Question 939 of 1,250
SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Exhibit
Refer to the exhibit.
```json
{
"properties": {
"displayName": "Block high-risk sign-ins",
"state": "enabled",
"conditions": {
"userRiskLevels": [],
"signInRiskLevels": ["high"]
},
"grantControls": {
"builtInControls": ["block"]
}
}
}
```You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?
⚠ Common exam trap
A common mix-up: candidates confuse 'sign-in risk' with 'user risk'—candidates often pick Option A because they misread the condition, but the exhibit explicitly shows 'Sign-in risk' as the condition, not 'User risk'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Blocks sign-ins that have a high sign-in risk level
The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blocks sign-ins for users with high user risk
Why it's wrong here
This statement is incorrect because the conditional access policy explicitly targets "sign-in risk levels" and not "user risk levels." User risk, which assesses the likelihood of a user account being compromised over time, is a distinct condition evaluated by Azure AD Identity Protection. For this policy to block based on user risk, the UserRiskLevels condition would need to be configured with "High" selected, which is not the case in this scenario.
- ✓
Blocks sign-ins that have a high sign-in risk level
Why this is correct
This statement accurately describes the policy's intended behavior. The conditional access policy is configured to evaluate the "sign-in risk level" condition, specifically targeting "High" risk as detected by Azure AD Identity Protection. When a sign-in attempt is classified as having a high sign-in risk, the policy's grant control, which is set to "Block access," will prevent the user from completing the authentication process.
- ✗
Blocks all sign-ins for the assigned users
Why it's wrong here
This statement is incorrect because the policy does not impose an unconditional block on all sign-ins for assigned users. Instead, it is a conditional access policy that only triggers its "Block access" grant control when a specific condition, namely a "High" sign-in risk level, is met. Legitimate sign-ins from assigned users that do not exhibit high risk will proceed without being blocked by this particular policy.
- ✗
Requires multi-factor authentication for high-risk sign-ins
Why it's wrong here
This statement is incorrect because the conditional access policy's "Grant" controls are configured to "Block access," not to "Require multi-factor authentication." While requiring MFA is a common and effective response to high-risk sign-ins to verify identity, this specific policy is designed to prevent access entirely rather than allowing it after an additional authentication challenge.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.