SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Intune to manage devices. They want to ensure that only devices with a specific minimum operating system version can access corporate email. What should they configure?
⚠ Common exam trap
Many exam-takers confuse device compliance policies (which evaluate device health) with device configuration profiles (which apply settings) or app protection policies (which protect data within apps), leading them to choose an option that does not enforce the OS version requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a device compliance policy specifying minimum OS version
To enforce a minimum operating system version for accessing corporate email, you need a device compliance policy in Microsoft Intune. This policy evaluates device attributes like OS version and marks devices as compliant or non-compliant. When combined with a Conditional Access policy in Entra ID, non-compliant devices can be blocked from accessing corporate resources, including email.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy an app protection policy for the email app
Why it's wrong here
App protection policies (MAM policies) are designed to safeguard organizational data within specific applications, controlling actions like copy/paste, save-as, and printing. They apply to the application layer, irrespective of whether the device itself is managed or compliant. Therefore, they cannot define or enforce a minimum operating system version requirement for the device to gain access to corporate resources.
- ✓
Create a device compliance policy specifying minimum OS version
Why this is correct
Device compliance policies in Microsoft Intune are specifically designed to define the security posture and configuration requirements that a device must meet to be considered "compliant." By specifying a minimum OS version, this policy directly establishes the foundational device-level standard required. This makes it the essential first step for enforcing operating system requirements before access to corporate resources can be granted.
- ✗
Create a device configuration profile for OS settings
Why it's wrong here
Device configuration profiles are primarily used to deploy and enforce specific settings on devices, such as Wi-Fi profiles, VPN configurations, or security features like BitLocker. While they can set certain OS parameters, they do not evaluate the device's current state against a defined standard or mark it as compliant or non-compliant. They are for applying configurations, not for assessing adherence to a policy that gates access.
- ✗
Configure a conditional access policy in Entra ID to block non-compliant devices
Why it's wrong here
Conditional Access policies in Microsoft Entra ID are powerful tools for enforcing access decisions based on various conditions, including a device's compliance status. However, a Conditional Access policy *consumes* the compliance state reported by Intune; it does not *define* what constitutes compliance itself. Without a preceding device compliance policy to establish the minimum OS version requirement, Conditional Access has no compliance state to evaluate for this specific condition, making it ineffective in this initial step.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.