Describe the capabilities of Microsoft Entra →easyMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit. {
  "displayName": "Block Legacy Auth",
  "state": "enabled",
  "conditions": {
    "clientAppTypes": ["exchangeActiveSync", "otherClients"],
    "applications": {
      "includeApplications": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["block"],
    "operator": "OR"
  }
}

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

⚠ Common exam trap

Many exam-takers confuse 'blocking legacy authentication' with 'requiring MFA' — the policy blocks the protocol entirely rather than prompting for an additional factor, which is a distinct control in Conditional Access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Block legacy authentication protocols

The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Block legacy authentication protocols
Why this is correct
The policy's "Client apps" condition is configured to target "Other clients," which is the category encompassing applications that utilize legacy authentication protocols such as POP, IMAP, SMTP, and older versions of Office clients that do not support modern authentication. By combining this specific client app condition with a "Block access" grant control, the policy effectively prevents users from authenticating via these less secure, legacy protocols. This significantly enhances security by forcing the use of modern authentication methods.
✗
Require MFA for all applications
Why it's wrong here
The policy's "Grant" control is explicitly set to "Block access," which means that under the specified conditions, users are entirely denied access to the targeted cloud applications. To require multi-factor authentication (MFA), the grant control would instead need to be configured as "Grant access" and then specifically select "Require multi-factor authentication" as a control. Therefore, this policy does not enforce MFA; it enforces a complete denial of access.
✗
Disable the policy for emergency access
Why it's wrong here
The statement implies the policy's overall state is disabled for specific scenarios, which is inaccurate. Conditional Access policies are either "Enabled," "Report-only," or "Off." If the policy were intended to be disabled for emergency access, it would typically involve configuring an exclusion for a specific group of emergency access accounts within the policy's "Users and groups" condition. The policy itself remains enabled and active for all other users and conditions within its scope.
✗
Allow only iOS devices
Why it's wrong here
The provided Conditional Access policy JSON does not include any conditions that would restrict access exclusively to iOS devices. To achieve this, the policy would need to specify "Device platforms" as a condition, selecting "iOS" as the target platform, or utilize a "Filter for devices" condition to specifically include only iOS devices. Without such explicit device-related conditions, the policy's scope is not limited to iOS devices, making this statement incorrect.

Visual reference

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question