Courseiva

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Conditional Access policy:
- Users: All users
- Cloud apps: Office 365 Exchange Online
- Conditions: Locations: All trusted locations
- Grant: Require multi-factor authentication
- Session: Use app enforced restrictions

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

⚠ Common exam trap

Watch out — candidates often assume 'Include: All users' means the policy applies to everyone, overlooking that 'Exclude: All users' negates the inclusion, making the policy effectively inactive.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The user is granted access without MFA because the policy does not apply.

The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The user is granted access without MFA because the policy does not apply.

    Why this is correct

    The Conditional Access policy is specifically configured to apply *only* when a user is accessing from a "trusted location." Since the user is accessing from an *untrusted* location, the conditions of this particular policy are not met. Consequently, the policy is not enforced, and its grant controls, including the MFA requirement, are not triggered. The user is thus granted access based on default security settings or other applicable policies, without being prompted for MFA by *this* specific policy.

  • Access is blocked because the condition is not met.

    Why it's wrong here

    While it is true that the condition (trusted locations) is not met for a user accessing from an untrusted location, this does not automatically result in access being blocked. Conditional Access policies are designed to *enforce* specific controls (like MFA or blocking) *when* their conditions are met. If the conditions are not met, the policy simply does not apply, and access is evaluated by other policies or default settings, rather than being explicitly blocked by this non-applicable policy.

  • The user is prompted for MFA because the policy applies to all users.

    Why it's wrong here

    This statement is incorrect because Conditional Access policies are evaluated based on *all* configured conditions, not just the "Users" scope. Even if the policy were configured to apply to "All users," its "Locations" condition explicitly limits its application to "trusted locations." Therefore, a user accessing from an *untrusted* location would not fall within the policy's scope, and the MFA requirement would not be prompted by this specific policy.

  • The user is blocked because the grant requires MFA.

    Why it's wrong here

    The grant control requiring MFA is only enforced *after* all conditions of the Conditional Access policy have been successfully met. In this scenario, the user is accessing from an untrusted location, which means the policy's "trusted locations" condition is *not* satisfied. Since the conditions are not met, the policy does not apply, and its grant controls, including the MFA requirement, are never triggered, thus access is not blocked due to an unmet MFA grant from *this* policy.

About these practice questions

One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.