SC-900 Describe the capabilities of Microsoft Entra Practice Question
You are the identity administrator for a multinational company using Microsoft Entra ID. The company has a Microsoft 365 E5 subscription. The security team wants to enforce the following requirements:
1. All users must use multi-factor authentication (MFA) when accessing sensitive applications (e.g., finance app). 2. Users from the IT department must use passwordless authentication methods (e.g., Windows Hello for Business) when accessing any resource. 3. All access to sensitive applications must be logged and monitored for anomalous activity. 4. Guest users from partner organizations must be automatically reviewed quarterly to ensure they still need access. 5. The company wants to minimize administrative overhead by automating as much as possible.
You need to design a solution that meets these requirements using Microsoft Entra ID capabilities. Which combination of actions should you take?
⚠ Common exam trap
Candidates often confuse security defaults (which enforce MFA for all users but lack granularity) with Conditional Access policies (which allow targeted MFA and authentication strength requirements), and they may overlook that passwordless enforcement requires an authentication strength policy, not just MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.
It uses Conditional Access policies to enforce MFA for the finance app and passwordless authentication strength for IT, meeting requirements 1 and 2. Microsoft Entra ID Protection logs and monitors sign-in risks for sensitive apps (requirement 3), and an access review for guest users automates quarterly reviews (requirement 4). This minimizes administrative overhead by leveraging automation, aligning with requirement 5.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Self-Service Password Reset (SSPR) for all users. Enable Microsoft Entra ID Protection. Create an access review for guests.
Why it's wrong here
Configuring Self-Service Password Reset (SSPR) primarily allows users to reset their own passwords and does not provide the granular control needed to enforce multi-factor authentication (MFA) specifically for a finance application or mandate passwordless authentication for IT users. While Microsoft Entra ID Protection is enabled for monitoring, this option lacks the specific policy mechanisms to enforce the distinct authentication methods required by the scenario's security objectives.
- ✗
Use Microsoft Entra ID Protection to enforce MFA based on risk. Implement Privileged Identity Management (PIM) for IT. Configure access reviews for guests.
Why it's wrong here
While Microsoft Entra ID Protection can enforce MFA based on risk, it does not specifically enforce passwordless authentication as a sign-in method for IT users. Implementing Privileged Identity Management (PIM) is designed for managing and just-in-time elevating access to privileged roles, not for enforcing a specific authentication method like passwordless for general IT access. Therefore, this option fails to meet the requirement for passwordless authentication for IT.
- ✗
Enable security defaults to enforce MFA for all users. Configure Microsoft Entra ID Protection to monitor anomalies. Use Microsoft Entra ID Governance to automate guest access reviews.
Why it's wrong here
Enabling security defaults enforces multi-factor authentication for all users and administrative roles, which is too broad and does not allow for granular enforcement of MFA specifically for the finance application. Crucially, security defaults do not offer the capability to enforce passwordless authentication for IT users, which is a specific requirement of the scenario. While ID Protection monitors anomalies and ID Governance handles guest reviews, the core authentication requirements are not met.
- ✓
Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.
Why this is correct
This option directly addresses all specified requirements. Creating Conditional Access policies allows for precise enforcement: one policy can require MFA for the finance application, and another can mandate a passwordless authentication strength for the IT group. Enabling Microsoft Entra ID Protection ensures that sign-in risks are continuously logged and monitored, providing essential security insights. Finally, creating an access review for guest users fulfills the requirement for systematic management of external access.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.