SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.
A is correct. Identity Protection sign-in risk policies can detect and block sign-ins from anonymous IP addresses. User risk policies can require a password change for high-risk users. Conditional Access policies can enforce MFA based on location (e.g., outside home country). Option B is incorrect because a single Conditional Access policy cannot directly detect anonymous IP addresses (this is only available through Identity Protection). Option C is incorrect because it blocks sign-ins from outside the home country instead of requiring MFA. Option D is incorrect because it uses Conditional Access to require MFA for all users, which is already done by the existing policy, and it does not specifically enforce MFA for outside home country; also, requiring MFA for all users adds unnecessary friction. The most efficient method to meet all requirements with minimal administrative overhead is to combine Identity Protection risk policies for anonymous IP and high risk, and create a separate Conditional Access policy for location-based MFA, as in option A.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.
Why this is correct
This meets all requirements: anonymous IP blocked via risk policy, password change via user risk policy, location-based MFA via Conditional Access.
- ✗
Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.
Why it's wrong here
Conditional Access cannot detect anonymous IP addresses directly; that requires Identity Protection risk policies.
- ✗
Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.
Why it's wrong here
Blocking sign-ins from outside the home country is too restrictive; requirement is to require MFA, not block.
- ✗
Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.
Why it's wrong here
This does not address MFA for sign-ins from outside the home country specifically; all users already require MFA but location-based MFA is not implemented.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.