SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?
⚠ Common exam trap
The trap is confusing Identity Protection with Conditional Access; candidates may pick Identity Protection because it sounds security-related, but Conditional Access is the feature that actually enforces MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies
Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions such as user, group, application, location, and device state. This is the primary feature for requiring MFA for access to sensitive applications. It provides granular control and integrates with other signals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and time-bound access to privileged roles within Microsoft Entra ID and Azure resources. While PIM can require multi-factor authentication (MFA) for role activation, its primary function is not to enforce MFA for regular user access to specific applications, but rather to secure elevated administrative privileges.
- ✓
Conditional Access policies
Why this is correct
Conditional Access policies are the primary tool within Microsoft Entra ID for enforcing specific access controls based on various conditions evaluated at sign-in. These policies allow administrators to define "if-then" statements, such as "if a user is accessing a specific cloud application, then require multi-factor authentication." This capability directly addresses the requirement to enforce MFA for designated applications, providing granular control over access.
- ✗
Password Protection
Why it's wrong here
Microsoft Entra ID Password Protection is a security feature focused on preventing users from creating weak, easily guessable, or commonly compromised passwords. It enforces both global and custom banned password lists, significantly reducing the risk of credential stuffing attacks. However, Password Protection solely addresses password strength and selection, and it does not provide any mechanism to enforce multi-factor authentication for application access.
- ✗
Identity Protection policies
Why it's wrong here
Microsoft Entra ID Identity Protection is a robust security solution that detects, investigates, and remediates identity-based risks, such as leaked credentials, anomalous sign-in locations, or unfamiliar sign-in properties. While Identity Protection can trigger multi-factor authentication as a remediation for a detected risk, its enforcement is entirely risk-driven. It does not allow for a blanket requirement of MFA for specific applications irrespective of the sign-in risk level.
Go deeper
Related to this question
Learn chapter
Microsoft Entra Global Secure Access
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.