SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to automatically detect and alert the security team when a user sign-in appears to originate from a known compromised credential or from an anonymizing VPN service. The company wants to receive a risk score for each sign-in and be able to trigger automated remediation actions. Which Microsoft Entra ID feature should they enable?
⚠ Common exam trap
Many candidates confuse Privileged Identity Management (PIM) with Identity Protection because both involve 'risk' or 'security,' but PIM only manages privileged role activation and does not detect or score sign-in risks from compromised credentials or anonymizing VPNs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Protection
Microsoft Entra ID Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks, including sign-ins from compromised credentials and anonymizing VPN services (e.g., Tor). It assigns a risk score (low, medium, high) to each sign-in and user, and supports automated remediation actions such as requiring multi-factor authentication (MFA) or blocking sign-in via Conditional Access policies integrated with the risk detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Protection
Why this is correct
Microsoft Entra ID Protection is the correct service for automatically detecting and alerting security teams about identity-based risks. It continuously monitors user sign-ins and identities for suspicious activities, such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Upon detection, it can trigger automated responses like multi-factor authentication prompts, password resets, or blocking access, thereby protecting user accounts from compromise and preventing unauthorized access.
- ✗
Microsoft Entra Identity Governance
Why it's wrong here
Microsoft Entra Identity Governance focuses on managing and auditing the identity lifecycle, access lifecycle, and privileged access for users. It encompasses features like access reviews to ensure appropriate access, entitlement management for streamlined access requests, and lifecycle workflows for onboarding and offboarding users. This service ensures compliance and manages access permissions effectively but does not provide real-time detection or alerting for identity-based security risks like suspicious sign-in attempts or compromised credentials.
When this WOULD be correct
This option would be correct for a question about automating user access reviews, managing guest user lifecycles, or ensuring compliance with access policies, such as 'A company needs to regularly review and certify access to critical applications for all employees and guests.'
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within an organization. Its primary function is to provide just-in-time and just-enough access to privileged roles, reducing the attack surface associated with standing administrative permissions. While it monitors the use of these elevated roles, it does not actively detect or alert on general user sign-in risks, such as compromised credentials or unusual sign-in patterns for non-privileged accounts.
When this WOULD be correct
A company needs to implement just-in-time privileged access, require approval for role activation, and receive alerts when privileged roles are used. They want to audit and manage privileged identities to reduce standing access.
- ✗
Microsoft Entra External Identities
Why it's wrong here
Microsoft Entra External Identities is a suite of capabilities that allows organizations to collaborate securely with external users, such as partners, customers, or vendors. It facilitates guest access (B2B collaboration) and customer identity and access management (B2C) by enabling external users to sign in with their own identities. While it manages external user accounts, its primary function is not to detect or alert on security risks associated with suspicious sign-ins or compromised credentials for either internal or external users.
When this WOULD be correct
A company needs to allow external partners to access internal applications using their own identity providers (e.g., Google, Facebook) and manage their access lifecycle. In that scenario, Microsoft Entra External Identities would be the correct feature to enable.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Entra ID ProtectionCorrect answer▾
Why this is correct
Microsoft Entra ID Protection is the correct service for automatically detecting and alerting security teams about identity-based risks. It continuously monitors user sign-ins and identities for suspicious activities, such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Upon detection, it can trigger automated responses like multi-factor authentication prompts, password resets, or blocking access, thereby protecting user accounts from compromise and preventing unauthorized access.
✗Microsoft Entra Identity GovernanceWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Identity Governance focuses on managing identity lifecycles, access reviews, and entitlement management, not on detecting risky sign-ins or compromised credentials. It lacks the risk detection and automated remediation capabilities required by the question.
★ When this WOULD be the correct answer
This option would be correct for a question about automating user access reviews, managing guest user lifecycles, or ensuring compliance with access policies, such as 'A company needs to regularly review and certify access to critical applications for all employees and guests.'
Why candidates choose this
Candidates may confuse 'governance' with security monitoring, assuming that identity governance includes risk detection and alerting, when in fact it is primarily about managing and auditing access rights.
✗Microsoft Entra Privileged Identity ManagementWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles, not sign-in risk detection or automated remediation based on compromised credentials or anonymizing VPNs.
★ When this WOULD be the correct answer
A company needs to implement just-in-time privileged access, require approval for role activation, and receive alerts when privileged roles are used. They want to audit and manage privileged identities to reduce standing access.
Why candidates choose this
Candidates may confuse PIM's alerting and automated actions with risk-based remediation, not realizing PIM focuses on privileged role management rather than sign-in risk detection.
✗Microsoft Entra External IdentitiesWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra External Identities is designed for managing external user identities (e.g., B2B collaboration), not for detecting compromised credentials, anonymizing VPNs, or providing risk scores and automated remediation for sign-ins.
★ When this WOULD be the correct answer
A company needs to allow external partners to access internal applications using their own identity providers (e.g., Google, Facebook) and manage their access lifecycle. In that scenario, Microsoft Entra External Identities would be the correct feature to enable.
Why candidates choose this
Candidates may confuse 'External Identities' with security features for external sign-ins, mistakenly thinking it includes threat detection for external users, when in fact it focuses on identity federation and guest user management.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Time-based One-time Password
A temporary, automatically generated code that changes every few seconds and is used as an extra layer of security when logging into an account.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.