SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.

  Why it's wrong here

  Enabling Microsoft Entra ID Identity Protection and configuring a sign-in risk policy primarily focuses on detecting and remediating identity-based risks, such as compromised credentials or unusual sign-in patterns. While essential for overall security, this feature does not provide the granular session control or real-time monitoring capabilities specifically required to manage user interactions with cloud applications from unmanaged devices. It addresses *who* is signing in and *how risky* that sign-in is, rather than controlling *what actions* they can perform on a specific device type.

• ✗

  Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.

  Why it's wrong here

  Creating a Conditional Access policy that requires device compliance and blocks access for non-compliant devices is a valid security measure, but it enforces an all-or-nothing approach. This policy would completely deny access to cloud applications from any device deemed non-compliant, which might hinder productivity if the goal is to allow access from unmanaged devices under strict monitoring and control. The intent of using Microsoft Defender for Cloud Apps in this context is typically to permit access while applying specific restrictions, not to block it outright.

• ✗

  Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.

  Why it's wrong here

  Creating a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices is overly broad and does not align with the common requirement to differentiate between trusted and untrusted environments. Applying such a restrictive policy universally would unnecessarily impede users on managed, compliant devices, where downloads might be permitted. Effective security often requires targeting specific conditions, such as unmanaged devices, to apply more stringent controls without impacting the productivity of trusted users and devices.

• ✓

  Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.

  Why this is correct

  Creating a Conditional Access policy that uses the 'Require session control' grant and targets 'All cloud apps' and 'Unmanaged devices' as conditions is the correct approach. This configuration seamlessly integrates Microsoft Entra Conditional Access with Microsoft Defender for Cloud Apps (MDCA), routing sessions from unmanaged devices through MDCA's reverse proxy. This allows MDCA to apply granular, real-time session controls, such as blocking downloads, restricting copy-paste, or enforcing read-only access, specifically for those less trusted sessions while still permitting access to the cloud applications.

Go deeper

Related to this question