SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies
Conditional Access policies allow administrators to enforce MFA based on conditions such as application sensitivity, user risk, or location. Option A (Privileged Identity Management) is incorrect because it manages just-in-time access for privileged roles, not MFA enforcement. Option C (Password Protection) is incorrect because it blocks weak passwords but does not enforce MFA. Option D (Identity Protection) is incorrect because it detects identity risks and can trigger remediation but does not directly enforce MFA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and time-bound access to privileged roles within Microsoft Entra ID and Azure resources. While PIM can require multi-factor authentication (MFA) for role activation, its primary function is not to enforce MFA for regular user access to specific applications, but rather to secure elevated administrative privileges.
- ✓
Conditional Access policies
Why this is correct
Conditional Access policies are the primary tool within Microsoft Entra ID for enforcing specific access controls based on various conditions evaluated at sign-in. These policies allow administrators to define "if-then" statements, such as "if a user is accessing a specific cloud application, then require multi-factor authentication." This capability directly addresses the requirement to enforce MFA for designated applications, providing granular control over access.
- ✗
Password Protection
Why it's wrong here
Microsoft Entra ID Password Protection is a security feature focused on preventing users from creating weak, easily guessable, or commonly compromised passwords. It enforces both global and custom banned password lists, significantly reducing the risk of credential stuffing attacks. However, Password Protection solely addresses password strength and selection, and it does not provide any mechanism to enforce multi-factor authentication for application access.
- ✗
Identity Protection policies
Why it's wrong here
Microsoft Entra ID Identity Protection is a robust security solution that detects, investigates, and remediates identity-based risks, such as leaked credentials, anomalous sign-in locations, or unfamiliar sign-in properties. While Identity Protection can trigger multi-factor authentication as a remediation for a detected risk, its enforcement is entirely risk-driven. It does not allow for a blanket requirement of MFA for specific applications irrespective of the sign-in risk level.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.