Microsoft Entra ID Identity Risk Detection and Remediation: Identity Protection and Conditional Access
Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)
Quick Answer
The answer is Conditional Access and Identity Protection. Identity Protection is the detection engine that analyzes signals like leaked credentials, anonymous IP addresses, and atypical travel to assign a risk level to each user or sign-in, while Conditional Access acts as the remediation engine by enforcing automated policies—such as requiring multi-factor authentication or blocking access—when a risk threshold is met. On the SC-900 exam, this pairing tests your understanding of how Microsoft Entra ID identity risk detection and remediation work together as a closed-loop system; a common trap is confusing Privileged Identity Management (PIM), which controls just-in-time admin roles, with risk remediation. Remember the mnemonic “Detect with Protection, Remediate with Access” to keep the two distinct.
⚠ Common exam trap
Many exam-takers confuse Privileged Identity Management (PIM) with risk remediation, but PIM only manages privileged role activation and does not detect or automatically remediate identity risks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection
Identity Protection (A) is correct because it uses machine learning and heuristics to detect identity-based risks such as leaked credentials, impossible travel, and anomalous sign-in behavior. It provides automated remediation actions like requiring password reset or blocking sign-in, directly addressing risk detection and remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Protection
Why this is correct
Identity Protection detects risk detections.
- ✗
Identity Governance
Why it's wrong here
Identity Governance manages access reviews.
- ✗
Password protection
Why it's wrong here
Password protection prevents weak passwords.
- ✗
Privileged Identity Management
Why it's wrong here
PIM manages just-in-time access, not risk detection.
- ✓
Conditional Access
Why this is correct
Conditional Access can block or require MFA based on risk.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO are capabilities of Microsoft Entra ID Protection?
easy- ✓ A.Risk-based conditional access policies
- B.Device enrollment policies
- C.Self-service password reset
- D.Privileged role activation
- ✓ E.Detection of leaked credentials
Why A: Microsoft Entra ID Protection uses risk-based conditional access policies to automatically respond to detected risks, such as blocking access or requiring multi-factor authentication, based on real-time risk levels. Option E is correct because Entra ID Protection continuously monitors for leaked credentials by analyzing known credential breaches and flagging accounts whose credentials have been exposed, enabling proactive remediation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.