SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?
⚠ Common exam trap
Candidates often confuse Conditional Access (an identity-based policy tool) with network-level traffic routing, not realizing that Global Secure Access is the specific feature designed to enforce traffic routing through Microsoft's network for internet-bound apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Global Secure Access
Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access is a policy-based access control engine within Microsoft Entra ID that evaluates various signals, such as user identity, device compliance, location, and application, to make real-time decisions on whether to grant, block, or limit access to resources. While fundamental for enforcing Zero Trust principles and securing access, it operates at the authentication and authorization layer, determining *who* can access *what* and *under what conditions*. It does not actively route network traffic through a secure perimeter or provide network-level inspection and enforcement for all internet-bound traffic.
- ✓
Global Secure Access
Why this is correct
Microsoft Entra Global Secure Access is Microsoft's unified Security Service Edge (SSE) solution, designed to extend identity-centric security to network access. It functions as a cloud-delivered proxy, routing both internet-bound and private application traffic through Microsoft's global network security perimeter. This capability enables comprehensive traffic inspection, policy enforcement, and threat protection for all network flows, directly addressing the need for secure traffic routing and robust network security for an organization's users and devices.
- ✗
DDoS protection
Why it's wrong here
DDoS protection, such as Azure DDoS Protection, is a specialized security service focused on safeguarding applications and services from distributed denial-of-service attacks. Its primary function is to mitigate large-scale, malicious traffic floods by absorbing and scrubbing attack traffic, thereby ensuring the availability and performance of legitimate services. It is designed for resilience against specific attack vectors and does not provide the general traffic routing, inspection, or policy enforcement capabilities across all organizational network traffic through a secure perimeter for everyday operations.
- ✗
Network segmentation
Why it's wrong here
Network segmentation is a broad architectural strategy that involves dividing a network into smaller, isolated sub-networks or zones to limit the scope of security breaches and improve control over traffic flow. While a critical security best practice for containing threats and enforcing granular access, it is a conceptual design principle rather than a specific Microsoft Entra product or service that inherently routes all internet-bound traffic through a cloud-based security perimeter. It defines boundaries and policies but does not provide the underlying global routing and security enforcement infrastructure itself.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.