SC-900 Describe the capabilities of Microsoft Entra Practice Question
You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse Identity Protection's risk-based conditional access policies (which block sign-ins at the authentication level) with the session-level controls needed for real-time monitoring and blocking within an already-established cloud app session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration
Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration
Why this is correct
Microsoft Entra Conditional Access session controls, when integrated with Defender for Cloud Apps, provides granular, real-time control over user sessions *after* initial authentication. Conditional Access policies can route sessions through Defender for Cloud Apps (formerly MCAS) for continuous monitoring, allowing actions like blocking downloads, requiring re-authentication, or enforcing read-only access based on detected risky behavior *during* the session, not just at sign-in. This combination directly addresses the need for ongoing session control and behavioral enforcement.
- ✗
Microsoft Entra Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection primarily focuses on detecting and remediating identity-based risks, such as compromised credentials or suspicious sign-in activities, *at the point of authentication*. While it can trigger Conditional Access policies to block sign-ins or enforce multi-factor authentication, it does not offer real-time, in-session monitoring or control over user actions *after* a session has been established and deemed initially legitimate. Its scope is pre-authentication risk assessment and remediation.
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time and just-enough access to privileged roles. It focuses on the lifecycle of privileged role assignments, requiring activation and approval for elevated permissions. PIM does not provide capabilities for real-time monitoring or control of user behavior *within* an active session, nor does it enforce policies based on ongoing user actions once a role is activated.
- ✗
Microsoft Entra access reviews
Why it's wrong here
Microsoft Entra access reviews are a governance feature used to periodically review and certify user access to groups, applications, or roles. They help ensure that users maintain only the necessary access over time by prompting reviewers to confirm or deny existing permissions. This feature is a periodic, administrative process for compliance and least privilege principles, and it does not offer any real-time detection, monitoring, or enforcement capabilities for user behavior during an active session.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Defender for Cloud Apps
Defender for Cloud Apps is a Microsoft cloud access security broker (CASB) that helps you discover, protect, and govern your cloud applications and data across multiple cloud environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.