SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?
⚠ Common exam trap
Candidates often confuse the purpose of Identity Protection policies (risk-based) with Conditional Access policies (condition-based), or they mistakenly think Per-user MFA is the only way to enforce MFA for a specific app, when in fact it applies globally to all apps for that user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy
Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on specific conditions, such as the application being accessed (the financial app). This is the correct, modern approach to require MFA for a specific application rather than for all sign-ins globally. It provides granular control by evaluating signals like user, device, location, and application before granting access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection policy
Why it's wrong here
Identity Protection policies primarily focus on detecting and remediating sign-in and user risks, such as impossible travel or leaked credentials. While they can enforce multifactor authentication (MFA) as a remediation step when a sign-in is deemed risky, their core function is not to universally require MFA for all sign-ins or specific applications. They react to anomalies rather than proactively setting a baseline MFA requirement for all users or specific conditions.
- ✓
Conditional Access policy
Why this is correct
Conditional Access policies are the control plane for access decisions in Microsoft Entra ID, allowing administrators to define specific conditions under which users can access resources. These policies can explicitly mandate controls like 'Require multifactor authentication' for specific users, groups, applications, or locations. This makes them the definitive tool for enforcing MFA requirements across an organization based on defined criteria and is the recommended modern approach.
- ✗
Per-user MFA
Why it's wrong here
Per-user MFA is a legacy method for enabling or enforcing multifactor authentication on an individual user account, typically managed through the Microsoft 365 admin center or the Entra ID portal. Unlike Conditional Access, it lacks the granular control to apply MFA based on conditions such as the application being accessed, network location, or device compliance. While it can enforce MFA for a user, it is not the recommended modern approach for flexible and scalable MFA enforcement across an organization.
- ✗
MFA registration policy
Why it's wrong here
An MFA registration policy ensures that users set up and register their multifactor authentication methods within Microsoft Entra ID, often as part of a secure registration process. Its purpose is to prepare users to use MFA by having valid methods available, but it does not, by itself, enforce the actual MFA challenge during a sign-in attempt. A separate policy, typically Conditional Access, is required to compel users to *use* their registered MFA methods for authentication.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.