SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to improve password security across its Microsoft Entra ID tenant. The security team wants to prevent users from setting passwords that appear on Microsoft's global banned password list, which includes commonly compromised passwords. Additionally, they need to add a custom banned password containing the company name so that users cannot use variations of it. Which Microsoft Entra ID feature should they configure to enforce these password policies?
⚠ Common exam trap
Many candidates confuse Identity Protection's 'leaked credentials' detection with the ability to block password creation, but Identity Protection only detects credentials that have already been compromised, not prevents users from setting weak passwords in the first place.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password Protection
Password Protection in Microsoft Entra ID is the feature specifically designed to enforce both global and custom banned password lists. It prevents users from using commonly compromised passwords from Microsoft's global list and allows administrators to add custom terms, such as the company name, to block variations. This directly addresses the requirement to improve password security by blocking weak and organization-specific passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies in Microsoft Entra ID are designed to evaluate various signals, such as user location, device compliance, and sign-in risk, to make real-time decisions about granting or blocking access to resources. While crucial for overall security, these policies operate *after* a password has been entered and do not dictate the content or complexity of the password itself. They control *how* and *when* users can access resources, not *what* passwords they can choose.
When this WOULD be correct
A company wants to block access from untrusted locations unless users complete MFA. Conditional Access policies can require MFA for specific conditions like location or device compliance.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a powerful tool focused on detecting and remediating identity-based risks, such as leaked credentials, anomalous sign-in behaviors, and risky users. It identifies existing vulnerabilities and suspicious activities, triggering automated responses like forcing password resets or blocking sign-ins. However, Identity Protection does not proactively prevent users from initially setting weak or banned passwords; its primary function is to respond to and mitigate risks *after* they have been detected.
When this WOULD be correct
An exam question might ask: 'A company wants to automatically detect and block users whose credentials have been leaked in a public data breach. Which Microsoft Entra ID feature should they configure?' In that scenario, Identity Protection would be correct.
- ✓
Password Protection
Why this is correct
Microsoft Entra ID Password Protection directly addresses the goal of improving password security by enforcing policies that prevent users from creating weak, easily guessable, or commonly compromised passwords. It utilizes both a global banned password list, maintained by Microsoft, and allows administrators to configure a custom banned password list specific to their organization. This feature actively checks new or reset passwords against these lists, rejecting those that fail to meet the defined security standards and thereby reducing the risk of password-based attacks.
- ✗
Multi-factor authentication (MFA)
Why it's wrong here
Multi-factor authentication (MFA) significantly enhances security by requiring users to provide two or more verification factors to prove their identity during sign-in. This adds a critical layer of defense, making it much harder for attackers to gain access even if they manage to compromise a user's password. Despite its effectiveness in strengthening the authentication process, MFA does not govern the actual content or strength of the password a user selects; it simply adds an additional hurdle beyond the password itself.
When this WOULD be correct
An exam question might ask: 'A company wants to require users to provide a second form of verification, such as a phone call or app notification, when signing in from untrusted locations. Which feature should they configure?' In that scenario, MFA would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Password ProtectionCorrect answer▾
Why this is correct
Microsoft Entra ID Password Protection directly addresses the goal of improving password security by enforcing policies that prevent users from creating weak, easily guessable, or commonly compromised passwords. It utilizes both a global banned password list, maintained by Microsoft, and allows administrators to configure a custom banned password list specific to their organization. This feature actively checks new or reset passwords against these lists, rejecting those that fail to meet the defined security standards and thereby reducing the risk of password-based attacks.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access enforces access controls based on signals like user, location, or device state, but it does not manage password content policies such as banned password lists.
★ When this WOULD be the correct answer
A company wants to block access from untrusted locations unless users complete MFA. Conditional Access policies can require MFA for specific conditions like location or device compliance.
Why candidates choose this
Candidates may confuse Conditional Access with general security policy enforcement, thinking it can be used to set password rules, but it is focused on access conditions, not password content.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is designed to detect and respond to identity-based risks, such as leaked credentials or suspicious sign-ins, but it does not enforce password policies like banning specific passwords.
★ When this WOULD be the correct answer
An exam question might ask: 'A company wants to automatically detect and block users whose credentials have been leaked in a public data breach. Which Microsoft Entra ID feature should they configure?' In that scenario, Identity Protection would be correct.
Why candidates choose this
Candidates may confuse Identity Protection's ability to detect compromised passwords with the ability to enforce password policies, as both relate to password security.
✗Multi-factor authentication (MFA)Wrong answer — click to see why▾
Why this is wrong here
Multi-factor authentication (MFA) adds a second verification step during sign-in, but it does not enforce password content policies like banning specific passwords. The question specifically asks about preventing users from setting banned passwords, which is handled by Password Protection, not MFA.
★ When this WOULD be the correct answer
An exam question might ask: 'A company wants to require users to provide a second form of verification, such as a phone call or app notification, when signing in from untrusted locations. Which feature should they configure?' In that scenario, MFA would be the correct answer.
Why candidates choose this
Candidates may confuse MFA with password security because both are commonly associated with improving authentication security. They might think that requiring MFA indirectly prevents weak passwords, but MFA does not control password creation policies.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.