SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.

  Why this is correct

  Microsoft Entra Identity Protection actively monitors for various risk detections, including leaked credentials, which are identified through dark web monitoring and other sources. A user risk policy, configured within Identity Protection, can then automatically enforce remediation actions like requiring a password change when a user's aggregated risk level (e.g., medium or high) indicates potential compromise. This direct linkage ensures that detected credential compromises are promptly addressed.

• ✗

  Create an Access Review for all users and require them to confirm their access quarterly.

  Why it's wrong here

  Access Reviews are a governance tool designed to periodically ensure that users still have appropriate access to resources, often by requiring managers or resource owners to confirm continued need. While crucial for maintaining a strong security posture by removing stale or excessive permissions, they do not actively monitor for or detect security incidents like leaked credentials. Their purpose is about validating existing access, not identifying external compromises.

• ✗

  Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

  Why it's wrong here

  Microsoft Entra Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. It enables just-in-time access, requiring users to activate roles for a limited time and often with multi-factor authentication, thereby reducing the attack surface for privileged accounts. However, PIM's core function is not to detect external security threats like leaked credentials; it's about securing the *use* of privileged roles.

• ✗

  Configure a Conditional Access policy to require password change when sign-in risk is high.

  Why it's wrong here

  Conditional Access policies can indeed leverage sign-in risk signals to enforce actions like requiring a password change. However, Conditional Access itself does not *detect* leaked credentials; it consumes risk scores provided by Microsoft Entra ID Protection's real-time sign-in risk detections. While a Conditional Access policy can *respond* to high sign-in risk, it's Identity Protection that performs the underlying analysis, including identifying leaked credentials, which then feeds into the sign-in risk assessment.

Go deeper

Related to this question