Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.
{
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["Office 365 Exchange Online"]
    },
    "locations": {
      "includeLocations": ["AllTrusted"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa"]
  }
}

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The location condition is configured to include trusted locations

The policy includes MFA for Exchange Online, but the location condition 'includeLocations' with 'AllTrusted' means it applies to trusted locations, not excludes them. To exclude trusted locations, the policy should use 'excludeLocations'. Therefore, the user is prompted for MFA when accessing from a trusted IP because the policy is incorrectly configured to include trusted locations, making option A the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The location condition is configured to include trusted locations
Why this is correct
This statement is correct because a Conditional Access policy configured to "include" trusted locations in its `locations` condition will apply its grant controls, such as requiring multi-factor authentication (MFA), even when users are signing in from designated secure network segments. For most MFA policies, the best practice is to *exclude* trusted locations to provide a frictionless experience for users on corporate networks, making the inclusion of trusted locations an often misconfigured or overly restrictive setting.
✗
The policy targets high sign-in risk
Why it's wrong here
The policy does not target high sign-in risk because the `riskLevels` condition, which is part of the `conditions` block in a Conditional Access policy, is not specified or configured to include "high" sign-in risk. Without an explicit `riskLevels` configuration, the policy will not evaluate or enforce controls based on the sign-in risk detected by Azure AD Identity Protection, meaning it applies irrespective of the user's sign-in risk level.
✗
The policy does not apply to Exchange Online
Why it's wrong here
The statement is incorrect because Conditional Access policies define their scope through the `applications` condition. If the JSON exhibit explicitly lists "Exchange Online" within the `applications` array, it signifies that the policy *is* configured to apply to user access attempts for Exchange Online. Therefore, any user attempting to access Exchange Online while matching other policy conditions would be subject to its controls.
✗
The policy requires device compliance
Why it's wrong here
The statement is incorrect because requiring device compliance is a specific grant control that must be explicitly configured within the `grantControls` section of a Conditional Access policy. If the policy's `grantControls` array does not contain `requireDeviceCompliant`, the policy will not enforce that the accessing device meets compliance standards managed by Intune or other MDM solutions. Therefore, users can access resources from non-compliant devices under this policy.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question