, including device-level data encryption. This profile allows administrators to mandate specific encryption requirements, such as requiring storage encryption for the entire device, setting encryption types, or configuring related password policies necessary for unlocking encrypted data. It directly applies these security configurations to the device operating system.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
Key term
BitLocker
BitLocker is a full-disk encryption feature built into Windows that protects data by encrypting the entire drive so that unauthorized users cannot access files without the correct recovery key.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.