SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company wants to ensure that all users access corporate resources using multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure to enforce MFA for all users?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access policies allow granular control over authentication requirements, including MFA enforcement. Security defaults provide basic MFA but are less flexible. Identity Protection detects risks but does not enforce MFA directly. Privileged Identity Management manages roles, not MFA enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access
Why this is correct
Conditional Access policies are the primary mechanism in Azure AD to enforce specific access requirements, such as multi-factor authentication (MFA), based on various conditions. These policies can be configured to target all users and all cloud apps, requiring MFA for every sign-in attempt to corporate resources. This granular control allows administrators to define precise conditions, like device state, location, or sign-in risk, under which MFA is mandatory, ensuring comprehensive protection for all access.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) provides just-in-time privileged role activation and access reviews, but it does not enforce multi-factor authentication as a condition for all sign-ins. PIM can require MFA *during* role activation, yet this does not apply to standard user access to corporate resources. It is tempting because PIM strengthens security for administrative roles, and in a scenario requiring MFA *only for privileged role elevation*, it would be the correct choice.
- ✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection is a detection and reporting tool that identifies potential vulnerabilities affecting an organization's identities and detects suspicious actions related to those identities, such as risky sign-ins or compromised credentials. While it can detect risk, it does not directly enforce multi-factor authentication (MFA) as a control. Instead, Identity Protection feeds its risk detections into Conditional Access policies, which then *can* enforce MFA or other access controls based on the detected risk level.
- ✗
Security defaults
Why it's wrong here
Security defaults provide a baseline level of security for all organizations by enforcing multi-factor authentication (MFA) for administrative roles and for all users when necessary, such as during risky sign-ins. However, they are a fixed set of pre-configured policies that cannot be customized or fine-tuned. Unlike Conditional Access, security defaults do not offer the granular control needed to define specific conditions (e.g., location, device compliance) for MFA enforcement across all users accessing corporate resources, making them less suitable for complex enterprise requirements.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.