Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "name": "Block legacy authentication",
  "conditions": {
    "clientAppTypes": ["exchangeActiveSync", "otherClients"]
  },
  "grantControls": {
    "builtInControls": ["block"]
  }
}
```

Refer to the exhibit. A Conditional Access policy is defined as shown. Which client applications will be blocked?

⚠ Common exam trap

It's easy for candidates to confuse 'Exchange ActiveSync clients' (which can use modern authentication) with legacy protocols like IMAP/POP/SMTP, or assume that all browser-based apps are blocked, when the policy specifically targets legacy authentication clients only.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Legacy authentication clients such as IMAP, POP, and SMTP.

The policy targets 'Legacy authentication clients' such as IMAP, POP, and SMTP, which do not support modern authentication protocols like OAuth 2.0. These protocols rely on basic authentication and are blocked by Conditional Access policies configured to require modern authentication. Option C is correct because the policy explicitly blocks these legacy protocols.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Browser-based applications accessing Office 365.
Why it's wrong here
This Conditional Access policy does not target browser-based applications. In the "Client apps" condition of a Conditional Access policy, if the "Browser" option is not selected, then web applications accessed via a browser are explicitly excluded from the policy's enforcement. Therefore, users accessing Office 365 services through a web browser would not be affected by this specific policy.
✗
Exchange ActiveSync clients only.
Why it's wrong here
While Exchange ActiveSync clients are indeed targeted by this policy, the scope is not limited solely to them. The policy also includes "Other clients" in its "Client apps" condition. This broader selection means that various non-browser applications and protocols, beyond just ActiveSync, are subject to the policy's controls, making the "only" qualifier incorrect.
✓
Legacy authentication clients such as IMAP, POP, and SMTP.
Why this is correct
This Conditional Access policy specifically targets legacy authentication clients by including both "Exchange ActiveSync clients" and "Other clients" in its scope. Protocols like IMAP, POP, and SMTP inherently utilize legacy authentication methods, which are encompassed within the "Other clients" category. By targeting these client types, the policy effectively applies its controls to connections made using these older, less secure authentication flows.
✗
Applications using modern authentication (e.g., Outlook for Windows with OAuth).
Why it's wrong here
Applications leveraging modern authentication, such as Outlook for Windows utilizing OAuth, are generally categorized under "Mobile apps and desktop clients" in Conditional Access policies. Since this policy does not explicitly target "Mobile apps and desktop clients," and instead focuses on "Other clients" and "Exchange ActiveSync," it would not apply to applications using modern authentication. The policy's intent is to manage or block legacy authentication, not modern authentication.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question