SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to prevent users from setting weak passwords that are commonly found in leaked databases. They use Microsoft Entra ID (Microsoft Entra ID). Which feature should they enable?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft Entra ID Protection (which alerts on leaked credentials after they are used) with Password Protection (which proactively blocks weak passwords at creation), leading them to choose the risk-detection feature instead of the prevention feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Password Protection
Microsoft Entra ID Password Protection is the correct feature because it specifically blocks weak passwords by comparing them against a global list of commonly compromised passwords (e.g., from leaked databases) and an optional custom banned password list. This feature enforces password strength at the time of creation or reset, preventing users from setting passwords that appear in known breaches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection is a security feature designed to detect, investigate, and remediate identity-based risks, such as compromised credentials, suspicious sign-ins, and anomalous user behavior. While it can trigger automated responses like requiring multi-factor authentication or password resets for risky users, its primary function is post-event risk detection and response, not proactively preventing users from initially setting a weak password during account creation or changes.
- ✓
Microsoft Entra ID Password Protection
Why this is correct
Microsoft Entra ID Password Protection directly addresses the challenge of weak passwords by preventing users from creating or changing to commonly used, easily guessable, or compromised passwords. It achieves this by maintaining both a globally banned password list, which Microsoft curates based on breach data, and allowing organizations to define their own custom banned password lists. This proactive enforcement occurs at the point of password creation or reset, significantly reducing the risk of password-based attacks.
- ✗
Microsoft Entra ID Privileged Identity Management
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) is a service focused on managing, controlling, and monitoring access to important resources within an organization, particularly for privileged roles. It enables just-in-time (JIT) access, approval workflows, and provides auditing capabilities for role activations, minimizing the attack surface associated with standing privileged access. PIM's primary function is to secure and govern privileged access, not to enforce general password complexity or strength policies for all user accounts.
- ✗
Microsoft Entra ID Conditional Access
Why it's wrong here
Microsoft Entra ID Conditional Access policies are powerful tools used to enforce access controls based on various conditions, such as user location, device compliance, or sign-in risk. While Conditional Access can mandate requirements like multi-factor authentication or compliant devices before granting access to an application, it does not directly prevent users from setting weak passwords. It evaluates conditions at the time of an access attempt rather than enforcing password content rules during creation or change operations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.