SC-900 Describe the capabilities of Microsoft Entra Practice Question
An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?
⚠ Common exam trap
Many candidates confuse the detection and blocking capability (Identity Protection) with the enforcement mechanism (Conditional Access or MFA), but the question asks for the feature that 'automatically blocks sign-ins from suspicious IP addresses,' which is Identity Protection's risk-based policy integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Protection
Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Self-Service Password Reset
Why it's wrong here
Microsoft Entra Self-Service Password Reset (SSPR) enables users to independently reset their forgotten passwords without requiring administrator intervention. While SSPR significantly enhances user convenience and reduces helpdesk workload, its core functionality is not designed to detect, analyze, or block credential-based attacks like password sprays. It focuses on password management workflows rather than real-time threat detection based on sign-in risk signals.
- ✓
Microsoft Entra Identity Protection
Why this is correct
Microsoft Entra Identity Protection is purpose-built to detect and automatically remediate identity-based risks, including sophisticated password spray attacks. It utilizes machine learning and behavioral analytics to identify anomalous sign-in patterns, such as sign-ins from unfamiliar locations, impossible travel, or multiple failed attempts across various accounts from a suspicious IP address. Based on these risk detections, Identity Protection can enforce conditional access policies to block or challenge risky sign-ins, effectively preventing unauthorized access.
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is a service focused on managing, controlling, and monitoring access to critical resources within an organization. Its primary function is to reduce the attack surface associated with standing privileged access by enabling just-in-time (JIT) access, requiring approval for role activation, and providing comprehensive auditing. PIM does not actively detect or block real-time password spray attacks against general user accounts; instead, it strengthens the security posture of privileged roles.
- ✗
Microsoft Entra Multifactor Authentication
Why it's wrong here
Microsoft Entra Multifactor Authentication (MFA) adds a vital second layer of security by requiring users to provide an additional verification method beyond just a password. While MFA is extremely effective at mitigating the impact of a successful password spray by preventing unauthorized access even if a password is compromised, it does not inherently detect or block the initial password spray attempts themselves based on IP reputation or other risk signals. MFA acts as a strong deterrent post-password entry rather than a proactive attack detection system.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.