Describe the concepts of security, compliance, and identity →hardMultiple Choice

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "Block high-risk sign-ins",
    "state": "enabled",
    "conditions": {
      "userRiskLevels": [],
      "signInRiskLevels": ["high"]
    },
    "grantControls": {
      "builtInControls": ["block"]
    }
  }
}
```

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

⚠ Common exam trap

A common mix-up: candidates confuse 'sign-in risk' with 'user risk'—candidates often pick Option A because they misread the condition, but the exhibit explicitly shows 'Sign-in risk' as the condition, not 'User risk'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Blocks sign-ins that have a high sign-in risk level

The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Blocks sign-ins for users with high user risk
Why it's wrong here
This statement is incorrect because the conditional access policy explicitly targets "sign-in risk levels" and not "user risk levels." User risk, which assesses the likelihood of a user account being compromised over time, is a distinct condition evaluated by Microsoft Entra ID Protection. For this policy to block based on user risk, the UserRiskLevels condition would need to be configured with "High" selected, which is not the case in this scenario.
✓
Blocks sign-ins that have a high sign-in risk level
Why this is correct
This statement accurately describes the policy's intended behavior. The conditional access policy is configured to evaluate the "sign-in risk level" condition, specifically targeting "High" risk as detected by Microsoft Entra ID Protection. When a sign-in attempt is classified as having a high sign-in risk, the policy's grant control, which is set to "Block access," will prevent the user from completing the authentication process.
✗
Blocks all sign-ins for the assigned users
Why it's wrong here
This statement is incorrect because the policy does not impose an unconditional block on all sign-ins for assigned users. Instead, it is a conditional access policy that only triggers its "Block access" grant control when a specific condition, namely a "High" sign-in risk level, is met. Legitimate sign-ins from assigned users that do not exhibit high risk will proceed without being blocked by this particular policy.
✗
Requires multi-factor authentication for high-risk sign-ins
Why it's wrong here
This statement is incorrect because the conditional access policy's "Grant" controls are configured to "Block access," not to "Require multi-factor authentication." While requiring MFA is a common and effective response to high-risk sign-ins to verify identity, this specific policy is designed to prevent access entirely rather than allowing it after an additional authentication challenge.

Go deeper

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question