SC-900 Describe the capabilities of Microsoft Entra Practice Question
A healthcare organization uses Microsoft Entra ID and needs to enforce that only users from the United States and Canada can access patient records. Access attempts from all other locations must be blocked. Which Microsoft Entra ID Conditional Access condition should be configured to meet this requirement?
⚠ Common exam trap
Watch out — candidates often confuse the Locations condition with Sign-in risk, mistakenly thinking that blocking by country is a risk-based control rather than a straightforward geographic restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Locations
The Locations condition in Microsoft Entra ID Conditional Access allows administrators to define named locations (e.g., countries or IP ranges) and then grant or block access based on those locations. By configuring a policy that blocks access from all countries except the United States and Canada, the organization can enforce geographic restrictions on patient record access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device state
Why it's wrong here
The Device state condition in Microsoft Entra Conditional Access evaluates attributes like whether a device is marked as compliant by Microsoft Intune, is Hybrid Azure AD joined, or Azure AD registered. This condition is crucial for ensuring devices meet organizational security standards before granting access, such as requiring encryption or up-to-date antivirus. However, it does not provide any mechanism to restrict access based on the device's physical or network geographic location.
- ✗
Sign-in risk
Why it's wrong here
The Sign-in risk condition leverages Microsoft Entra Identity Protection's machine learning capabilities to detect suspicious sign-in attempts, such as impossible travel from atypical locations, sign-ins from infected devices, or unfamiliar sign-in properties. While it uses location as one signal to infer the *likelihood* of a compromised identity, it does not allow an administrator to explicitly define and enforce access policies based on specific geographic regions or named IP ranges, focusing instead on the real-time risk assessment of the sign-in itself.
- ✓
Locations
Why this is correct
The Locations condition in Microsoft Entra Conditional Access is specifically designed to control access based on the network location from which a user is attempting to sign in. Administrators can define 'named locations' using specific public IPv4 ranges, representing trusted corporate networks, or by selecting entire countries/regions, allowing for granular policies to grant access only from approved geographies or block access from high-risk areas. This directly addresses the need to restrict access based on a user's physical or network geographic location.
- ✗
Client apps
Why it's wrong here
The Client apps condition enables administrators to control access based on the type of application a user is employing to connect, distinguishing between modern authentication clients, legacy authentication clients, browsers, mobile apps, and desktop apps. This condition is vital for enforcing policies like requiring managed apps, blocking older, less secure authentication protocols, or restricting access to specific client types. However, it does not offer any functionality to determine or restrict access based on the user's geographic origin.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.