SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID. Which TWO features help protect against identity-based attacks by detecting and responding to risks?
⚠ Common exam trap
A common mix-up: candidates confuse Privileged Identity Management (PIM) with Identity Protection, assuming PIM's role activation controls also detect attacks, when in fact PIM is purely a privileged access management tool with no risk detection capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is correct because it enforces policy-based access controls that evaluate real-time signals (e.g., user location, device compliance, sign-in risk) to block or challenge suspicious sign-in attempts, directly mitigating identity-based attacks. Identity Protection is correct because it uses machine learning to detect risk signals such as leaked credentials, anonymous IP addresses, and atypical travel, then automatically triggers remediation actions like requiring password reset or blocking access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important organizational resources. It provides just-in-time privileged access, requiring users to activate roles for a limited time, and includes features for approval workflows and access reviews for privileged roles. While PIM enhances security by limiting standing access, its primary function is not real-time risk detection or automated response to dynamic user or sign-in risks.
- ✗
Access reviews
Why it's wrong here
Microsoft Entra ID access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments. They facilitate periodic re-evaluation of user access rights by owners or reviewers to ensure only necessary access is maintained, thereby reducing the risk of stale access. However, access reviews are a periodic governance tool and do not provide real-time detection or automated response to dynamic user or sign-in risks.
- ✓
Conditional Access
Why this is correct
Microsoft Entra Conditional Access is a powerful policy engine that evaluates various conditions, such as user location, device compliance, and sign-in risk, in real-time before granting access to resources. It allows administrators to enforce specific controls, like multi-factor authentication, password changes, or blocking access, based on these conditions. When integrated with Identity Protection, Conditional Access policies can automatically respond to detected user and sign-in risks, ensuring adaptive security.
- ✗
Entitlement management
Why it's wrong here
Microsoft Entra entitlement management is an identity governance feature that enables organizations to manage identity and access lifecycle at scale. It allows for the creation of access packages, which bundle resources like groups, applications, and SharePoint sites, and automates access requests, approvals, and provisioning. Its purpose is to streamline access requests and lifecycle management, not to detect or respond to real-time security risks associated with user behavior or sign-ins.
- ✓
Identity Protection
Why this is correct
Microsoft Entra ID Protection is a crucial security tool that detects, investigates, and remediates identity-based risks across an organization. It leverages machine learning and heuristics to identify various threats, including leaked credentials, anomalous sign-in locations, impossible travel, and malware-infected devices. Identity Protection assigns a risk level to users and sign-ins, which can then be used by Conditional Access policies to trigger automated responses, proactively safeguarding identities.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.