SC-100 Certification Practice Question #267

Question

You have a Microsoft 365 subscription.

You are designing a user access solution that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA).

You need to recommend a solution that automatically restricts access to Microsoft Exchange Online, SharePoint Online, and Teams in near-real-time (NRT) in response to the following Azure AD events:

•	A user account is disabled or deleted.
•	The password of a user is changed or reset.
•	All the refresh tokens for a user are revoked.
•	Multi-factor authentication (MFA) is enabled for a user.

Which two features should you include in the recommendation? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

The four triggers in the scenario — account disabled/deleted, password changed/reset, all refresh tokens revoked, and MFA enabled — are the exact "critical events" that Continuous Access Evaluation (A) subscribes to and enforces in near-real-time for Exchange Online, SharePoint Online, and Teams, matching the MS Learn list verbatim. CAE is implemented through Conditional Access (E), which both enables CAE and synchronizes the policies the M365 services evaluate, so the two features are complementary parts of one solution. The official Suggested Answer lists only E, but a single feature cannot deliver the near-real-time event-driven revocation described, and the strong Most Voted (AE, 11 votes) plus the Highly Voted comment fill that gap; MS Learn confirms CAE is the missing piece. The lone AD dissent misunderstands that CAE is a Conditional Access capability. Confidence is 88 — a multi-select confidently resolved with MS Learn fully backing both selections, held just under 90 because the Suggested Answer is partial.

More SC-100 practice questions