SC-100 Certification Practice Question #10

Question

A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications.
The customer discovers that several endpoints are infected with malware.
The customer suspends access attempts from the infected endpoints.
The malware is removed from the endpoints.
Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

Per MS Learn, in the Defender-for-Endpoint → Intune → Conditional Access flow, Defender shares a device risk level, and **Intune** is the component that evaluates that signal against compliance policy and reports the device as compliant to Entra ID (B). Access was suspended via token/session revocation, so once the device is compliant again the **client access tokens must be refreshed** for the new state to be recognized and access restored (A) — exactly the CAE re-evaluation MS Learn describes. The widely repeated BD answer mislabels Defender for Endpoint as a compliance reporter; it only supplies the risk score, which is why D is rejected and B is kept. Confidence is held at 80 because the official Suggested Answer lists only B (leaving the second selection to community judgment) and there is a substantial, articulate BD minority — but MS Learn's "Intune determines compliance / MDE reports risk" wording breaks the tie in favor of AB.

More SC-100 practice questions