SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Microsoft Entra Application Proxy

  Why this is correct

  Microsoft Entra Application Proxy is the correct solution for securely publishing on-premises web applications to external users. It achieves this by deploying a lightweight connector within the on-premises network, which establishes an outbound connection to Azure, creating a secure tunnel. This allows users to access internal web apps remotely with single sign-on capabilities, leveraging Entra ID's conditional access policies without requiring a VPN or opening inbound firewall ports.

• ✗

  Microsoft Entra Self-Service Password Reset (SSPR)

  Why it's wrong here

  Microsoft Entra Self-Service Password Reset (SSPR) empowers users to reset their own forgotten or locked-out passwords without requiring administrator intervention. It leverages pre-configured authentication methods, such as mobile phone verification or security questions, to securely validate a user's identity. While crucial for user productivity and helpdesk load reduction, SSPR is exclusively a password management feature and does not provide any mechanism for remote access to on-premises applications.

  When this WOULD be correct

  A company wants to reduce helpdesk calls by enabling employees to reset their own passwords securely. The IT team needs a Microsoft Entra ID feature that supports self-service password changes with security verification. In that scenario, SSPR would be the correct answer.

• ✗

  Microsoft Entra Privileged Identity Management (PIM)

  Why it's wrong here

  Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. Its primary function is to provide just-in-time and time-bound access to privileged roles, reducing the risk of excessive or standing administrative permissions. PIM does not facilitate external access to general on-premises web applications; it focuses solely on privilege elevation and governance.

  When this WOULD be correct

  A company needs to provide just-in-time privileged access to Azure AD roles and monitor privileged account usage. Which Microsoft Entra feature should they implement?

• ✗

  Microsoft Entra Identity Protection

  Why it's wrong here

  Microsoft Entra Identity Protection is a security module focused on detecting, investigating, and remediating identity-based risks within an organization. It utilizes machine learning and heuristics to identify suspicious activities like anomalous sign-ins, leaked credentials, or impossible travel scenarios. While vital for enhancing an organization's security posture by enforcing conditional access policies based on risk levels, Identity Protection's purpose is purely defensive and does not offer any functionality for publishing or providing remote access to applications.

  When this WOULD be correct

  A company wants to automatically detect and block risky sign-in attempts, such as those from anonymous IP addresses or unfamiliar locations, to protect user accounts. Which Microsoft Entra feature should they implement?

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question