SC-900 Practice Test 21 — 15 Questions

Question 1

A large enterprise uses Microsoft Entra ID with P2 licenses. The security team wants to implement just-in-time (JIT) access for privileged roles and require approval for role activation. Additionally, they want to receive alerts when a role is activated outside business hours. Which feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM).. Microsoft Entra Privileged Identity Management (PIM) is the correct feature because it provides just-in-time (JIT) activation of privileged roles, supports approval workflows for role activation, and can send alerts when roles are activated outside business hours. PIM is specifically designed for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID, including time-bound activation and notification settings.

Answer

Microsoft Entra Identity Protection.

Answer

Conditional Access policies.

Answer

Microsoft Entra entitlement management.

Question 2

Your organization uses Microsoft Purview Communication Compliance to detect potential harassment in Microsoft Teams messages. Which role is required to review and act on policy matches?

Accepted Answer

Communication Compliance analyst. The Communication Compliance analyst role is specifically designed to review policy matches, investigate message details, and take remediation actions such as escalating or resolving alerts in Microsoft Purview Communication Compliance. This role has the necessary permissions to view and act on detected violations without the broader administrative privileges of a Compliance administrator.

Answer

Communication Compliance admin

Answer

Communication Compliance investigator

Answer

Compliance administrator

Question 3

Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?

Accepted Answer

Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.. You need to use a Conditional Access policy with the 'Require session control' grant, targeting 'All cloud apps' and 'Unmanaged devices' as conditions. This integrates with Microsoft Defender for Cloud Apps to enforce additional authentication (via Microsoft Entra ID) and enable session monitoring, such as real-time activity logging and download blocking, for the sanctioned app when accessed from unmanaged devices.

Answer

Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.

Answer

Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.

Answer

Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.

Question 4

A user reports they cannot access the company portal from their personal device. The device is not enrolled in Microsoft Intune. The admin wants to ensure only compliant devices can access corporate resources. What should the admin configure?

Accepted Answer

Conditional Access policy requiring device compliance. A is correct because a Conditional Access policy can require device compliance before granting access to corporate resources. When the device is not enrolled in Microsoft Intune, it cannot report compliance status, so the policy blocks access. This ensures only managed, compliant devices can access the company portal.

Answer

Enable password writeback

Answer

Enable Identity Protection sign-in risk policy

Answer

Microsoft Entra Privileged Identity Management

Question 5

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have multiple on-premises applications that use LDAP for authentication. They want to enable single sign-on (SSO) to these applications from the cloud without modifying the applications. Which approach should they use?

Accepted Answer

Microsoft Entra Domain Services. Microsoft Entra Domain Services provides managed domain services such as LDAP, Kerberos, and NTLM authentication without requiring you to deploy and manage domain controllers. Since the on-premises applications use LDAP for authentication and cannot be modified, Entra Domain Services can be used to lift and shift these applications into Azure while enabling SSO from the cloud, as it presents a compatible LDAP interface that the applications can continue to use.

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Pass-through authentication

Answer

Password hash synchronization with Seamless SSO

Question 6

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

Accepted Answer

MFA registration campaign. The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Answer

Identity Protection

Answer

Conditional Access

Answer

Security defaults

Question 7

Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides centralized security analytics and threat intelligence across the entire enterprise, including on-premises and multi-cloud environments. It collects data from various sources via connectors (e.g., Azure Monitor Agent, Syslog, Windows Security Events) and allows security teams to manage policies, detect threats, and respond from a single pane of glass. This makes it a correct answer for centrally managing security policies across hybrid environments.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 8

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

Accepted Answer

Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Answer

Identity Protection

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 9

Your organization wants to centrally manage security policies for all devices (Windows, iOS, Android) and ensure they meet compliance requirements before accessing corporate resources. Which Microsoft solution should you use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct solution because it is a cloud-based mobile device management (MDM) and mobile application management (MAM) service that centrally manages security policies across Windows, iOS, and Android devices. It enforces compliance requirements—such as encryption, OS version, and jailbreak detection—before granting access to corporate resources, integrating with Conditional Access in Microsoft Entra ID.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Entra ID

Question 10

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

Accepted Answer

The corporate laptops are not marked as compliant devices.. The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Answer

Users are authenticating via device code flow.

Answer

The Conditional Access policy has the 'Persistent browser session' setting enabled.

Answer

The policy is blocking legacy authentication.

Question 11

A security administrator needs to identify users who are repeatedly failing to authenticate from unusual locations. Which Microsoft 365 security feature provides this visibility?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects and reports risky sign-in behaviors, including repeated authentication failures from unusual locations. It uses machine learning models to evaluate sign-in risk based on factors like unfamiliar IP addresses, anonymous IP addresses, and atypical travel patterns, providing security administrators with visibility into such anomalies.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 12

An organization wants to automatically revoke access to cloud apps when an employee leaves the company. Which Microsoft Entra feature should they use?

Accepted Answer

Automated user provisioning. Automated user provisioning (B) is the correct answer because it can automatically disable or remove a user's access to cloud apps when the user is deleted or deactivated in the HR system or on-premises directory. This feature synchronizes identity lifecycle events (e.g., termination) to connected SaaS applications, ensuring revocation of access without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 13

Your organization needs to classify documents containing personally identifiable information (PII) like social security numbers. Which Microsoft Purview solution should you configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection (A) is the correct solution because it provides classification and labeling capabilities specifically designed to identify, label, and protect sensitive data such as PII (e.g., social security numbers). It uses trainable classifiers and exact data match (EDM) to automatically detect sensitive content and apply appropriate protection actions like encryption or access restrictions.

Answer

Records Management

Answer

Auditing

Answer

Communication Compliance

Question 14

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their social media accounts, such as Google or Facebook. Which feature should you configure?

Accepted Answer

External ID. External ID (now known as Microsoft Entra External ID) allows you to configure identity providers for social accounts like Google and Facebook. This enables users to sign in with their existing social credentials by establishing federation via OAuth 2.0 or OpenID Connect protocols, rather than requiring a separate Microsoft Entra ID account.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Conditional Access

Question 15

Refer to the exhibit. You are reviewing a risk detection report in Microsoft Entra Identity Protection. The report shows a user with high risk level and two risk events. What does the status 'remediated' indicate?

Accepted Answer

The risk has been resolved by a remediation action such as password reset.. In Microsoft Entra Identity Protection, the 'remediated' status indicates that the risk associated with the user has been resolved through an automated or manual remediation action, such as a password reset or completion of a multi-factor authentication (MFA) challenge. This means the detected risk event is no longer considered active, and the user's account has been brought back to a secure state. Option B correctly identifies that the risk was resolved by a remediation action.

Answer

The risk is still active and requires investigation.

Answer

The user's account has been confirmed as compromised.

Answer

The risk was dismissed by an administrator as false positive.