SC-900 Describe the capabilities of Microsoft Entra Practice Question
A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?
⚠ Common exam trap
The trap here is that candidates might confuse the 'What If' tool (which simulates what *would* happen) with the Sign-in logs (which show what *did* happen). For diagnosing an *actual* reported access issue, the Sign-in logs provide the definitive record of the specific Conditional Access policy application and outcome.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign-in logs
Sign-in logs provide detailed information about every sign-in attempt, including whether Conditional Access policies were applied, which policies were triggered, and the outcome (success or failure). When a user reports they cannot access an app and a Conditional Access policy is suspected, reviewing the sign-in logs for that user's attempts will directly show if a policy blocked access and why, making it the primary diagnostic tool for an existing issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sign-in logs
Why this is correct
Sign-in logs provide historical data about past authentication attempts, detailing success or failure, and any Conditional Access policies that were applied at that specific time. However, they do not offer a predictive capability to simulate a new sign-in scenario with hypothetical conditions, which is crucial for proactively diagnosing why a user *might* be blocked before they even attempt access under new circumstances.
- ✗
My Apps portal
Why it's wrong here
The My Apps portal is an end-user interface designed for users to discover, launch, and manage their access to cloud applications, including self-service password reset and group management. It serves purely as an application access point and lacks any administrative or diagnostic functionalities required to troubleshoot Conditional Access policy enforcement or simulate sign-in outcomes.
- ✗
Conditional Access 'What If' tool
Why it's wrong here
The Conditional Access 'What If' tool is specifically designed to simulate a sign-in attempt by a particular user to a specified cloud application under various conditions, such as device state, location, and client application. This simulation accurately predicts which Conditional Access policies would apply and the resulting access decision (grant or block), making it invaluable for proactively troubleshooting and validating policy configurations.
- ✗
Audit logs
Why it's wrong here
Audit logs record administrative activities and changes made within Microsoft Entra ID, including modifications to Conditional Access policies, user accounts, or application registrations. While they show *who* changed *what* and *when*, they do not provide insight into the real-time evaluation of these policies during a user's sign-in attempt or simulate the outcome of a potential access scenario.
Go deeper
Related to this question
Learn chapter
Shadow IT Discovery in Defender for Cloud Apps
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.