Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "riskLevel": ["high"]
  },
  "grantControls": {
    "builtInControls": ["block"]
  }
}
```

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

⚠ Common exam trap

Test-takers frequently assume any risk level triggers the block action, but Conditional Access policies only enforce controls when the condition exactly matches the configured risk level, not for lower or higher levels unless explicitly specified.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Access is granted

The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Access is blocked
Why it's wrong here
A Conditional Access policy's "Block access" control is only enforced when all conditions within that specific policy are met. Since the overarching policy condition is not met in this scenario, the policy is not applied, and consequently, its configured controls, including any "Block access" directives, are not activated. Therefore, access would not be blocked by this particular policy.
✗
User is redirected to a password reset page
Why it's wrong here
Redirecting a user to a password reset page is a specific session control or grant control requirement within Conditional Access, often linked to user risk policies. For this action to occur, the Conditional Access policy must explicitly include a "Require password change" grant control or a similar session control. Since no such self-remediation or password reset requirement is configured or triggered by the policy, this action will not take place.
✓
Access is granted
Why this is correct
Access is granted because the fundamental conditions defined within the Conditional Access policy's "Assignments" section were not entirely satisfied. When a policy's conditions are not met, the policy is not triggered, and its configured controls—whether to grant, block, or require specific actions—are not enforced. In such cases, access typically defaults to being granted, assuming no other active policies or security defaults intervene to restrict it.
✗
User is prompted for MFA
Why it's wrong here
A prompt for Multi-Factor Authentication (MFA) is a specific "Grant" control that must be explicitly configured within a Conditional Access policy. If the policy does not include "Require multi-factor authentication" as a grant control, or if the policy's conditions are not met to trigger its application, then the user will not be prompted for MFA by this policy.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question