SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security administrator needs to block legacy authentication protocols across all applications in Microsoft Entra ID. Which conditional access policy setting should they configure?
⚠ Common exam trap
Many candidates confuse 'Block access' under 'Grant' (which is a general block) with the specific condition needed to target legacy protocols, or they may think that location or sign-in frequency settings can address protocol-level restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Under 'Conditions', configure 'Client apps' to block legacy authentication
Legacy authentication protocols (such as POP3, IMAP4, SMTP, and older Office clients) do not support modern authentication methods like MFA or conditional access. By configuring the 'Client apps' condition in a Conditional Access policy to block legacy authentication, the administrator can prevent these insecure sign-in attempts across all applications in Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Under 'Grant', select 'Block access'
Why it's wrong here
Selecting 'Block access' under the 'Grant' control within a Conditional Access policy is an all-or-nothing action. This setting would prevent all users targeted by the policy from accessing the specified cloud apps, regardless of their authentication method, modern or legacy. The objective is to block only legacy authentication, making this option overly restrictive and disruptive to legitimate modern access.
- ✗
Under 'Conditions', configure 'Locations' to block all locations
Why it's wrong here
Configuring 'Locations' to block all locations within a Conditional Access policy would restrict user access based on their network origin. This condition is designed to enforce geo-fencing or prevent access from untrusted network segments, not to differentiate between authentication protocols like legacy or modern. Therefore, it would not achieve the specific goal of blocking legacy authentication while permitting modern authentication.
- ✗
Set 'Sign-in frequency' to 1 hour
Why it's wrong here
Setting 'Sign-in frequency' to 1 hour dictates how often users are prompted to reauthenticate to a service. While this enhances security by reducing session lifetimes, it does not differentiate between or block specific authentication protocols. This control primarily manages the duration of a user's authenticated session, rather than preventing the use of legacy authentication methods altogether.
- ✓
Under 'Conditions', configure 'Client apps' to block legacy authentication
Why this is correct
Under 'Conditions', configuring 'Client apps' allows administrators to target specific client applications and authentication protocols. By selecting 'Other clients' (which includes clients using legacy authentication protocols like Exchange ActiveSync, POP, IMAP, and older Office clients), and then applying a 'Block' grant control, the policy effectively prevents sign-ins from these legacy methods. This precisely addresses the requirement to block legacy authentication without impacting modern authentication flows.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.