SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team needs to block all sign-in attempts from a list of known malicious IP addresses. They also want to block sign-ins that originate from anonymous proxy services. Which Microsoft Entra capability should they configure to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse Identity Protection’s risk detection capabilities with the enforcement mechanism, mistakenly thinking Identity Protection alone can block sign-ins, when in fact it only identifies risks and requires Conditional Access to enforce the block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access policies in Microsoft Entra ID allow administrators to define conditions under which sign-ins are blocked or allowed. By configuring a policy that includes 'Locations' as a condition, you can specify a list of known malicious IP addresses and also enable the 'Anonymous IP address' risk detection to block sign-ins from anonymous proxy services. This directly meets the requirement to block sign-ins from both specific IPs and anonymous proxies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access
Why this is correct
Microsoft Entra Conditional Access is the primary policy engine within Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. By configuring "named locations," administrators can define specific trusted or untrusted IP address ranges. A Conditional Access policy can then be created to explicitly block sign-in attempts originating from these designated malicious IP ranges or from anonymous IP addresses, directly addressing the requirement to prevent access from specific unwanted network origins.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection focuses on detecting, investigating, and remediating identity-based risks by analyzing sign-in behavior and identifying anomalies. While it can flag sign-ins from unfamiliar or anonymous IP addresses as risk detections, its core function is not to maintain or enforce a static block list of IP addresses. Instead, it feeds risk signals into Conditional Access policies, which then make the enforcement decisions, such as blocking access based on the calculated risk level, rather than directly managing IP-based blocking.
- ✗
Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to privileged roles and resources within Microsoft Entra ID and Azure. Its key features include providing just-in-time (JIT) access, enforcing approval workflows for role activation, and conducting periodic access reviews for privileged assignments. PIM's functionality is centered on securing and auditing the lifecycle of privileged access, not on implementing network-level access restrictions or blocking sign-ins based on source IP addresses.
- ✗
Access Reviews
Why it's wrong here
Microsoft Entra Access Reviews are a governance feature used to ensure that users maintain only the necessary access to resources. They facilitate periodic reviews by resource owners or designated reviewers to certify that existing access assignments are still appropriate and to remove stale or unnecessary privileges. The primary purpose of Access Reviews is to manage and audit existing permissions, not to actively block sign-in attempts based on the originating IP address or other real-time sign-in conditions.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.