Azure AD Conditional Access Flashcards
6 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Azure AD Conditional Access flashcards as text
Which Conditional Access condition evaluates the likelihood that a sign-in event is not performed by the legitimate owner of the account?
Answer: Sign-in risk
Sign-in risk reflects the probability that a given authentication request is not authorized by the account owner, based on Microsoft's threat intelligence.
You need to enforce Conditional Access on legacy authentication protocols such as IMAP and POP3. Which condition should you configure?
Answer: Client apps > Exchange ActiveSync clients and other clients
The 'Client apps' condition with 'Exchange ActiveSync clients and other clients' targets legacy authentication protocols that do not support modern authentication.
What is the minimum Azure AD license required to create and use Conditional Access policies?
Answer: Azure AD Premium P1
Azure AD Premium P1 is the minimum license tier that includes Conditional Access policy functionality.
An administrator configures a Conditional Access policy with the 'Require approved client app' grant control. Which scenario will this control block?
Answer: A user accessing Exchange Online from a native mail app that is not Intune-managed
The 'Require approved client app' control blocks access from apps that are not on Microsoft's list of approved client applications, such as unmanaged native mail clients.
Which feature allows Conditional Access policies to revoke access tokens in near real-time when a user's risk level changes?
Answer: Continuous access evaluation (CAE)
Continuous Access Evaluation (CAE) allows resource providers to revoke access tokens immediately when policy-relevant events such as account disablement or risk elevation occur.
A Conditional Access policy is configured to require MFA for all users. A new emergency access (break-glass) account must bypass this policy. What is the recommended approach?
Answer: Add the emergency access account to the policy's user exclusion list
Microsoft recommends excluding emergency access accounts from Conditional Access policies by adding them to the policy's user exclusion list so break-glass accounts remain accessible during outages.