SC-900 Describe the capabilities of Microsoft Entra Practice Question
Which two capabilities are provided by Microsoft Entra ID? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse Microsoft Entra ID's identity-focused capabilities (Conditional Access, Identity Protection) with adjacent security services like Intune (MDM), Microsoft Purview (DLP), and Defender for Cloud Apps (CASB), which are separate products in the Microsoft security stack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies
Conditional Access policies (B) are a core capability of Microsoft Entra ID, enabling administrators to enforce access controls based on signals like user location, device state, and application sensitivity. Identity Protection with risk-based conditional access (C) leverages machine learning to detect sign-in and user risks, automatically applying policies to block or require multi-factor authentication. Both are native to Microsoft Entra ID and integral to its identity and access management (IAM) framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mobile device management (MDM)
Why it's wrong here
Microsoft Entra ID provides the foundational identity and access management services, enabling users to authenticate and enroll devices into management solutions. However, the actual mobile device management (MDM) capabilities, including policy deployment, application management, and device configuration, are primarily delivered by Microsoft Intune. Intune leverages Entra ID for user and device identities but is the dedicated solution for comprehensive MDM functionality.
- ✓
Conditional Access policies
Why this is correct
Conditional Access policies are a core security feature within Microsoft Entra ID, allowing organizations to enforce specific access controls based on various signals. These policies evaluate conditions such as user identity, device state, location, and application to determine whether to grant access, block access, or require additional authentication methods like multi-factor authentication. This capability is fundamental for implementing Zero Trust principles in Entra ID by ensuring only authorized users on compliant devices can access resources.
- ✓
Identity protection with risk-based conditional access
Why this is correct
Microsoft Entra ID Identity Protection actively detects identity-based risks, such as suspicious sign-ins, leaked credentials, or impossible travel scenarios, by analyzing vast amounts of telemetry data. It then integrates seamlessly with Conditional Access policies to trigger automated responses based on these risk detections. This enables risk-based conditional access, dynamically challenging users with multi-factor authentication or blocking access entirely when a high-risk event is identified, thereby enhancing security posture.
- ✗
Data loss prevention (DLP) for sensitive information
Why it's wrong here
Data loss prevention (DLP) focuses on identifying, monitoring, and protecting sensitive information across various locations and applications within an organization. This critical compliance capability is primarily provided by Microsoft Purview, which offers a comprehensive suite of data governance and compliance solutions. While Microsoft Entra ID manages user identities and access to resources, it does not directly perform the content inspection or policy enforcement required for DLP.
- ✗
Cloud access security broker (CASB)
Why it's wrong here
A Cloud Access Security Broker (CASB) provides critical visibility, control, and protection for data and threats across cloud applications. This functionality, including real-time monitoring, threat detection, and policy enforcement for SaaS applications, is delivered by Microsoft Defender for Cloud Apps. Although Microsoft Entra ID facilitates single sign-on to these cloud applications, it does not offer the deep, in-app security and compliance capabilities inherent to a CASB solution.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.