SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Entra ID and is implementing a zero-trust security model. You need to ensure that all access requests to sensitive applications are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID capability should you use?
⚠ Common exam trap
Test-takers frequently confuse periodic reviews (Access reviews) or risk detection (Identity Protection) with real-time enforcement, but only session controls under Conditional Access provide the continuous, event-driven verification required by zero-trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access with session controls
Conditional Access with session controls enforces continuous access evaluation (CAE) by intercepting real-time signals—such as user risk, device compliance, or location changes—after the initial authentication. This ensures that access to sensitive applications is verified throughout the session, not just at sign-in, aligning with the zero-trust principle of 'verify explicitly and continuously.'
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access with session controls
Why this is correct
Conditional Access policies, specifically when configured with session controls and leveraging Continuous Access Evaluation (CAE), are designed to provide real-time verification during an active user session. CAE allows Microsoft Entra ID to revoke access tokens almost instantly in response to critical security events, such as a user's account being disabled, a password change, or a change in MFA location. This ensures that access is continuously evaluated against policy requirements throughout the session, not just at initial sign-in, making it the correct solution for continuous verification.
- ✗
Access reviews
Why it's wrong here
Access reviews are a governance feature in Microsoft Entra ID used for periodically attesting to user access rights, such as group memberships or application assignments. They facilitate compliance by ensuring that users only retain access necessary for their role, but they operate on a scheduled, periodic basis, typically weekly or monthly. Therefore, access reviews do not provide the real-time, continuous verification of an active user session that the scenario requires.
- ✗
Microsoft Entra Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is a powerful tool focused on detecting identity-based risks, including compromised credentials, anomalous sign-in locations, or unfamiliar sign-in properties. While it can trigger Conditional Access policies to enforce actions like MFA or password resets based on detected risks, its primary function is risk detection and reporting, not continuous, real-time verification of an *active* session's ongoing compliance. It acts pre-authentication or post-authentication to assess risk, rather than continuously verifying during the session itself.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time and time-bound access to privileged roles. PIM ensures that users elevate their permissions only when needed and for a limited duration, reducing the attack surface associated with standing privileged access. However, PIM's scope is specifically for privileged role elevation and management, not for continuous, real-time verification of *all* user sessions against general access policies.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.