SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A device compliance policy
Device compliance policies in Intune define the rules that devices must meet to be considered compliant, such as requiring a passcode of at least 6 characters and device encryption. Option A is incorrect because Conditional Access policies use compliance status to enforce access controls, but do not define the compliance rules themselves. Option B is incorrect because device configuration profiles push settings to devices but do not enforce compliance; they are used for configuring device settings. Option C is incorrect because app protection policies manage how apps access and handle data, not device-level requirements like passcode and encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Conditional Access policy
Why it's wrong here
A Conditional Access policy determines access to organizational resources based on various conditions, including whether a device is marked as compliant. While it can enforce that a device must be compliant to gain access, it does not define the specific settings or criteria that make a device compliant. Its role is to evaluate the compliance status provided by other policies, not to establish the compliance rules themselves.
- ✗
A device configuration profile
Why it's wrong here
A device configuration profile is used to deploy specific settings and features to devices, such as Wi-Fi profiles, VPN connections, or security settings like password complexity. While these profiles configure desired states, they do not inherently evaluate whether a device meets those settings or report its compliance status back to Intune. They apply settings, but lack the built-in mechanism to flag a device as non-compliant if a setting deviates.
- ✗
An app protection policy
Why it's wrong here
An app protection policy, also known as a Mobile Application Management (MAM) policy, focuses on protecting organizational data within specific applications, regardless of whether the device itself is managed by Intune. These policies control actions like copy/paste, save-as, or access to corporate data from unapproved apps. They do not define or enforce any requirements for the device's operating system or hardware configuration to be considered secure or compliant.
- ✓
A device compliance policy
Why this is correct
A device compliance policy explicitly defines the security baselines and health requirements that a device must meet to be considered compliant with organizational standards. These policies specify settings like minimum OS versions, encryption status, password requirements, or the presence of antivirus software. Intune continuously evaluates devices against these defined rules, marking them as compliant or non-compliant, and can then report this status for Conditional Access enforcement.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Bring Your Own Device
A policy allowing employees to use their personal laptops, smartphones, or tablets for work tasks instead of using company-issued equipment.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.