SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Microsoft Entra Application Proxy

  Why this is correct

  Microsoft Entra Application Proxy enables secure remote access to on-premises web applications from any device, without requiring a VPN or opening inbound firewall ports. It works by deploying a lightweight connector within the private network that establishes an outbound connection to the Microsoft Entra service. This allows users to access internal applications using their Microsoft Entra ID credentials, benefiting from single sign-on and Microsoft Entra's robust security features like Conditional Access.

• ✗

  Microsoft Entra Connect

  Why it's wrong here

  Microsoft Entra Connect is a crucial tool for hybrid identity, responsible for synchronizing user, group, and contact identities from an on-premises Active Directory to Microsoft Entra ID. It ensures that identities are consistent across both environments, enabling single sign-on for cloud applications. While essential for identity management, it does not provide proxying capabilities for remote access to on-premises applications.

  When this WOULD be correct

  A company wants to synchronize user accounts and passwords from an on-premises Active Directory to Microsoft Entra ID to enable cloud-based authentication and management. The question would ask: 'Which tool should they use to sync on-premises identities to the cloud?'

• ✗

  Microsoft Entra Domain Services

  Why it's wrong here

  Microsoft Entra Domain Services provides managed domain services, such as domain join, group policy, LDAP, and Kerberos/NTLM authentication, directly within Azure. It is designed to support cloud-based virtual machines and applications that require traditional Active Directory features, without needing to deploy and manage domain controllers yourself. However, it does not facilitate secure remote access to applications hosted on *on-premises* infrastructure.

  When this WOULD be correct

  A company needs to lift-and-shift on-premises applications to Azure without re-architecting, and requires domain-joined VMs with managed domain services like Group Policy. Entra Domain Services would be correct for providing AD DS compatibility in Azure.

• ✗

  Microsoft Entra ID P2 license

  Why it's wrong here

  A Microsoft Entra ID P2 license is a subscription tier that unlocks advanced identity and access management capabilities within Microsoft Entra ID. These features include Microsoft Entra Identity Protection for risk detection, Privileged Identity Management (PIM) for just-in-time access, and advanced Conditional Access policies. It is a licensing plan that grants access to specific features, rather than a service or component that directly provides remote application access.

  When this WOULD be correct

  A question that asks which license is required to use Microsoft Entra ID Protection, Identity Governance (e.g., Privileged Identity Management), or Conditional Access policies with risk-based conditions. For example: 'Which license is needed to implement risk-based Conditional Access policies?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question