SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization is adopting a Zero Trust security model. You are tasked with implementing identity protection. The requirements are: enforce multi-factor authentication (MFA) for all users when accessing cloud applications, ensure that risky sign-ins are detected and blocked automatically, and provide administrators with a dashboard showing user risk levels. You have Microsoft Entra ID P2 licenses. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Conditional Access policy to require MFA for all cloud apps, enable Identity Protection to detect and automatically block risky sign-ins, and use the Identity Protection dashboard.
A Conditional Access policy enforces MFA for all cloud apps, Identity Protection detects and automatically blocks risky sign-ins, and the Identity Protection dashboard provides a view of user risk levels. Option A is incorrect because Microsoft Sentinel is a SIEM for security information and event management, not for identity protection. Option C is incorrect because Privileged Identity Management (PIM) manages privileged access roles, not general MFA or risk detection. Option D is incorrect because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) for cloud app security, not for identity risk detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Microsoft Sentinel to collect sign-in logs and create custom alerts for risky sign-ins.
Why it's wrong here
Sentinel is a SIEM, not the primary identity protection tool.
- ✓
Configure a Conditional Access policy to require MFA for all cloud apps, enable Identity Protection to detect and automatically block risky sign-ins, and use the Identity Protection dashboard.
Why this is correct
This combination meets all requirements.
- ✗
Configure Privileged Identity Management for all users and enable MFA.
Why it's wrong here
PIM is for privileged roles, not all users.
- ✗
Configure Microsoft Defender for Cloud Apps to require MFA and detect risky sign-ins.
Why it's wrong here
Defender for Cloud Apps is for shadow IT, not identity risk.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.