SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID capability helps verify the identity of users before granting access to resources?
⚠ Common exam trap
Many candidates confuse Microsoft Entra ID Protection with Microsoft Entra ID Governance, mistakenly thinking that governance policies (like access reviews) verify identity, when in fact governance manages permissions after access is granted, not the real-time verification required by Zero Trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Protection
Microsoft Entra ID Protection (D) is the correct answer because it directly addresses the Zero Trust principle of 'verify explicitly' by using real-time risk detection and conditional access policies to verify user identity before granting access. It evaluates sign-in risk, user risk, and enforces policies like multi-factor authentication (MFA) or blocking access when suspicious activity is detected, ensuring that only legitimate users can access resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Connect
Why it's wrong here
Microsoft Entra ID Connect is primarily a synchronization service that bridges on-premises Active Directory with Microsoft Entra ID. Its core function is to provision and synchronize user identities, groups, and contacts from an on-premises directory to the cloud. While essential for hybrid identity scenarios, it does not actively perform real-time identity verification or risk assessment during sign-in attempts, which is a fundamental aspect of a Zero Trust model's "never trust, always verify" principle. Therefore, it doesn't directly implement the continuous verification aspect.
- ✗
Microsoft Entra ID Domain Services
Why it's wrong here
Microsoft Entra ID Domain Services provides managed domain services, such as domain join, group policy, LDAP, and Kerberos/NTLM authentication, for cloud-based virtual machines and applications. It essentially offers a managed domain controller experience in Azure, allowing legacy applications to authenticate against Entra ID identities. However, its primary role is not to perform dynamic identity verification or risk-based access decisions crucial for a Zero Trust architecture, which requires continuous evaluation of trust signals. It facilitates traditional authentication rather than adaptive, risk-based verification.
- ✗
Microsoft Entra ID Governance
Why it's wrong here
Microsoft Entra ID Governance focuses on managing identity and access lifecycles, including entitlement management, access reviews, and privileged identity management. Its purpose is to ensure that the right people have the right access to the right resources at the right time, and that access is regularly reviewed and removed when no longer needed. While crucial for overall security and compliance, it does not directly perform the real-time, risk-based identity verification and adaptive access enforcement that is central to a Zero Trust security model during every sign-in attempt.
- ✓
Microsoft Entra ID Protection
Why this is correct
Microsoft Entra ID Protection is a key component for implementing Zero Trust principles by continuously evaluating user and sign-in risks. It detects potential vulnerabilities affecting identities, such as leaked credentials, and identifies suspicious sign-in activities, like impossible travel or sign-ins from infected devices. By integrating with Conditional Access policies, Entra ID Protection can then enforce adaptive controls, such as requiring multi-factor authentication or blocking access, based on the real-time risk level, thereby ensuring continuous verification before granting access.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Zero Trust
Zero Trust is a security framework that assumes no user, device, or network is automatically trusted, requiring verification for every access request regardless of its origin.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.