SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. What should they configure?
⚠ Common exam trap
Candidates often confuse Device enrollment restrictions (which set OS version limits at enrollment time) with Compliance policies (which enforce OS version requirements continuously after enrollment), leading them to pick Option B instead of C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliance policy and conditional access
Combining a compliance policy (which checks the device OS version against a minimum requirement) with a Conditional Access policy (which blocks access if the device is non-compliant) is the standard Microsoft approach to enforce OS version requirements for accessing corporate email. The compliance policy marks devices below the minimum OS version as non-compliant, and the Conditional Access policy then denies access to Exchange Online or other corporate resources for those non-compliant devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
App protection policy
Why it's wrong here
App protection policies, also known as Mobile Application Management (MAM) policies, focus on securing organizational data within specific applications. They define data protection settings like restricting copy/paste or 'save as' functionality, independent of the device's enrollment status. However, these policies do not assess the overall compliance posture of the device itself or gate access to resources based on device health, making them unsuitable for enforcing device-level access.
- ✗
Device enrollment restriction
Why it's wrong here
Device enrollment restrictions are designed to control which devices are permitted to enroll into Microsoft Intune based on criteria such as device type, operating system version, or manufacturer. While essential for initial onboarding security, these restrictions do not continuously monitor a device's compliance status after enrollment. Therefore, they cannot dynamically enforce ongoing access to corporate resources if a previously enrolled device later falls out of compliance.
- ✓
Compliance policy and conditional access
Why this is correct
Intune compliance policies define the specific security and health requirements that a device must meet to be considered compliant, such as requiring a minimum OS version, disk encryption, or antivirus software. Conditional Access policies then integrate with Azure AD to evaluate this compliance status in real-time. This powerful combination ensures that only devices meeting the defined compliance standards are granted access to sensitive organizational applications and data, providing robust, continuous enforcement.
- ✗
Device configuration profile
Why it's wrong here
Device configuration profiles are utilized to deploy specific settings, features, and restrictions to managed devices, such as Wi-Fi profiles, VPN configurations, or password complexity requirements. While these profiles can help configure a device to meet certain security standards, they do not inherently enforce access to corporate resources based on whether those configurations are successfully applied or maintained. Their primary role is configuration, not access gating based on compliance.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.