SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Conditional Access

  Why it's wrong here

  Conditional Access policies are used to enforce organizational access requirements based on conditions like user location, device compliance, or sign-in risk. While they can block access for high-risk sign-ins or require MFA, they operate *after* a password has been entered and validated. They do not possess the capability to inspect or reject a password during the creation or reset process based on a banned list, making them unsuitable for preventing weak password choices.

• ✓

  Microsoft Entra ID Password Protection

  Why this is correct

  Microsoft Entra ID Password Protection directly addresses the challenge of weak and commonly used passwords by integrating a global banned password list and enabling administrators to create custom banned lists specific to their organization. This service actively checks passwords during creation, reset, or change operations against these lists, preventing users from setting easily guessable or compromised credentials. It ensures stronger password hygiene by proactively blocking known weak patterns, directly fulfilling the requirement to prevent common passwords.

• ✗

  Identity Protection

  Why it's wrong here

  Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks, such as leaked credentials, impossible travel, or anomalous sign-in activities, often by triggering MFA or blocking access. While it identifies *risks associated with* compromised credentials, it does not directly enforce password creation policies or maintain lists of banned passwords. Its role is reactive to potential threats, not proactive in preventing the initial selection of weak passwords.

• ✗

  Multifactor Authentication (MFA)

  Why it's wrong here

  Multifactor Authentication (MFA) significantly enhances security by requiring users to provide two or more verification factors to gain access, such as a password combined with a code from an authenticator app or a biometric scan. While MFA makes it much harder for attackers to compromise an account even if they know the password, it operates independently of the password creation process. MFA does not prevent users from choosing weak or common passwords; it merely adds an additional layer of protection *after* the password has been selected.

Go deeper

Related to this question