SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to automatically block sign-ins from IP addresses that exhibit brute-force attack patterns. Which capability should they enable?
⚠ Common exam trap
Test-takers frequently confuse Conditional Access (which enforces policies based on conditions) with Identity Protection (which provides the risk detection signals), leading them to select D, even though Conditional Access alone cannot automatically detect brute-force patterns without Identity Protection's risk assessments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Protection
Microsoft Entra Identity Protection is the correct capability because it uses machine learning and heuristic detection to automatically identify and block sign-ins from IP addresses exhibiting brute-force attack patterns, such as repeated failed authentication attempts. It can trigger risk-based policies, including blocking access or requiring multi-factor authentication, without manual intervention. This directly addresses the security team's requirement to automate the response to brute-force patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Identity Protection
Why this is correct
Microsoft Entra Identity Protection is the correct choice because it specifically leverages machine learning and heuristic rules to detect potential vulnerabilities affecting identities, such as leaked credentials, impossible travel, or sign-ins from unfamiliar locations. It automatically assesses user and sign-in risk in real-time and can be configured to take automated remediation actions like blocking access, requiring multi-factor authentication, or forcing a password reset, directly addressing the need to detect and block risky sign-ins.
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is incorrect because its primary function is to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. PIM focuses on providing just-in-time (JIT) or time-bound access to privileged roles, requiring approval workflows and providing audit trails, rather than dynamically detecting and blocking anomalous or risky sign-in behaviors based on real-time risk signals.
- ✗
Microsoft Entra External Identities
Why it's wrong here
Microsoft Entra External Identities is incorrect as it is designed for managing identities that originate outside the organization's primary Microsoft Entra tenant, such as business-to-business (B2B) collaboration users or business-to-consumer (B2C) customers. While it secures external user access, its core purpose is not to provide advanced, real-time risk detection and automated blocking capabilities for general risky sign-ins across all users, particularly for internal company users.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access is incorrect because it is an enforcement engine that applies access policies based on specific conditions, rather than a standalone risk detection service. While Conditional Access policies can utilize risk signals generated by Microsoft Entra Identity Protection as a condition, it does not perform the underlying machine learning-based risk assessment itself. It requires pre-defined policies to act upon conditions, whereas Identity Protection actively identifies the risk.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.