SC-900 Describe the capabilities of Microsoft Entra Practice Question
You are a security architect for a large enterprise using Microsoft Entra ID. You need to implement a solution that enforces least-privilege access and reduces lateral movement. Which THREE Microsoft Entra capabilities should you include in your design?
⚠ Common exam trap
Many candidates confuse Microsoft Defender for Cloud Apps (a CASB for SaaS app governance) with a core Entra ID capability, or mistakenly think password hash synchronization provides a security benefit beyond authentication synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection
Identity Protection is correct because it uses machine learning to detect and automatically respond to identity-based risks, such as leaked credentials or anomalous sign-in patterns, which directly reduces the attack surface and limits lateral movement by blocking or challenging risky authentications before an attacker can pivot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Protection
Why this is correct
Identity Protection is a crucial Microsoft Entra ID feature that automatically detects, remediates, and reports identity-based risks. It analyzes sign-in and user behavior for anomalies, such as impossible travel, leaked credentials, or unfamiliar sign-in properties. By identifying these risks, it can trigger automated responses like blocking access, enforcing multi-factor authentication, or requiring password resets, significantly reducing the potential for compromised identities to facilitate lateral movement or data breaches.
- ✗
Password hash synchronization
Why it's wrong here
Password hash synchronization (PHS) is a method for synchronizing user identities from an on-premises Active Directory to Microsoft Entra ID. It involves securely hashing and then synchronizing a user's password hash, enabling users to authenticate directly against Microsoft Entra ID using their on-premises credentials. While essential for hybrid identity authentication, PHS is a synchronization mechanism, not a security control designed to enforce least privilege or detect identity-based risks.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Privileged Identity Management (PIM) is a Microsoft Entra ID capability that manages, controls, and monitors access to important resources. It minimizes the attack surface by providing just-in-time (JIT) and just-enough-access (JEA) for privileged roles, ensuring users only have elevated permissions when explicitly needed and for a limited duration. This significantly reduces standing administrative access, enforcing the principle of least privilege and improving auditability of privileged operations.
- ✓
Conditional Access policies
Why this is correct
Conditional Access policies are "if-then" statements that enforce organizational access requirements based on various signals, including user identity, device state, location, application, and real-time risk assessments. These policies can grant or block access, or require additional authentication steps like multi-factor authentication. By dynamically evaluating conditions and enforcing appropriate controls, Conditional Access is fundamental to implementing a Zero Trust strategy and ensuring least privilege for accessing resources.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCA) functions as a Cloud Access Security Broker (CASB), providing visibility into cloud applications, identifying shadow IT, and enforcing data loss prevention (DLP) policies across SaaS applications. While it integrates with Microsoft Entra ID for identity context and user information, MDCA is a distinct security solution focused on cloud application security and governance, rather than a core Microsoft Entra ID capability for identity protection or access management itself.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.