SC-900 Describe the capabilities of Microsoft Entra Practice Question
A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?
⚠ Common exam trap
Many candidates confuse Audit logs (which show what happened) with Identity Protection risk detections (which analyze why it happened), leading them to pick Audit logs as the investigative tool for attack patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection risk detections
Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Protection risk detections
Why this is correct
Azure AD Identity Protection actively monitors user sign-ins and user behavior for suspicious activities, including password spray attacks, impossible travel, anomalous IP addresses, and leaked credentials. When it detects these risks, it generates risk detections that can trigger automated responses or alert administrators. This capability directly addresses the need to identify the cause of frequent password reset requests by pinpointing the underlying attack patterns.
- ✗
Audit logs
Why it's wrong here
Azure AD audit logs record specific actions and events performed by users and administrators, such as password changes, policy updates, or application access. While they can show that a password reset occurred, they do not inherently correlate multiple events into a consolidated risk detection or proactively identify patterns indicative of an attack like a password spray, which is the primary function of Identity Protection.
- ✗
Conditional Access policies
Why it's wrong here
Conditional Access policies are used to enforce specific access requirements based on conditions like user location, device compliance, or sign-in risk level. While these policies can respond to risk detections identified by Identity Protection (e.g., blocking access for high-risk users), they are a policy enforcement engine, not a system designed to actively detect or identify the underlying security threats causing frequent password reset requests.
- ✗
Multifactor authentication
Why it's wrong here
Multifactor authentication (MFA) adds an extra layer of security by requiring users to provide two or more verification factors to gain access. While MFA significantly reduces the risk of successful account compromise from stolen passwords, it is a preventative control for authentication, not a diagnostic or investigative tool to identify the root cause or detect patterns of suspicious activity like frequent password reset attempts.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.