SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?
⚠ Common exam trap
SC-900 often tests the difference between permission-based access (sensitivity labels) and policy-based access (conditional access). Candidates might focus on the label permission and overlook the conditional access policy, but the location block is the most likely cause given the user's group membership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A conditional access policy is blocking access based on the user's location
The user is a member of the Finance group, which has the necessary sensitivity label permission, so lack of permission is not the issue. The most likely reason is that a conditional access policy is blocking access based on the user's location, as the user is in a blocked country. Conditional access policies in Microsoft Entra ID can restrict access based on location, and this would override other permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have the required sensitivity label permission
Why it's wrong here
The user is a member of the Finance group, which has been explicitly granted viewer or editor permissions by the 'Highly Confidential' sensitivity label. Therefore, the user *does* possess the necessary label-based access rights, indicating that the problem lies elsewhere, not with the label's permission assignment itself.
- ✗
The user does not have a Microsoft 365 E5 license
Why it's wrong here
While a Microsoft 365 E5 license provides advanced security and compliance features, basic document access, even to sensitive content, is often governed by specific permissions and policies, not solely by the highest-tier license. The scenario does not provide any information suggesting a licensing prerequisite is the direct cause of this access denial.
- ✓
A conditional access policy is blocking access based on the user's location
Why this is correct
Conditional Access policies evaluate various signals, including user location, device compliance, and sign-in risk, to determine if access should be granted or blocked. A policy configured to restrict access to sensitive documents from untrusted or unapproved geographic locations would explicitly override any inherent sensitivity label permissions, directly causing the user's inability to access the document.
- ✗
The document does not have a sensitivity label applied
Why it's wrong here
The document is confirmed to have the 'Highly Confidential' sensitivity label applied, which means it is protected according to the label's configuration, including encryption and access controls. The issue is not the absence of protection or classification, but rather an external factor preventing access despite the document being correctly labeled and protected.
Go deeper
Related to this question
Learn chapter
Named Locations in Conditional Access
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.