SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to implement a solution that provides real-time risk detection during sign-ins and can automatically enforce access policies based on user risk and sign-in risk. Which TWO Microsoft Entra features should they use together to achieve this? (Choose two.)
⚠ Common exam trap
The trap here is thinking that PIM or ID Governance can enforce risk-based policies, but only ID Protection and Conditional Access work together for real-time risk detection and enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Protection
Microsoft Entra ID Protection detects user and sign-in risks in real time, while Conditional Access enforces policies based on those risks. Together, they enable automated responses such as requiring MFA or blocking access when risk is elevated. This combination directly addresses the need for real-time risk detection and dynamic policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Privileged Identity Management (PIM)
Why it's wrong here
PIM provides just-in-time privileged access and access reviews, but it does not detect sign-in risks or enforce access policies based on user or sign-in risk. It is focused on managing administrative roles. While important for security, it does not address the real-time risk detection and enforcement described in the scenario. Using PIM alone would not meet the requirement.
- ✓
Microsoft Entra ID Protection
Why this is correct
Microsoft Entra ID Protection detects risk events such as leaked credentials, atypical travel, and anonymous IP addresses. It calculates user risk and sign-in risk in real time. By itself, it can generate alerts and risk reports, but to automatically enforce access decisions, it must be integrated with Conditional Access. This feature is essential for the risk detection component of the scenario.
- ✗
Microsoft Entra self-service password reset (SSPR)
Why it's wrong here
SSPR allows users to reset their passwords, reducing helpdesk load. It does not detect risk or enforce access policies. It is unrelated to real-time risk-based conditional access. While SSPR can be integrated with Conditional Access, it is not a component that provides risk detection or enforcement. Therefore, it does not satisfy the scenario's requirements.
- ✗
Microsoft Entra ID Governance
Why it's wrong here
ID Governance focuses on lifecycle management, access reviews, and entitlement management. It does not provide real-time risk detection during sign-ins or enforce access policies based on risk. While it can help with compliance, it is not the right tool for dynamic risk-based access control. The scenario requires immediate risk evaluation and policy enforcement, which ID Governance does not deliver.
- ✓
Microsoft Entra Conditional Access
Why this is correct
Conditional Access uses signals from ID Protection, such as user risk and sign-in risk, to enforce access policies. For example, it can require MFA or block access when risk is high. Without Conditional Access, ID Protection's risk detections cannot automatically control access. Together, they provide real-time risk-based enforcement, meeting the requirement for automated policy enforcement based on risk.
Go deeper
Related to this question
Learn chapter
Cloud Security Posture Management (CSPM)
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.