Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "displayName": "Block high-risk sign-ins",
    "conditions": {
      "userRiskLevels": ["high"],
      "signInRiskLevels": []
    },
    "grantControls": {
      "builtInControls": ["block"]
    }
  }
}
```

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?

⚠ Common exam trap

Watch out — candidates often confuse user risk with sign-in risk; candidates often pick 'block sign-ins when sign-in risk is high' because they overlook the `userRiskLevels` field in the JSON and assume the policy targets sign-in risk instead.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Block access when user risk is high

The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Block access when user risk is medium or high
Why it's wrong here
This statement is incorrect because the Conditional Access policy explicitly targets only a 'High' user risk level. It does not include 'Medium' user risk as a condition for enforcement. Therefore, users with a medium risk level would not be subject to this specific policy's 'Block access' control, making the assertion that it blocks for medium or high risk inaccurate.
✗
Block sign-ins when sign-in risk is high
Why it's wrong here
This option is incorrect because the exhibit shows that the 'Sign-in risk' condition within the Conditional Access policy is not configured with any selected risk levels. This indicates the policy is not set up to evaluate or act upon sign-in risk at all. Consequently, it cannot block sign-ins based on a high sign-in risk level if that specific condition is not defined within the policy.
✗
Require MFA when user risk is high
Why it's wrong here
This statement is incorrect because the 'Grant' control configured for this Conditional Access policy is set to 'Block access,' not 'Require multi-factor authentication.' When the policy's conditions are met, such as a high user risk, the user's access attempt is denied outright. The policy does not prompt the user for MFA; instead, it prevents the sign-in entirely.
✓
Block access when user risk is high
Why this is correct
This statement is correct because the Conditional Access policy is configured with 'User risk level' set to 'High' as a specific condition. Furthermore, the 'Grant' control for this policy is explicitly set to 'Block access.' This combination precisely dictates that if a user's risk level is assessed as high by Azure AD Identity Protection, their attempt to access resources will be blocked.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question