SC-900 Describe the capabilities of Microsoft Entra Practice Question
An organization uses Microsoft Entra ID and wants to require users to re-authenticate every 4 hours when accessing a critical financial application, even if the user already has an active sign-in session. Which Conditional Access control should be configured?
⚠ Common exam trap
Many exam-takers confuse session controls (which manage token lifetime and re-authentication behavior) with grant controls (which enforce conditions at initial sign-in), leading candidates to select 'Require multi-factor authentication' thinking it will force periodic re-authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session control 'Sign-in frequency'
The 'Sign-in frequency' session control in Conditional Access allows administrators to specify the time interval after which a user must re-authenticate, even if they have an active session. By setting this to 4 hours, the organization ensures that users re-authenticate before accessing the critical financial application, overriding any existing session tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant control 'Require multi-factor authentication'
Why it's wrong here
Requiring multi-factor authentication (MFA) ensures a stronger initial verification of user identity by demanding two or more authentication factors. However, once the user successfully completes the MFA challenge, a session token is issued, and the duration of that session is governed by other policies, such as token lifetime or sign-in frequency. MFA itself does not dictate a recurring re-authentication interval within an active session, meaning a user could remain signed in for an extended period after a single MFA challenge.
- ✓
Session control 'Sign-in frequency'
Why this is correct
The 'Sign-in frequency' session control directly addresses the requirement to force re-authentication after a specific time interval. This control mandates that users must re-enter their credentials, potentially including MFA, after a defined period (e.g., 4 hours), even if their session is still active and valid. It ensures periodic re-verification of identity throughout the user's workday, enhancing security by limiting the window of compromise for a stolen session token.
- ✗
Session control 'Persistent browser session'
Why it's wrong here
The 'Persistent browser session' control determines whether a user remains signed in to Microsoft Entra ID after closing and reopening their web browser. This setting primarily affects the continuity of the session across browser instances, allowing users to avoid re-entering credentials when they resume browsing. It does not, however, enforce a specific re-authentication interval *during* an active, continuous session within a single browser instance, which is the core requirement.
- ✗
Grant control 'Require device to be marked as compliant'
Why it's wrong here
The 'Require device to be marked as compliant' grant control ensures that the device attempting to access resources meets the organization's security and compliance standards, as defined by Microsoft Intune. This check verifies device health and configuration at the point of access and can monitor compliance during the session. While critical for endpoint security, this control does not dictate how often the *user* must re-authenticate their identity; the session can persist as long as the device maintains its compliant status.
Go deeper
Related to this question
Learn chapter
Microsoft Entra Global Secure Access
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.