SC-900 Describe the capabilities of Microsoft Entra Practice Question
A security administrator uses Microsoft Entra ID Protection to identify and respond to identity-based risks. Which two types of risk detections can be reviewed in Microsoft Entra ID Protection? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse risk detection types with other security features like device compliance or application permissions, but Entra ID Protection specifically focuses on sign-in and user risk detections only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign-in risk
Microsoft Entra ID Protection evaluates identity-based risks by analyzing two primary detection types: sign-in risk and user risk. Sign-in risk assesses the probability that a specific authentication attempt is unauthorized, while user risk evaluates the likelihood that a user account has been compromised based on aggregated suspicious activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sign-in risk
Why this is correct
Microsoft Entra ID Protection actively monitors and evaluates various sign-in attempts for suspicious patterns, classifying them as "sign-in risk." This includes detecting anomalies like impossible travel from geographically disparate locations, sign-ins from anonymous IP addresses or malware-linked IPs, and unfamiliar sign-in properties such as new devices or locations. These real-time detections are crucial for preventing unauthorized access by compromised accounts.
- ✓
User risk
Why this is correct
User risk, as determined by Microsoft Entra ID Protection, signifies the likelihood that a specific user's identity has been compromised, even if a particular sign-in attempt isn't immediately suspicious. This risk is aggregated over time from various detections, including leaked credentials found on the dark web, sign-ins from infected devices, or reported suspicious activity. It represents a persistent state of potential compromise for the user account, prompting proactive remediation.
- ✗
Application permission risk
Why it's wrong here
Application permission risk pertains to the potential security vulnerabilities arising from excessive or inappropriate permissions granted to applications within the Microsoft Entra tenant. While critical for overall security, this specific risk type is not directly monitored or detected by Microsoft Entra ID Protection. Instead, it falls under the purview of other security services like Microsoft Defender for Cloud Apps (MCAS) or manual auditing of application consent grants, which focus on application behavior and permissions rather than user or sign-in anomalies.
- ✗
Device compliance risk
Why it's wrong here
Microsoft Entra ID Protection primarily focuses on user and sign-in behavior to detect identity-based risks. Device compliance, however, is a function managed by Microsoft Intune, which evaluates device health, configuration, and policy adherence against organizational standards. Conditional Access policies then leverage this compliance status to grant or deny access to resources, making it distinct from the identity-centric risk detections of Entra ID Protection.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.