SC-900 Practice Exam 61 — 20 Questions

Question 1

A company uses Microsoft Entra ID and Intune to manage devices. They want to enforce a policy that allows access to financial data from SharePoint Online only when the user's device is compliant (e.g., encrypted, patched) AND the user authenticates from a trusted IP address range. Additionally, if the sign-in risk is assessed as medium or high by Identity Protection, the user must also perform multifactor authentication (MFA). Which Conditional Access components should the administrator configure?

Accepted Answer

Configure conditions for sign-in risk and locations, and use Grant controls to require MFA and device compliance.. Option A is correct because Conditional Access in Microsoft Entra ID allows combining multiple conditions (sign-in risk, locations) with grant controls (require MFA, require device compliance) to enforce the described policy. The administrator configures conditions for sign-in risk (medium/high) and locations (trusted IP range), then uses Grant controls to require MFA and device compliance, ensuring access is allowed only when all requirements are met.

Answer

Configure a session control to require device compliance and an assignment for sign-in risk to trigger MFA.

Answer

Use Microsoft Entra ID Protection to automatically enforce MFA and device compliance for all users regardless of location.

Answer

Configure a compliance policy in Intune and link it directly to SharePoint Online to block non-compliant devices.

Question 2

A company uses Microsoft Entra ID and wants to allow external business partners to request access to a specific application through an approval process. The access should be time-limited and automatically expired. Which Microsoft Entra ID feature should be configured?

Accepted Answer

Entitlement management. Microsoft Entra entitlement management (part of Identity Governance) allows organizations to manage access for internal and external users through access packages, which include policies for requesting, approving, and automatically expiring access. Conditional Access is for enforcing policies during sign-in, PIM manages privileged roles, and self-service group management allows users to manage group membership but does not provide approval workflows or time-limited access for external users out-of-the-box.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Self-service group management

Question 3

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to allow users to sign in using biometrics (fingerprint or face) on their mobile devices instead of passwords. They want this to work for both iOS and Android devices. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Passwordless authentication using Microsoft Authenticator. Option A is correct because Microsoft Authenticator supports passwordless authentication using FIDO2-based biometric verification on mobile devices. This feature allows users to sign in with a fingerprint or face on both iOS and Android, eliminating the need for a password while leveraging the device's built-in biometric capabilities.

Answer

Microsoft Entra Connect Sync Health

Answer

Microsoft Entra ID Protection

Answer

Self-Service Password Reset (SSPR)

Question 4

A company uses Microsoft Entra ID. They want to ensure that users who are traveling to a high-risk country, based on the sign-in IP address, are prompted for multi-factor authentication before accessing the company's CRM application. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in signals—such as the user's location derived from the IP address—and enforce access controls like requiring multi-factor authentication (MFA) before granting access to a specific application (e.g., the CRM app). By configuring a Conditional Access policy with a location condition targeting high-risk countries, the company can ensure that only users signing in from those IP ranges are prompted for MFA, while other sign-ins proceed normally.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Azure AD Join

Question 5

A company wants employees to be able to access corporate applications from their personal mobile devices, but only if those devices are enrolled in mobile device management (MDM) and have a PIN code set. Which Microsoft Entra capability should the administrator use to enforce these requirements?

Accepted Answer

Conditional Access. Conditional Access is the correct Microsoft Entra capability because it allows administrators to create policies that enforce specific requirements—such as device enrollment in MDM and a PIN code—before granting access to corporate applications. By configuring a Conditional Access policy with a grant control requiring 'Require device to be marked as compliant' (which depends on MDM enrollment and PIN compliance), the administrator can block access from personal devices that do not meet these conditions.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Enterprise App Registration

Question 6

An organization uses Microsoft Entra ID Protection. A user's sign-in is flagged with a risk level of 'High' because of an anonymous IP address. The administrator wants to automatically block the sign-in while allowing the user to self-remediate. Which should be configured?

Accepted Answer

A sign-in risk policy configured to block access. A sign-in risk policy in Microsoft Entra ID Protection can be configured to automatically block access when a sign-in is detected as high risk (e.g., from an anonymous IP address). This policy operates at the sign-in level, allowing the administrator to block the sign-in while still enabling the user to self-remediate (e.g., by signing in again after the risk is mitigated). Option C directly matches this requirement.

Answer

A Conditional Access policy requiring MFA for high-risk sign-ins

Answer

A user risk policy configured to require a password change

Answer

An MFA registration policy for all users

Question 7

A company uses Microsoft Entra ID. The security team wants to configure automated actions when user sign-ins are detected as high risk due to anonymized IP addresses or leaked credentials. They need to automatically block the sign-in or force a password change based on risk level. Which Microsoft Entra ID feature should they use?

Accepted Answer

Identity Protection. Microsoft Entra ID Protection is the correct feature because it automates the detection and remediation of identity-based risks, including sign-ins from anonymized IP addresses and leaked credentials. It allows administrators to configure conditional access policies that automatically block high-risk sign-ins or force a password change based on the risk level (e.g., low, medium, high). This directly matches the security team's requirement for automated actions tied to risk detection.

Answer

Privileged Identity Management

Answer

Azure AD Connect

Answer

Self-service password reset

Question 8

A company wants to allow external business partners to access its internal applications using their own corporate credentials (e.g., their Microsoft Entra ID or Google account), without creating separate user accounts in the company's directory. Which Microsoft Entra ID feature should they use?

Accepted Answer

B2B collaboration. B2B collaboration allows the company to grant external business partners access to its internal applications using their own corporate identities (such as Microsoft Entra ID or Google accounts) without creating separate user accounts in the company's directory. It leverages federation trust and cross-tenant authentication, enabling partners to authenticate with their home organizations while accessing resources in the host tenant.

Answer

Azure AD B2C (Business-to-Consumer)

Answer

Microsoft Entra Domain Services

Answer

Conditional Access

Question 9

A company wants to improve password security across its Microsoft Entra ID tenant. The security team wants to prevent users from setting passwords that appear on Microsoft's global banned password list, which includes commonly compromised passwords. Additionally, they need to add a custom banned password containing the company name so that users cannot use variations of it. Which Microsoft Entra ID feature should they configure to enforce these password policies?

Accepted Answer

Password Protection. Password Protection in Microsoft Entra ID is the feature specifically designed to enforce both global and custom banned password lists. It prevents users from using commonly compromised passwords from Microsoft's global list and allows administrators to add custom terms, such as the company name, to block variations. This directly addresses the requirement to improve password security by blocking weak and organization-specific passwords.

Answer

Conditional Access

Answer

Identity Protection

Answer

Multi-factor authentication (MFA)

Question 10

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Accepted Answer

Verify explicitly. Options B and D are correct. Zero Trust principles include 'Verify explicitly' and 'Use least privilege access' (or 'Assume breach' and 'Verify explicitly'). Actually the official principles are: Verify explicitly, Use least privilege, Assume breach. So the correct two are B and D.

Answer

Perimeter-based security

Answer

Implicit trust

Answer

Trust but verify

Question 11

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for users who sign in from sessions that Microsoft Entra ID Protection determines to have medium or high sign-in risk. Users signing in from low-risk sessions should not be prompted for MFA. Which feature should the security team configure?

Accepted Answer

Configure a Conditional Access policy with Sign-in risk as a condition and MFA as a grant control. Option A is correct because a Conditional Access policy can use Sign-in risk (a condition from Microsoft Entra ID Protection) to require MFA as a grant control. This allows the security team to enforce MFA only for sessions with medium or high sign-in risk, while low-risk sessions are not prompted, exactly matching the requirement.

Answer

Configure a user risk policy in Microsoft Entra ID Protection

Answer

Assign the Global Administrator role with Privileged Identity Management (PIM) activation requiring MFA

Answer

Create an access review in Microsoft Entra ID Governance

Question 12

A multinational corporation uses Microsoft Entra ID. The IT department wants to allow regional IT administrators in Europe to manage users and groups only for their own region, without granting them permissions to manage users in other regions. Which Microsoft Entra ID feature should they use?

Accepted Answer

B. Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions scoped to a subset of users, groups, or devices. By creating an AU for the Europe region and assigning regional IT administrators to it, you restrict their management scope to only those objects within that AU, preventing them from managing users in other regions.

Answer

A. Conditional Access

Answer

C. Privileged Identity Management

Answer

D. Identity Governance

Question 13

A multinational organization uses Microsoft Entra ID and wants to allow employees to sign in to a custom customer-facing application using their existing social identities (e.g., LinkedIn, Google). They also need to enforce a specific terms of use agreement and be able to revoke a user's access if their social account is compromised. Which Microsoft Entra capability should they configure?

Accepted Answer

Microsoft Entra External ID (B2C). Microsoft Entra External ID (B2C) is the correct choice because it is specifically designed for customer-facing applications that need to support social identity providers (like LinkedIn and Google) via OAuth 2.0 and OpenID Connect. It allows you to enforce a custom terms of use agreement during sign-up and provides the ability to revoke a user's access by disabling their account in the B2C directory or removing the social identity mapping, which directly addresses the requirement to respond to a compromised social account.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 14

An organization decides to eliminate passwords for their employees. They deploy Windows Hello for Business on company-issued laptops, allowing users to sign in with a PIN or a biometric gesture (e.g., fingerprint). The IT team also enables Microsoft Authenticator and FIDO2 security keys as alternative sign-in methods. Which Microsoft Entra ID capability are they leveraging?

Accepted Answer

Passwordless authentication. The organization is implementing passwordless authentication by removing passwords and using Windows Hello for Business (PIN/biometrics), Microsoft Authenticator, and FIDO2 security keys. These methods replace the password with a cryptographic key pair bound to the device or user, satisfying the definition of passwordless authentication in Microsoft Entra ID.

Answer

Microsoft Entra ID Protection

Answer

Conditional Access

Answer

Self-Service Password Reset (SSPR)

Question 15

A company uses Microsoft Defender for Endpoint on all workstations and Microsoft Defender for Office 365 for email protection. The security operations team wants a single console to see all incidents from both products, automatically investigate and respond to threats across endpoints and email, and integrate with Microsoft Sentinel for advanced hunting. Which Microsoft security solution should they use?

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender is the correct solution because it provides a unified incident queue that aggregates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365, enabling automated investigation and response (AIR) across endpoints and email. It also natively integrates with Microsoft Sentinel for advanced hunting via the Microsoft 365 Defender connector, allowing the security operations team to correlate signals and perform cross-domain threat hunting.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview Compliance Portal

Answer

Microsoft Entra ID Protection

Question 16

A company wants to implement just-in-time (JIT) privileged access management for their Global Administrators in Microsoft Entra ID. They require that a user must request activation of the Global Administrator role, the request must be approved by a separate administrator, and the role will automatically expire after 4 hours. Additionally, they need an audit trail of all activations. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator on-demand, requiring approval from designated approvers, setting a maximum activation duration (e.g., 4 hours), and automatically deactivating the role upon expiry. It also maintains a full audit trail of all activations, approvals, and role assignments via the PIM audit history and Azure AD audit logs, meeting all the stated requirements.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Azure Role-Based Access Control (RBAC)

Question 17

A company uses Microsoft Entra ID. A new IT support technician is hired and needs to be able to reset passwords for users but must not be allowed to delete user accounts or modify group memberships. Which built-in Microsoft Entra ID role should be assigned to this technician?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific permissions required to reset passwords for all users, including administrators, while explicitly excluding permissions to delete user accounts or modify group memberships. This role is designed for scenarios where a technician needs to perform password-related tasks without broader user management capabilities.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Global Administrator

Question 18

A company uses Microsoft Entra ID. The security manager wants to provide temporary, time-bound elevated access to the Global Administrator role only when needed, and require approval from a designated approver. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate the Global Administrator role for a limited, time-bound duration only when needed, and it enforces approval workflows from designated approvers. This directly matches the security manager's requirement for temporary, approval-based elevation.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Identity Governance (Access Reviews)

Question 19

A company has several custom-developed web applications hosted on-premises. The company wants to provide employees with secure remote access to these applications without deploying a traditional VPN. Employees should be able to sign in using their existing Microsoft Entra ID credentials, and the solution should pass through multi-factor authentication policies. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It allows employees to sign in with their existing Microsoft Entra ID credentials and enforces conditional access policies, including multi-factor authentication, without requiring a traditional VPN.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 20

Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?

Accepted Answer

It reduces the attack surface by opening ports only when necessary. JIT network access reduces the attack surface by keeping network ports closed by default and opening them only when needed for legitimate traffic, based on user requests. It does not block all inbound traffic permanently; it allows authorized requests. It does not encrypt traffic or replace firewall rules; it complements them.

Answer

It replaces the need for network security groups

Answer

It encrypts all network traffic between the VM and clients

Answer

It permanently blocks all inbound traffic to the VM