SC-900 Practice Test 22 — 15 Questions

Question 1

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra entitlement management

Question 2

Your organization uses Microsoft Entra ID for identity management. You need to enable users to sign in using a QR code from the Microsoft Authenticator app. Which Microsoft Entra feature should you configure?

Accepted Answer

Passwordless sign-in with Microsoft Authenticator. The Microsoft Authenticator app supports passwordless sign-in by allowing users to approve a notification or scan a QR code from the sign-in screen. This feature eliminates the need for a password and relies on the Authenticator app as a primary authentication method, which is configured under the Passwordless sign-in with Microsoft Authenticator option in Entra ID.

Answer

FIDO2 security keys

Answer

Temporary Access Pass

Answer

My Security-info (https://aka.ms/mysecurityinfo)

Question 3

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

Accepted Answer

Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Answer

Identity Protection

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 4

A company needs to ensure that only approved devices can access corporate resources. Which Microsoft Entra feature should they combine with Microsoft Intune?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra feature that enforces policies to grant or block access based on conditions such as device compliance. When combined with Microsoft Intune, which manages device compliance policies (e.g., requiring encryption, a specific OS version, or a healthy device health attestation), Conditional Access can block access from non-compliant or unapproved devices. This integration ensures that only devices marked as compliant by Intune can access corporate resources.

Answer

Application Proxy

Answer

Identity Protection

Answer

Privileged Identity Management

Question 5

Your organization has implemented Microsoft Entra ID Governance. You need to review and attest to the access rights of users in a specific group every quarter. The group contains both direct members and members from nested groups. Which Microsoft Entra feature should you use to automate this review?

Accepted Answer

Access reviews. Access Reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group membership, including both direct members and transitive members from nested groups. This feature automates the attestation process by sending reviewers notifications and tracking their decisions, ensuring compliance with quarterly review requirements.

Answer

Lifecycle workflows

Answer

Privileged Identity Management

Answer

Entitlement management

Question 6

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Accepted Answer

Self-Service Password Reset (SSPR). Option C is correct because SSPR allows users to reset their own password. Option A (Password reset admin portal) is for administrators. Option B (Identity Protection) detects risks. Option D (Privileged Identity Management) manages privileged roles.

Answer

Password reset admin portal

Answer

Identity Protection

Answer

Privileged Identity Management

Question 7

You are configuring Microsoft Entra ID Governance for your organization. You need to ensure that when a user's employment status changes to 'Terminated' in the HR system, their access to critical applications is automatically revoked within 24 hours. Additionally, managers must be able to request temporary access for a terminated user if needed. What should you implement?

Accepted Answer

Create an access package with automatic assignment policies based on HR attributes and enable access reviews.. Option C is correct because access packages in Microsoft Entra entitlement management can include automatic assignment policies that evaluate HR attributes (like employment status) to grant or revoke access. When a user's status changes to 'Terminated', the policy automatically removes their membership in the access package, revoking access to critical applications within the configured time frame (e.g., 24 hours). Additionally, access reviews allow managers to request temporary access for terminated users if needed, fulfilling both requirements.

Answer

Configure Microsoft Entra entitlement management with access packages for external users.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) for all user accounts.

Answer

Implement Microsoft Entra ID Governance lifecycle workflows.

Question 8

Refer to the exhibit. You are configuring a Conditional Access policy that requires compliant device for access to Microsoft 365. The device shown in the exhibit is Azure AD joined, compliant, and managed. However, a user signing in from this device is still blocked. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires Hybrid Azure AD joined device.. Option D is correct because the exhibit shows the device is Azure AD joined, compliant, and managed, yet the user is still blocked. This indicates the Conditional Access policy is configured to require a Hybrid Azure AD joined device, which is a stricter requirement than just being Azure AD joined. A Hybrid Azure AD joined device must be both domain-joined to on-premises Active Directory and registered with Azure AD, whereas an Azure AD joined device is only cloud-joined. Since the device in the exhibit is only Azure AD joined, it does not satisfy the Hybrid Azure AD joined condition, causing the block.

Answer

The device profile type is 'Workplace', which is not allowed.

Answer

The device is not compliant.

Answer

The device is not managed.

Question 9

Your organization uses Microsoft Entra ID. You need to ensure that guest users can access resources without requiring invitation redemption. Which feature should you enable?

Accepted Answer

B2B Direct Connect. Option C is correct because B2B Direct Connect allows guest users to access resources in your Microsoft Entra ID tenant without requiring them to redeem an invitation or accept a consent prompt. This feature establishes a mutual, two-way trust relationship between your tenant and an external Microsoft Entra ID tenant, enabling seamless resource access for users who already exist in the partner's directory.

Answer

Application Proxy

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 10

Refer to the exhibit. You are reviewing a risk detection in Microsoft Entra Identity Protection. The risk event indicates 'unfamiliarFeatures' with medium risk level for user John Doe from IP 203.0.113.5. What is the most likely cause of this risk detection?

Accepted Answer

The sign-in was from an unfamiliar location or device.. Option D is correct because 'unfamiliarFeatures' indicates sign-in from a location or device that is not familiar to the user. Option A is wrong because leaked credentials would show 'leakedCredentials' risk event. Option B is wrong because anonymous IP address would be 'anonymousIpAddress' risk event. Option C is wrong because impossible travel would show 'impossibleTravel' risk event.

Answer

There was an impossible travel event detected.

Answer

John Doe's credentials were leaked on the dark web.

Answer

The sign-in originated from an anonymous IP address.

Question 11

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

Accepted Answer

Include all locations, exclude trusted locations.. Option D is correct because Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Answer

Include all users, include trusted locations.

Answer

Include all trusted locations.

Answer

Include Azure portal app, exclude trusted locations.

Question 12

A company uses Microsoft Entra ID and requires that all guest users from a partner organization must sign in using Microsoft Authenticator for MFA. The partner organization manages their own identities. What should you configure?

Accepted Answer

Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant. Option C is correct because cross-tenant access settings in Microsoft Entra ID allow you to trust MFA claims from an external partner's tenant. Since the partner manages their own identities, trusting their MFA ensures that guest users from that partner organization can satisfy MFA requirements using their own Microsoft Authenticator without needing to register again in your tenant.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy for guests

Answer

Use Microsoft Entra ID Governance to require access reviews for guests

Answer

Create a Conditional Access policy that requires MFA for guest users

Question 13

Which THREE of the following are capabilities of Microsoft Entra ID Governance?

Accepted Answer

Access reviews. Access reviews are a core capability of Microsoft Entra ID Governance, enabling organizations to periodically review and certify user access to resources, groups, and applications. This ensures compliance with internal policies and regulatory requirements by automating the attestation process and removing stale or excessive permissions.

Answer

Self-service password reset

Answer

Conditional access

Question 14

Your organization uses Microsoft Entra ID. Which TWO capabilities are provided by Microsoft Entra ID Governance?

Accepted Answer

Entitlement management. Entitlement management is a core capability of Microsoft Entra ID Governance that enables organizations to manage the identity and access lifecycle at scale. It allows administrators to create and manage access packages, automate access requests, and enforce policies for internal and external users, ensuring the right people have the right access to the right resources.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Conditional Access

Question 15

Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?

Accepted Answer

Conditional Access policy with location condition and group exclusion.. D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra entitlement management.

Answer

Microsoft Entra B2B collaboration.