SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which policy should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse the policy that defines compliance (Intune Device Compliance) with the policy that enforces access based on that compliance (Entra ID Conditional Access), leading them to pick Option A instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy in Microsoft Entra ID
Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By configuring a Conditional Access policy that requires device compliance, only devices marked as compliant by Intune can access corporate email. This is the correct mechanism because Conditional Access acts as the gatekeeper that enforces the compliance requirement at the authentication and authorization layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device compliance policy in Microsoft Intune
Why it's wrong here
A device compliance policy in Microsoft Intune defines the security standards a device must meet, such as requiring a PIN or encryption, and reports its compliance status to Intune. While crucial for assessing device health, these policies themselves do not directly block access to organizational resources like email. Instead, they provide the compliance signal that other services utilize for access control decisions.
- ✗
Enrollment restrictions in Microsoft Intune
Why it's wrong here
Enrollment restrictions in Microsoft Intune govern which types of devices are permitted to enroll into management, based on factors like device platform, operating system version, or manufacturer. Their primary function is to control the initial onboarding of devices into the Intune service. These restrictions do not regulate ongoing access to corporate applications or data once a device is already enrolled and managed.
- ✗
App protection policy in Microsoft Intune
Why it's wrong here
An App protection policy in Microsoft Intune (also known as MAM policy) applies data protection controls directly to applications, regardless of whether the device itself is enrolled in Intune. These policies manage how corporate data can be used within an app, for example, preventing copy-pasting to personal apps or requiring a PIN to access the app. They focus on securing data at the application layer, not on enforcing device-level access to services like email.
- ✓
Conditional Access policy in Microsoft Entra ID
Why this is correct
A Conditional Access policy in Microsoft Entra ID is the robust enforcement mechanism that evaluates various signals, including device compliance status reported by Intune, before granting access to cloud apps like email. It acts as the gatekeeper, allowing administrators to define conditions under which users can access resources. If a device is marked as non-compliant by Intune, a Conditional Access policy can then block access to sensitive applications, effectively linking device health to resource access.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.