SC-900 Describe the capabilities of Microsoft Entra Practice Question
A user is locked out of their account due to multiple failed sign-in attempts. Which Microsoft Entra ID feature can automatically block suspicious sign-in attempts based on risk?
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access with risk-based blocking, but Conditional Access is the policy engine that enforces the block, while Entra ID Protection is the service that actually detects and assesses the risk to trigger the automatic block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Protection
Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect and automatically block suspicious sign-in attempts based on risk signals such as anonymous IP addresses, atypical travel, or leaked credentials. When a user is locked out due to multiple failed attempts, Entra ID Protection can evaluate the sign-in risk and enforce a block or require multi-factor authentication before allowing access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) is a feature that allows users to reset their forgotten passwords independently, without administrator intervention. While crucial for user productivity and reducing help desk calls, SSPR does not actively monitor for or prevent account lockouts stemming from multiple failed sign-in attempts. Its purpose is password recovery, not real-time risk detection or automatic blocking of suspicious sign-ins.
- ✗
Microsoft Entra ID Governance
Why it's wrong here
Microsoft Entra ID Governance focuses on managing identity and access lifecycle, including access reviews, entitlement management, and privileged identity management (PIM). It ensures that the right individuals have appropriate access to resources for the correct duration. However, ID Governance does not include capabilities for detecting anomalous sign-in behavior or automatically blocking accounts due to a high volume of failed authentication attempts, which falls outside its scope of access lifecycle management.
- ✓
Microsoft Entra ID Protection
Why this is correct
Microsoft Entra ID Protection is specifically designed to detect, report, and automatically remediate identity-based risks, such as unusual sign-in locations, impossible travel, and multiple failed sign-in attempts. It leverages machine learning to identify suspicious activities and can configure policies to automatically block access or enforce multi-factor authentication (MFA) when a user's risk level is deemed high. This capability directly addresses the scenario of an account lockout due to multiple failed sign-ins by identifying and responding to the underlying risk.
- ✗
Conditional Access
Why it's wrong here
Conditional Access is a powerful policy engine that enforces access controls based on various conditions like user location, device compliance, or application. While it can block sign-ins, it primarily acts as an enforcement mechanism for predefined rules, rather than a standalone risk detection system. It can consume risk signals from Microsoft Entra ID Protection to make decisions, but it does not inherently detect the 'multiple failed sign-ins' risk itself or automatically respond to such events without an explicit policy leveraging an external risk signal.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Time-based One-time Password
A temporary, automatically generated code that changes every few seconds and is used as an extra layer of security when logging into an account.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.