SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization uses Microsoft Entra ID for identity management. They want to implement a risk-based conditional access policy that requires multi-factor authentication (MFA) when sign-in risk is medium or high. Which policy settings should they configure?
⚠ Common exam trap
Candidates often confuse 'User risk' (which targets compromised user accounts) with 'Sign-in risk' (which targets suspicious authentication attempts), leading candidates to incorrectly select Option A when the question specifically asks about sign-in risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign 'Sign-in risk' condition to 'Medium and above' and grant 'Require MFA'
The scenario explicitly requires a risk-based conditional access policy that triggers MFA based on sign-in risk level. In Microsoft Entra ID, the 'Sign-in risk' condition evaluates the likelihood that the authentication attempt is not legitimate, using signals such as anonymous IP addresses, atypical travel, or malware-linked IPs. By setting this condition to 'Medium and above' and granting 'Require MFA', the policy enforces MFA only when the sign-in risk is assessed as medium or high, directly matching the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign 'User risk' condition to 'Medium and above' and grant 'Require MFA'
Why it's wrong here
The 'User risk' condition in Microsoft Entra Conditional Access assesses the cumulative likelihood that a user account itself has been compromised, based on historical and ongoing suspicious activities associated with that identity. This includes factors like leaked credentials or activity from infected devices over time. While critical for overall security, it does not evaluate the real-time risk of a specific sign-in attempt or its immediate contextual anomalies, making it less suitable for directly addressing suspicious sign-in patterns.
- ✗
Assign 'Device compliance' condition to 'Compliant' and grant 'Require MFA'
Why it's wrong here
The 'Device compliance' condition evaluates whether the device attempting to access resources meets the organization's security standards, as defined in Microsoft Intune or other MDM solutions. This includes checks for OS version, encryption status, and presence of security software. While essential for ensuring endpoints are secure, device compliance does not analyze the behavioral characteristics or contextual anomalies of a sign-in session itself, such as impossible travel or atypical IP addresses, which are indicators of sign-in risk.
- ✗
Assign 'Location' condition to 'All trusted locations' and grant 'Require MFA'
Why it's wrong here
The 'Location' condition allows administrators to define network locations as trusted or untrusted, based on IP ranges or country codes. While useful for restricting access based on geographic or network origin, it is a static, pre-defined control that does not dynamically assess the risk level of a sign-in attempt based on behavioral analytics or machine learning. Applying MFA to 'All trusted locations' would not specifically target suspicious sign-in patterns, but rather enforce MFA broadly for all defined trusted access points.
- ✓
Assign 'Sign-in risk' condition to 'Medium and above' and grant 'Require MFA'
Why this is correct
The 'Sign-in risk' condition, powered by Microsoft Entra ID Protection, specifically evaluates the real-time risk associated with an individual sign-in attempt. It utilizes machine learning to detect anomalies such as impossible travel, sign-ins from unfamiliar locations or devices, or atypical sign-in properties. Setting this condition to 'Medium and above' and granting 'Require MFA' directly addresses suspicious sign-in patterns by challenging potentially compromised sessions with an additional verification factor, thereby preventing unauthorized access.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.