SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A conditional access policy is blocking access based on the user's location
Although the user is a member of the Finance group and has the required sensitivity label permission, the conditional access policy blocks access based on the user's location (country). Conditional access policies can override label permissions. Option A is incorrect because the user does have the required label permission. Option B is incorrect because no licensing issue is indicated; Microsoft 365 E5 is not required for sensitivity labels. Option D is incorrect because the document does have a sensitivity label applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have the required sensitivity label permission
Why it's wrong here
The user is a member of the Finance group, which has been explicitly granted viewer or editor permissions by the 'Highly Confidential' sensitivity label. Therefore, the user *does* possess the necessary label-based access rights, indicating that the problem lies elsewhere, not with the label's permission assignment itself.
- ✗
The user does not have a Microsoft 365 E5 license
Why it's wrong here
While a Microsoft 365 E5 license provides advanced security and compliance features, basic document access, even to sensitive content, is often governed by specific permissions and policies, not solely by the highest-tier license. The scenario does not provide any information suggesting a licensing prerequisite is the direct cause of this access denial.
- ✓
A conditional access policy is blocking access based on the user's location
Why this is correct
Conditional Access policies evaluate various signals, including user location, device compliance, and sign-in risk, to determine if access should be granted or blocked. A policy configured to restrict access to sensitive documents from untrusted or unapproved geographic locations would explicitly override any inherent sensitivity label permissions, directly causing the user's inability to access the document.
- ✗
The document does not have a sensitivity label applied
Why it's wrong here
The document is confirmed to have the 'Highly Confidential' sensitivity label applied, which means it is protected according to the label's configuration, including encryption and access controls. The issue is not the absence of protection or classification, but rather an external factor preventing access despite the document being correctly labeled and protected.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.