SC-900 Describe the capabilities of Microsoft Entra Practice Question
Exhibit
Refer to the exhibit. Sign-in logs from Microsoft Entra ID: User: jsmith@contoso.com, App: Office 365 Exchange Online, Status: Failure, Error: 53003 - Device is not compliant. Risk level: Medium.
Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?
⚠ Common exam trap
Many exam-takers confuse device compliance with authentication factors like MFA or password resets, but the sign-in log explicitly states the failure is due to device non-compliance, so the solution must enforce device health, not just user identity verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy requiring compliant device
The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Conditional Access policy requiring compliant device
Why this is correct
Creating a Conditional Access policy that requires a compliant device directly addresses access issues stemming from device non-compliance. This policy evaluates the device's security posture, as determined by an MDM solution like Microsoft Intune, ensuring it meets predefined organizational security standards (e.g., OS version, encryption, antivirus status). Access to protected resources is then granted only if the device is marked as compliant, thereby enforcing a secure endpoint environment.
- ✗
Reset the user's password
Why it's wrong here
Resetting a user's password primarily resolves authentication problems related to forgotten or compromised credentials, allowing the user to regain access to their account. However, this action has no bearing on the device's security configuration or its adherence to organizational compliance policies. Therefore, a password reset would not rectify an access denial caused by a non-compliant device state.
- ✗
Block all personal devices
Why it's wrong here
Blocking all personal devices is an overly broad and restrictive measure that could severely impact user productivity and the flexibility of modern work environments. While it would prevent non-compliant personal devices from accessing resources, it fails to differentiate between secure and insecure personal devices. A more targeted approach involves allowing personal devices that meet specific compliance standards, rather than imposing a blanket ban that disregards the potential for secure BYOD scenarios.
- ✗
Enable MFA for the user
Why it's wrong here
Enabling Multi-Factor Authentication (MFA) significantly strengthens the security of a user's identity by requiring multiple verification factors during login, making it harder for unauthorized users to gain access. However, MFA focuses solely on verifying the user's identity, not on assessing the security posture or compliance status of the device being used. A device's compliance is determined by its adherence to organizational security policies, independent of the user's authentication method.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.