SC-900 Describe the capabilities of Microsoft Entra Practice Question
This SC-900 practice question tests your understanding of describe the capabilities of microsoft entra. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: detects identity-based risks like impossible travel and anonymous IP sign-ins.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Entra ID. The security team wants to automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel between geographically distant locations within an unrealistic time frame. They need a solution that can automatically trigger actions like forcing a password reset or blocking sign-in for users identified as high risk. Which Microsoft Entra ID capability should they configure?
Why wrong: Conditional Access enforces policies based on conditions like location or device state, but the automated risk response policies (password reset, block) are part of Identity Protection.
B
Microsoft Entra Identity Protection
Identity Protection detects risks and allows you to configure automated responses such as requiring MFA, forcing password reset, or blocking access for high-risk users.
C
Microsoft Entra Privileged Identity Management
Why wrong: PIM manages just-in-time access for privileged roles, not general user risk response.
D
Microsoft Entra Identity Governance
Why wrong: Identity Governance deals with access certifications, entitlement management, and lifecycle, not automated risk responses.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Protection
Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.
Key principle: Detects identity-based risks like impossible travel and anonymous IP sign-ins.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Microsoft Entra Conditional Access
Why it's wrong here
Conditional Access enforces policies based on conditions like location or device state, but the automated risk response policies (password reset, block) are part of Identity Protection.
✓
Microsoft Entra Identity Protection
Why this is correct
Identity Protection detects risks and allows you to configure automated responses such as requiring MFA, forcing password reset, or blocking access for high-risk users.
Related concept
Detects identity-based risks like impossible travel and anonymous IP sign-ins.
✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
PIM manages just-in-time access for privileged roles, not general user risk response.
✗
Microsoft Entra Identity Governance
Why it's wrong here
Identity Governance deals with access certifications, entitlement management, and lifecycle, not automated risk responses.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Conditional Access with Identity Protection, but Conditional Access is the enforcement mechanism that requires a risk signal from Identity Protection to trigger automated responses like blocking or password reset.
Detailed technical explanation
How to think about this question
Under the hood, Identity Protection uses real-time and offline detection algorithms that analyze sign-in events against known risk indicators (e.g., anonymous IP addresses from Tor exit nodes, impossible travel calculated via geolocation and time differences). When a user is flagged as high risk, Identity Protection can automatically enforce a policy, such as requiring a secure password change via the self-service password reset (SSPR) integration, or blocking the sign-in entirely through Conditional Access policies that consume the risk signal. A subtle behavior is that risk can be aggregated over time, so a user may be blocked after multiple low-risk events accumulate into a high-risk state.
KKey Concepts to Remember
Detects identity-based risks like impossible travel and anonymous IP sign-ins.
Leverages Microsoft's threat intelligence and machine learning.
Configures automated responses such as forcing password reset or blocking sign-in.
Assigns risk levels to users and sign-in events.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Detects identity-based risks like impossible travel and anonymous IP sign-ins.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Review detects identity-based risks like impossible travel and anonymous IP sign-ins., then practise related SC-900 questions on the same topic to reinforce the concept.
Describe the capabilities of Microsoft Entra — This question tests Describe the capabilities of Microsoft Entra — Detects identity-based risks like impossible travel and anonymous IP sign-ins..
What is the correct answer to this question?
The correct answer is: Microsoft Entra Identity Protection — Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.
What should I do if I get this SC-900 question wrong?
Review detects identity-based risks like impossible travel and anonymous IP sign-ins., then practise related SC-900 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Detects identity-based risks like impossible travel and anonymous IP sign-ins.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.