Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

{
  "signInLogs": [
    {
      "userId": "jdoe@contoso.com",
      "appDisplayName": "Azure Portal",
      "signInEventType": "interactiveUser",
      "conditionalAccessStatus": "success",
      "mfaRequired": true,
      "riskLevelDuringSignIn": "medium",
      "riskLevelAggregated": "high"
    },
    {
      "userId": "asmith@contoso.com",
      "appDisplayName": "Office 365 Exchange Online",
      "signInEventType": "nonInteractiveUser",
      "conditionalAccessStatus": "failure",
      "mfaRequired": false,
      "riskLevelDuringSignIn": "low",
      "riskLevelAggregated": "low"
    }
  ]
}

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs. Which statement is true?

⚠ Common exam trap

Watch out — candidates often assume all sign-in logs represent user sign-ins and overlook the 'Sign-in type' column, leading them to misinterpret the risk level or Conditional Access status for a service principal entry.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

asmith's sign-in was likely from an application or service principal.

The sign-in log entry for asmith shows an 'Application' sign-in type, which indicates the authentication was performed by an application or service principal rather than a user. In Microsoft Entra ID, sign-ins from applications or service principals are logged with a distinct sign-in type, and the exhibit displays 'Application' for asmith's entry, confirming this.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
jdoe's sign-in had no risk detected.
Why it's wrong here
jdoe's sign-in did not have 'no risk detected'; instead, the 'riskLevelAggregated' field clearly indicates a 'high' risk. This high risk level suggests that Microsoft Entra ID Protection identified significant suspicious activity associated with this particular sign-in attempt, potentially triggering security policies or investigations.
✗
jdoe's sign-in failed Conditional Access.
Why it's wrong here
jdoe's sign-in did not fail Conditional Access; the 'conditionalAccessStatus' field explicitly shows 'success'. This status confirms that all applicable Conditional Access policies were evaluated and successfully passed, meaning the user either met the required conditions or no blocking policies were triggered for this specific access attempt.
✓
asmith's sign-in was likely from an application or service principal.
Why this is correct
asmith's sign-in was indeed likely from an application or service principal, as indicated by the 'NonInteractiveUser' sign-in type. This specific type signifies that the authentication request originated from a client application, script, or service principal, rather than a direct interactive session initiated by a human user, facilitating automated access to resources.
✗
asmith's sign-in had a high risk level.
Why it's wrong here
asmith's sign-in did not have a high risk level; both the 'riskLevelUser' and 'riskLevelAggregated' fields for this sign-in are explicitly marked as 'low'. A low risk level indicates that Microsoft Entra ID Protection did not detect any significant anomalous or suspicious behavior associated with this particular authentication event.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question