SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Exhibit
Conditional Access policy: - Users: All users - Cloud apps: Office 365 Exchange Online - Conditions: Locations: All trusted locations - Grant: Require multi-factor authentication - Session: Use app enforced restrictions
Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?
⚠ Common exam trap
Watch out — candidates often assume 'Include: All users' means the policy applies to everyone, overlooking that 'Exclude: All users' negates the inclusion, making the policy effectively inactive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is granted access without MFA because the policy does not apply.
The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user is granted access without MFA because the policy does not apply.
Why this is correct
The Conditional Access policy is specifically configured to apply *only* when a user is accessing from a "trusted location." Since the user is accessing from an *untrusted* location, the conditions of this particular policy are not met. Consequently, the policy is not enforced, and its grant controls, including the MFA requirement, are not triggered. The user is thus granted access based on default security settings or other applicable policies, without being prompted for MFA by *this* specific policy.
- ✗
Access is blocked because the condition is not met.
Why it's wrong here
While it is true that the condition (trusted locations) is not met for a user accessing from an untrusted location, this does not automatically result in access being blocked. Conditional Access policies are designed to *enforce* specific controls (like MFA or blocking) *when* their conditions are met. If the conditions are not met, the policy simply does not apply, and access is evaluated by other policies or default settings, rather than being explicitly blocked by this non-applicable policy.
- ✗
The user is prompted for MFA because the policy applies to all users.
Why it's wrong here
This statement is incorrect because Conditional Access policies are evaluated based on *all* configured conditions, not just the "Users" scope. Even if the policy were configured to apply to "All users," its "Locations" condition explicitly limits its application to "trusted locations." Therefore, a user accessing from an *untrusted* location would not fall within the policy's scope, and the MFA requirement would not be prompted by this specific policy.
- ✗
The user is blocked because the grant requires MFA.
Why it's wrong here
The grant control requiring MFA is only enforced *after* all conditions of the Conditional Access policy have been successfully met. In this scenario, the user is accessing from an untrusted location, which means the policy's "trusted locations" condition is *not* satisfied. Since the conditions are not met, the policy does not apply, and its grant controls, including the MFA requirement, are never triggered, thus access is not blocked due to an unmet MFA grant from *this* policy.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.