SC-200 Certification Practice Question #190

Question

You have a Microsoft 365 subscription that contains the following resources:

•	100 users that are assigned a Microsoft 365 E5 license
•	100 Windows 11 devices that are joined to the Microsoft Entra tenant

The users access their Microsoft Exchange Online mailbox by using Outlook on the web.

You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked. What should you configure?

Accepted Answer

Revoking an active Outlook on the web session token after compromise is exactly the scenario Continuous Access Evaluation (CAE) solves, and MS Learn states CAE "is auto enabled as part of an organization's Conditional Access policies" and lets admins "revoke the session tokens and access tokens for applications that are CAE capable." Outlook Web against Exchange Online is explicitly a CAE-supported client. Of the four choices only a Conditional Access policy provides the mechanism to enforce near-real-time token/session revocation (e.g., user-risk policy plus CAE), so Suggested Answer, the 15-vote community consensus, and MS Learn all converge on C. ID Protection (D) only computes the risk signal — it still relies on a Conditional Access policy to enforce a block/revocation, which is why the lone D dissent is discounted.

More SC-200 practice questions