SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID feature should you use to verify that users and devices meet specific health requirements before granting access to corporate resources?
⚠ Common exam trap
SC-900 often tests the confusion between Conditional Access (the enforcement engine) and Identity Protection (the risk detection engine)—candidates pick Identity Protection because it sounds security-focused, but only Conditional Access applies access controls based on device state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the Microsoft Entra ID policy engine that evaluates signals—including user, device compliance state, location, and risk—before granting access to resources. It can require that devices be marked compliant in Intune or hybrid-joined before allowing access, which directly implements the Zero Trust 'verify explicitly' principle. This makes it the correct feature for enforcing device health requirements at access time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
PIM governs just-in-time role activation and approval for privileged directory roles; it evaluates no device health signals, so conditional access grant controls cannot be satisfied. It is the right choice when standing admin access must be eliminated in favour of eligible, time-bound assignments.
- ✗
Identity Governance
Why it's wrong here
Identity Governance handles access reviews, entitlement management and lifecycle workflows for who holds which access; it inspects no device compliance or health state. It would be correct when recertifying group memberships or automating joiner-mover-leaver access packages.
- ✗
Identity Protection
Why it's wrong here
Identity Protection detects and scores risky users and sign-ins, triggering risk-based remediation; it does not verify device health requirements before granting access. It is correct when responding to leaked credentials or anomalous sign-in behaviour with risk policies.
- ✓
Conditional Access
Why this is correct
Conditional Access evaluates signals such as user, device compliance and location, then enforces grant controls before access is allowed. This satisfies the Zero Trust requirement to verify that users and devices meet specific health requirements before granting access to corporate resources.
Go deeper
Related to this question
Learn chapter
Azure Policy Effects: Audit, Deny, Modify
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.