SC-300 Azure AD Conditional Access 2 — Questions and Answers
Question 1: Which Conditional Access condition evaluates the likelihood that a sign-in event is not performed by the legitimate owner of the account?
- User risk
- Sign-in risk (Correct answer)
- Device compliance
- Location
Correct answer: Sign-in risk
Sign-in risk reflects the probability that a given authentication request is not authorized by the account owner, based on Microsoft's threat intelligence.
Question 2: You need to enforce Conditional Access on legacy authentication protocols such as IMAP and POP3. Which condition should you configure?
- Device platforms
- Client apps > Exchange ActiveSync clients and other clients (Correct answer)
- Locations
- Sign-in risk
Correct answer: Client apps > Exchange ActiveSync clients and other clients
The 'Client apps' condition with 'Exchange ActiveSync clients and other clients' targets legacy authentication protocols that do not support modern authentication.
Question 3: What is the minimum Azure AD license required to create and use Conditional Access policies?
- Azure AD Free
- Azure AD Premium P1 (Correct answer)
- Azure AD Premium P2
- Microsoft 365 Business Basic
Correct answer: Azure AD Premium P1
Azure AD Premium P1 is the minimum license tier that includes Conditional Access policy functionality.
Question 4: An administrator configures a Conditional Access policy with the 'Require approved client app' grant control. Which scenario will this control block?
- A user signing in from a non-compliant device
- A user accessing Exchange Online from a native mail app that is not Intune-managed (Correct answer)
- A user signing in from an anonymous IP address
- A user with a high user risk score
Correct answer: A user accessing Exchange Online from a native mail app that is not Intune-managed
The 'Require approved client app' control blocks access from apps that are not on Microsoft's list of approved client applications, such as unmanaged native mail clients.
Question 5: Which feature allows Conditional Access policies to revoke access tokens in near real-time when a user's risk level changes?
- Sign-in frequency
- Persistent browser session
- Continuous access evaluation (CAE) (Correct answer)
- Token protection
Correct answer: Continuous access evaluation (CAE)
Continuous Access Evaluation (CAE) allows resource providers to revoke access tokens immediately when policy-relevant events such as account disablement or risk elevation occur.
Question 6: A Conditional Access policy is configured to require MFA for all users. A new emergency access (break-glass) account must bypass this policy. What is the recommended approach?
- Delete the Conditional Access policy temporarily
- Add the emergency access account to the policy's user exclusion list (Correct answer)
- Disable MFA for all Global Administrators
- Change the policy to target specific groups only
Correct answer: Add the emergency access account to the policy's user exclusion list
Microsoft recommends excluding emergency access accounts from Conditional Access policies by adding them to the policy's user exclusion list so break-glass accounts remain accessible during outages.
SC-300 Azure AD Conditional Access 2
Which Conditional Access condition evaluates the likelihood that a sign-in event is not performed by the legitimate owner of the account?