SC-900 Describe the capabilities of Microsoft Entra Practice Question
A university wants to provide its students with a verifiable digital transcript that the students can share with potential employers. The university uses Microsoft Entra Verified ID to issue credentials. When an employer wants to verify a student's transcript, they scan a QR code or receive a link. Which Microsoft Entra ID feature allows the university to issue these tamper-proof credentials and allows employers to verify them without contacting the university directly?
⚠ Common exam trap
Many exam-takers confuse 'Verified ID' with general identity protection or access management features, but the key differentiator is the decentralized, tamper-proof credential issuance and independent verification capability that only Verified ID provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Verified ID
Microsoft Entra Verified ID (option C) is the correct answer because it is the decentralized identity solution built on open standards (W3C Decentralized Identifiers and Verifiable Credentials) that allows the university to issue tamper-proof digital credentials. Employers can verify these credentials independently by scanning a QR code or following a link, without needing to contact the university, because the verification is done cryptographically against the issuer's public DID on a distributed ledger.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection is a security feature designed to detect, investigate, and remediate identity-based risks within an organization's Microsoft Entra ID tenant. It identifies suspicious activities like impossible travel, leaked credentials, or anomalous sign-ins, then enforces conditional access policies. While crucial for securing identities, it does not provide functionality for issuing or managing decentralized, verifiable digital credentials to users.
When this WOULD be correct
A question asks: 'Which Microsoft Entra feature helps detect and respond to identity-based risks such as leaked credentials or suspicious sign-ins?'
- ✗
Microsoft Entra Domain Services
Why it's wrong here
Microsoft Entra Domain Services offers managed domain services, such as domain join, group policy, LDAP, and Kerberos/NTLM authentication, for virtual machines and applications running in Azure. It provides a traditional Active Directory-like experience without deploying domain controllers. This service is primarily for legacy application compatibility and infrastructure management, not for the issuance or verification of decentralized digital identity credentials for individuals.
When this WOULD be correct
A question asking: 'Which Microsoft Entra service provides managed domain services such as domain join, group policy, and LDAP for legacy applications that cannot use modern authentication methods?'
- ✓
Microsoft Entra Verified ID
Why this is correct
Microsoft Entra Verified ID enables organizations, like a university, to issue tamper-proof, self-owned digital credentials to individuals. These decentralized identifiers (DIDs) allow students to prove attributes, such as enrollment status or degree completion, to relying parties without sharing underlying personal data directly. It leverages open standards for verifiable credentials, ensuring interoperability and user control over their identity data. This directly addresses the need for a verifiable credential system.
- ✗
Microsoft Entra Permissions Management
Why it's wrong here
Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides comprehensive visibility and control over permissions across multi-cloud environments, including Azure, AWS, and GCP. It helps organizations discover, remediate, and monitor permission risks by identifying unused or excessive permissions. Its purpose is to enforce least privilege access for cloud resources, not to issue or manage verifiable digital credentials for individuals.
When this WOULD be correct
A question asking which Microsoft Entra feature helps an organization discover, remediate, and monitor overly permissive identities and resources across AWS, Azure, and GCP would have Permissions Management as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Entra Verified IDCorrect answer▾
Why this is correct
Microsoft Entra Verified ID enables organizations, like a university, to issue tamper-proof, self-owned digital credentials to individuals. These decentralized identifiers (DIDs) allow students to prove attributes, such as enrollment status or degree completion, to relying parties without sharing underlying personal data directly. It leverages open standards for verifiable credentials, ensuring interoperability and user control over their identity data. This directly addresses the need for a verifiable credential system.
✗Microsoft Entra ID ProtectionWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra ID Protection is a security tool for detecting identity risks and vulnerabilities, not for issuing or verifying verifiable credentials.
★ When this WOULD be the correct answer
A question asks: 'Which Microsoft Entra feature helps detect and respond to identity-based risks such as leaked credentials or suspicious sign-ins?'
Why candidates choose this
Candidates may confuse 'protection' with 'verification' or think that identity protection includes credential verification.
✗Microsoft Entra Domain ServicesWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP, but it does not issue or verify verifiable credentials. The scenario requires a decentralized identity solution for tamper-proof credentials, which is not a feature of Domain Services.
★ When this WOULD be the correct answer
A question asking: 'Which Microsoft Entra service provides managed domain services such as domain join, group policy, and LDAP for legacy applications that cannot use modern authentication methods?'
Why candidates choose this
Candidates may confuse 'Domain Services' with identity verification or credential management, assuming it handles digital credentials because of the word 'domain' and its role in identity infrastructure.
✗Microsoft Entra Permissions ManagementWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) tool for managing permissions across multi-cloud environments, not for issuing or verifying verifiable credentials like digital transcripts.
★ When this WOULD be the correct answer
A question asking which Microsoft Entra feature helps an organization discover, remediate, and monitor overly permissive identities and resources across AWS, Azure, and GCP would have Permissions Management as the correct answer.
Why candidates choose this
Candidates may confuse 'Permissions Management' with managing access to credentials or think it handles verification of permissions, but it is unrelated to decentralized identity or verifiable credentials.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.