SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?
⚠ Common exam trap
Test-takers frequently confuse Identity Protection (which can trigger MFA based on risk) as a direct MFA enforcement feature, when in fact it only provides risk signals that must be used with Conditional Access to enforce MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access
Why this is correct
Conditional Access policies are the primary method in Microsoft Entra ID to enforce specific access requirements, such as multifactor authentication (MFA), based on various conditions like user location, device state, or application being accessed. These policies evaluate conditions in real-time and grant or block access, or require additional steps like MFA, ensuring robust security tailored to risk.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a monitoring and reporting tool that detects potential identity-based risks, such as leaked credentials or anomalous sign-ins, and can trigger automated responses. While it identifies risky users or sign-ins, it does not directly enforce multifactor authentication; instead, it feeds risk signals into Conditional Access policies, which then apply the enforcement.
- ✗
Security defaults
Why it's wrong here
Security defaults provide a baseline level of security for all organizations, automatically enabling multifactor authentication for administrative roles and requiring all users to register for MFA. While it enforces MFA, it is a simplified, "all-or-nothing" approach designed for ease of use and cannot be combined with or customized by Conditional Access policies; it's an alternative, less granular enforcement mechanism.
- ✓
Authentication methods (Settings)
Why this is correct
The "Authentication methods" settings within Microsoft Entra ID allow administrators to enable and configure the specific multifactor authentication methods that users can register and utilize, such as Microsoft Authenticator, FIDO2 security keys, or SMS. This feature defines what MFA options are available, which is a prerequisite for any policy (like Conditional Access) to then require MFA.
- ✗
Password protection
Why it's wrong here
Microsoft Entra ID Password Protection is a feature designed to prevent users from creating or using weak, commonly compromised, or custom-banned passwords within the organization. Its sole focus is on strengthening password hygiene by blocking specific password choices, and it has no direct functionality related to enforcing or managing multifactor authentication.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.