SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID (Microsoft Entra ID) to manage user access to cloud applications. The security team wants to enforce that users must provide a second form of authentication, such as a phone call or mobile app notification, in addition to their password. Which Microsoft Entra capability should they enable?
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access (which can *require* MFA) with the actual MFA capability itself, but the question asks for the capability that *provides* the second form of authentication, not the policy that enforces it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-Factor Authentication
Multi-Factor Authentication (MFA) is the correct capability because it requires users to provide a second form of authentication (e.g., phone call, mobile app notification) in addition to their password. This directly addresses the security team's requirement for a second authentication factor, which is the core function of MFA in Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access is a policy evaluation engine within Microsoft Entra ID that determines *when* and *how* users can access resources. While it can be configured to *require* Multi-Factor Authentication (MFA) based on various conditions like user location or device compliance, it does not inherently *provide* the second authentication factor itself. Instead, it acts as the gatekeeper that enforces the use of MFA, which is a separate authentication capability.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a risk detection and remediation tool focused on identifying vulnerabilities and suspicious activities related to user identities. It analyzes sign-in behaviors and user accounts for risks such as impossible travel, unfamiliar sign-ins, or leaked credentials. While it can trigger a Multi-Factor Authentication challenge as a remediation action for high-risk events, its primary function is risk detection, not the direct provision of a second authentication factor.
- ✓
Multi-Factor Authentication
Why this is correct
Multi-Factor Authentication (MFA) is the security feature specifically designed to enhance account security by requiring users to provide two or more distinct verification factors to prove their identity. These factors typically come from different categories, such as something you know (password), something you have (phone, authenticator app), or something you are (biometrics). MFA directly implements and provides the additional authentication factor beyond the primary password, making it the correct choice for adding a second verification method.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) is a service within Microsoft Entra ID that manages, controls, and monitors access to important resources and privileged roles. Its core purpose is to provide just-in-time and just-enough access, reducing the exposure time of privileged permissions. While PIM can enforce Multi-Factor Authentication as a requirement for activating a privileged role, its fundamental function is access governance for elevated privileges, not the general provision of a second authentication factor for all user sign-ins.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.