AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Which TWO Microsoft Entra ID features should you use to protect against credential attacks?
⚠ Common exam trap
It's easy for candidates to confuse SSPR (a self-service recovery tool) with a proactive attack prevention feature, but SSPR does not block credential attacks—it only helps users after they are locked out or have forgotten their password.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password Protection
Password Protection is correct because it specifically targets credential attacks by blocking weak passwords and common variations (e.g., 'Password123!') using a global banned password list and the option to add custom terms. Identity Protection is correct because it uses real-time risk detection (e.g., leaked credentials, anonymous IP addresses) to automatically block or require MFA for suspicious sign-ins, directly mitigating credential-based attacks like password spray or brute force.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Password Protection
Why this is correct
Password Protection actively blocks users from selecting common, easily guessable passwords by enforcing both Microsoft's global banned password list and a custom banned list you define. It also performs fuzzy matching to catch variations like common letter substitutions, thereby directly reducing the likelihood of successful password spray or brute-force attacks against your tenant.
- ✓
Identity Protection
Why this is correct
Identity Protection uses machine learning and heuristics to continuously detect risk signals, such as leaked credentials, impossible travel, and anomalous sign-in behavior. When it identifies a risky sign-in or user, it can automatically challenge them with multi-factor authentication or block the attempt, providing proactive, real-time defense against credential-based attacks.
- ✗
Group-based licensing
Why it's wrong here
Group-based licensing is an administrative mechanism that automatically assigns Microsoft 365 or other product licenses to all members of a security group. It simplifies license lifecycle management by adding or removing licenses as users join or leave a group, but it has absolutely no role in credential security or authentication threat prevention.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) enables users to unlock their accounts or reset forgotten passwords by proving identity through pre-registered methods like SMS, phone call, or security questions. While this reduces helpdesk load and improves productivity, it is a recovery pathway rather than a defensive control, and it does not prevent attackers from guessing, phishing, or spraying passwords.
- ✗
Application Proxy
Why it's wrong here
Application Proxy is a reverse proxy that publishes on-premises web applications to external users through the Entra ID service, enabling conditional access, multi-factor authentication, and single sign-on for those apps. It secures access to applications by hiding them from direct internet exposure, but it does not protect the user's own credentials from being stolen or guessed; it is an access layer, not a credential protection mechanism.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.