Describe the concepts of security, compliance, and identity →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

{
  "ConditionalAccessPolicy": {
    "Name": "Require MFA for External Users",
    "Conditions": {
      "UsersAndGroups": {
        "IncludeExternalUsers": true
      },
      "Applications": {
        "IncludeAll": true
      }
    },
    "Controls": {
      "Grant": {
        "RequireMfa": true
      }
    }
  }
}

You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Requires MFA for all external users accessing any cloud app

The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Requires MFA for all external users accessing any cloud app
Why this is correct
The policy targets all external users and all cloud apps with MFA requirement.
✗
Requires MFA for guest users only
Why it's wrong here
It includes all external users, not just guests.
✗
Requires MFA for all users accessing all cloud apps
Why it's wrong here
The policy only includes external users.
✗
Requires MFA for external users except those with global admin role
Why it's wrong here
No exclusion based on role.

Go deeper

1 more way this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?

easy

A.All users who are members of any Azure AD administrative role
B.All users who are members of the Global Administrator role only
✓ C.All users who are members of the Global Administrator or Exchange Administrator role
D.All users in the organization

Why C: The conditional access policy specifies 'includeRoles' with the Global Administrator and Exchange Administrator roles, meaning only users assigned to either of those roles are affected. Option A is incorrect because the policy does not apply to all administrative roles, only the two specified. Option B is incorrect because it applies to both Global Administrator and Exchange Administrator, not just Global Administrator. Option D is incorrect because the policy does not apply to all users in the organization.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SC-900