SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a passcode can access corporate email. What should you configure?
⚠ Common exam trap
Many candidates confuse device compliance policies (which enforce security requirements and can block access) with device configuration policies (which only apply settings without enforcement), leading candidates to select Option A incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device compliance policy
A device compliance policy in Microsoft Intune evaluates device settings, such as requiring a passcode, and marks devices as noncompliant if they lack one. Conditional Access policies can then block noncompliant devices from accessing corporate email, ensuring only compliant devices with a passcode are allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device configuration policy
Why it's wrong here
Device configuration policies are used to deploy specific settings and features to devices, such as Wi-Fi profiles, VPN connections, or even the *setting* to require a passcode. However, they primarily define the desired state and push those settings. While they can configure the device to *require* a passcode, they do not inherently *evaluate* whether the device actually *meets* that requirement or mark the device as non-compliant in a way that triggers conditional access based on its current security posture.
- ✗
Enrollment restrictions
Why it's wrong here
Enrollment restrictions are a gatekeeping mechanism that dictates which types of devices are permitted to enroll into Microsoft Intune management. These policies evaluate device attributes like operating system version, manufacturer, or device ownership type (personal vs. corporate) *during the enrollment process*. They are not designed to enforce ongoing security requirements, such as a device passcode, or to assess a device's compliance status *after* it has been successfully enrolled and is actively managed.
- ✓
Device compliance policy
Why this is correct
Device compliance policies are specifically designed to define the security and health standards that managed devices must meet to be considered "compliant" with organizational policies. These policies actively monitor and evaluate device attributes, such as the presence of a passcode, encryption status, or minimum OS version. If a device fails to meet any defined requirement, the compliance policy marks it as "non-compliant," which can then be leveraged by Conditional Access policies to block access to corporate resources.
- ✗
App protection policy
Why it's wrong here
App protection policies (MAM policies) focus on securing organizational data within specific applications, irrespective of whether the device itself is managed by Intune. While these policies can enforce app-level PINs or restrict actions like copy/paste or "save as" to personal storage, they operate at the application layer. They do not manage or enforce device-wide security settings, such as the requirement for a device passcode, nor do they assess the overall security posture of the underlying device.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.