SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security administrator needs to ensure that only compliant and trusted devices can access Microsoft 365 resources. They want to evaluate device compliance status and apply access controls based on conditions like device state and user location. Which Microsoft Entra capability should they use?
⚠ Common exam trap
The trap here is mixing up identity governance features like access reviews or PIM with the policy enforcement engine that is Conditional Access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the Microsoft Entra feature that enforces access policies based on conditions like device compliance and user location. It integrates with Intune to identify compliant devices and can block or grant access accordingly. PIM, Identity Protection, and access reviews serve different identity governance and risk detection purposes, so they do not provide the dynamic access control described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access reviews
Why it's wrong here
Access reviews are used to periodically certify that users still need access to groups or applications. They do not evaluate device compliance or location in real time to grant or block access. Access reviews are part of identity governance, not dynamic access control, so they cannot enforce the required conditions for Microsoft 365 resource access.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management provides just-in-time role activation and approval workflows for privileged accounts. It does not evaluate device compliance or location to control access to resources. PIM is focused on managing administrative roles, not on enforcing conditional access policies for end-user resource access, so it does not fulfill the scenario.
- ✗
Identity Protection
Why it's wrong here
Identity Protection detects and remediates identity-based risks such as leaked credentials or anomalous sign-ins. While it can feed risk signals into Conditional Access, it does not itself enforce access controls based on device compliance. Its primary function is risk detection and reporting, not policy enforcement for resource access, so it is not the correct choice.
- ✓
Conditional Access
Why this is correct
Conditional Access in Microsoft Entra ID evaluates signals such as device compliance, user location, and application sensitivity to enforce access policies. It can require compliant devices or trusted locations before granting access to Microsoft 365 resources. This directly meets the requirement to apply access controls based on device state and location.
Go deeper
Related to this question
Learn chapter
Compliance Frameworks: ISO 27001, NIST, SOC 2
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.