SC-900 Mock Exam 78 — 25 Questions

Question 1

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

Accepted Answer

The user did not pass multi-factor authentication.. Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Answer

The user account is disabled.

Answer

The user's password has expired.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 2

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention, while maintaining security by requiring multi-factor authentication (MFA) during the reset process. Which feature should you enable?

Accepted Answer

Microsoft Entra self-service password reset (SSPR).. Microsoft Entra self-service password reset (SSPR) is the feature specifically designed to allow users to reset their own passwords without help desk intervention. When combined with Microsoft Entra Multi-Factor Authentication (MFA) as a registration and reset requirement, SSPR enforces MFA during the reset process, meeting both the self-service and security requirements.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra Multi-Factor Authentication.

Answer

Conditional Access policies.

Question 3

Your company uses Microsoft Entra ID and wants to automatically assign licenses to new employees based on their department. Which feature should you use?

Accepted Answer

Dynamic groups and group-based licensing. Dynamic groups in Microsoft Entra ID allow you to automatically add or remove users based on attributes like department. Combined with group-based licensing, you can assign licenses (e.g., Microsoft 365 E5) to all members of that group, so when a new employee is added with the matching department attribute, they automatically receive the correct license without manual intervention.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 4

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only devices that are enrolled in Intune and compliant with your organization's security policies can access corporate email. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces policy-based access controls that evaluate device compliance status reported by Microsoft Intune. By configuring a Conditional Access policy to require 'Device to be marked as compliant,' only devices enrolled in Intune and meeting security policies can access corporate email, leveraging the integration between Entra ID and Intune.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Terms of Use

Question 5

Refer to the exhibit. You are configuring an access package in Microsoft Entra Entitlement Management. Based on the policy, which users can request access to the HR App?

Accepted Answer

Any user in the organization can request access, but guests require manager approval.. Option A is correct because the access package policy shown in the exhibit is configured with 'For users in your directory' as the scope and 'Specific connected organization' is not selected, meaning any internal user can request. The policy also has 'Approval' set to 'Manager approval' only for 'Guest users', so internal users do not require approval, while guests do. This matches the description that any user in the organization can request, but guests need manager approval.

Answer

Only administrators can assign access.

Answer

Only users in the HR department can request access.

Answer

Only guest users can request access.

Question 6

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook, while maintaining security and compliance with conditional access policies. What should you configure?

Accepted Answer

Configure Microsoft Entra External ID with social identity providers.. Option D is correct because Microsoft Entra External ID (formerly Azure AD External Identities) allows you to configure social identity providers such as Google and Facebook as external identity sources. This enables users to sign in with their existing social media accounts while still being subject to your tenant's conditional access policies, ensuring security and compliance.

Answer

Enable Microsoft Entra Permissions Management.

Answer

Deploy Microsoft Entra Verified ID.

Answer

Configure Microsoft Entra B2B collaboration for guest users.

Question 7

Your organization wants to use Microsoft Entra Verified ID to issue digital credentials to employees. Which Microsoft Entra service provides the ability to issue and verify verifiable credentials?

Accepted Answer

Microsoft Entra Verified ID. Microsoft Entra Verified ID is the specific service designed to issue and verify verifiable credentials based on decentralized identity standards such as W3C Verifiable Credentials and Decentralized Identifiers (DIDs). It enables organizations to create, issue, and cryptographically verify digital credentials without relying on a central authority, aligning with the scenario described.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 8

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs for a user. The user successfully signed in from a mobile device running iOS, located in the US, with medium risk level. The sign-in did not require MFA. You have a Conditional Access policy that requires MFA for all users when sign-in risk is medium or higher. Why was MFA not triggered?

Accepted Answer

The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.. Option A is correct because the Conditional Access policy can be configured to exclude specific client apps, such as 'Mobile Apps and Desktop clients'. If the policy excludes these client apps, the sign-in from an iOS mobile device would not be subject to the MFA requirement, even though the sign-in risk is medium. The sign-in logs confirm MFA was not required, indicating the policy did not apply to this client app type.

Answer

The device is not compliant, so MFA was not required.

Answer

The sign-in risk level is medium, which is below the threshold.

Answer

The user is not assigned to the Conditional Access policy.

Question 9

Your organization uses Microsoft Entra ID to manage user identities. A new employee named John joins the company and needs access to Microsoft 365 apps. You want to ensure John's identity is verified using a phone call. Which authentication method should you configure?

Accepted Answer

Phone call (voice call). The question explicitly requires verification using a phone call. The Phone call (voice call) authentication method in Microsoft Entra ID delivers an automated voice call to the user's registered phone number, prompting them to press a key to confirm their identity. This directly matches the requirement, making D the correct choice.

Answer

Time-based one-time password (TOTP)

Answer

Email one-time passcode

Answer

Text message (SMS)

Answer

FIDO2 security key

Question 10

Which TWO of the following are capabilities of Microsoft Entra ID?

Accepted Answer

Identity and access management for cloud applications.. Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Answer

Email filtering and anti-malware protection.

Answer

Encryption of data at rest in Azure Storage.

Answer

Network firewall management.

Question 11

Your organization uses Microsoft Entra ID and Microsoft Sentinel. You need to analyze sign-in logs to detect risky sign-ins that are not blocked by Conditional Access policies. Which Microsoft Entra feature provides risk detection and can feed into Sentinel?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct feature because it specifically provides risk detection for sign-ins and users, including leaked credentials, anonymous IP addresses, and atypical travel. It can feed these risk detections directly into Microsoft Sentinel via a connector, enabling advanced analysis and automated response. Conditional Access policies can use Identity Protection's risk signals to block or require MFA, but Identity Protection itself identifies the risky sign-ins that policies may not block.

Answer

Microsoft Entra Verified ID

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Entitlement Management

Question 12

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 13

Your organization uses Microsoft Entra ID with P1 licenses. You need to provide a temporary access pass for a new employee to set up their account without a password. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Temporary Access Pass. The Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator that allows a user to register passwordless authentication methods (e.g., Microsoft Authenticator, FIDO2 security key) without needing an existing password. This directly meets the requirement for a new employee to set up their account without a password, and it is available with Microsoft Entra ID P1 licenses.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Verified ID

Question 14

Which THREE of the following are features of Microsoft Entra ID Protection?

Accepted Answer

Ability to define risk-based Conditional Access policies.. Option B is correct because Microsoft Entra ID Protection provides risk detection signals that can be integrated into Conditional Access policies, enabling administrators to automatically enforce controls such as requiring multi-factor authentication or blocking access based on user or sign-in risk levels. This allows organizations to respond dynamically to detected threats without manual intervention.

Answer

Automatically notify users when their password is about to expire.

Answer

Just-in-time privileged role activation.

Question 15

Your organization uses Microsoft Entra ID. Which TWO features help protect against identity-based attacks by detecting and responding to risks?

Accepted Answer

Conditional Access. Conditional Access is correct because it enforces policy-based access controls that evaluate real-time signals (e.g., user location, device compliance, sign-in risk) to block or challenge suspicious sign-in attempts, directly mitigating identity-based attacks. Identity Protection is correct because it uses machine learning to detect risk signals such as leaked credentials, anonymous IP addresses, and atypical travel, then automatically triggers remediation actions like requiring password reset or blocking access.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 16

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for all users accessing sensitive data from outside the corporate network. Which Microsoft Entra capability should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct capability because it allows administrators to define policies that enforce MFA based on specific conditions, such as network location. By configuring a policy that targets all users and applies the 'Require multi-factor authentication' grant control when the location is outside the corporate network, the security team can precisely meet the requirement. This policy evaluates the user's IP address against named locations defined in Entra ID before granting access to sensitive data.

Answer

B2B Collaboration

Answer

Privileged Identity Management

Answer

Identity Protection

Question 17

Your organization implements a Microsoft Entra ID tenant with a custom domain (contoso.com). You need to ensure that all users are assigned a unique user principal name (UPN) based on their email address. What should you do?

Accepted Answer

Configure the user naming attribute to use the email address as the UPN. Option A is correct because configuring the user naming attribute to use the email address as the UPN directly assigns each user a unique UPN that matches their email address. This setting is available in the Microsoft Entra ID tenant under 'User settings' and ensures that the UPN suffix (the domain part) aligns with the verified custom domain (contoso.com). This approach satisfies the requirement without requiring additional synchronization or domain services.

Answer

Verify the custom domain in Microsoft Entra ID

Answer

Enable Microsoft Entra ID Domain Services

Answer

Use Microsoft Entra ID Connect to sync UPNs from on-premises

Question 18

Refer to the exhibit. The JSON shows a conditional access policy in Microsoft Entra ID. A user signs in from a trusted location using a browser. Which controls will be enforced?

Accepted Answer

MFA, terms of use acceptance, sign-in frequency every 1 hour, and Cloud App Security monitoring.. Option B is correct because the conditional access policy in the exhibit grants access only when all specified conditions are met: the user is at a trusted location, the client app is a browser, and the grant controls include 'Require multi-factor authentication', 'Require terms of use acceptance', 'Sign-in frequency (every 1 hour)', and 'Use Cloud App Security for monitoring'. Since the user signs in from a trusted location using a browser, all grant controls are enforced simultaneously.

Answer

MFA, terms of use acceptance, and application enforced restrictions.

Answer

Only MFA and terms of use acceptance.

Answer

Only sign-in frequency and Cloud App Security monitoring.

Question 19

Your company is implementing a hybrid identity solution with Microsoft Entra ID. You need to ensure that password changes on-premises are synchronized to the cloud within minutes. Which feature should you enable?

Accepted Answer

Password Writeback. Password Writeback (D) is the correct feature because it enables password changes made on-premises in Active Directory to be written back to Microsoft Entra ID in near real-time, typically within minutes. This ensures that the cloud password hash is updated promptly, maintaining synchronization for hybrid identity scenarios. The other options do not handle the synchronization of password changes from on-premises to the cloud.

Answer

Password Hash Synchronization

Answer

Pass-through Authentication

Answer

Seamless Single Sign-On

Question 20

Your organization uses Microsoft Entra ID. You need to ensure that only users from the finance department can access a sensitive application, and they must be granted access dynamically based on their department attribute. What should you configure?

Accepted Answer

Create a dynamic group with rule: user.department -eq "Finance".. Option B is correct because a dynamic group in Microsoft Entra ID automatically adds or removes members based on a rule, such as `user.department -eq "Finance"`. This ensures that only users whose department attribute equals "Finance" are granted access to the sensitive application, and membership updates dynamically as the attribute changes, without manual intervention.

Answer

Create an administrative unit for the finance department.

Answer

Enable self-service group management.

Answer

Configure entitlement management with an access package for the finance application.

SC-900 Mock Exam 78 — 25 Questions

Exhibit

SC-900 Mock Exam 78 — 25 Questions

Exhibit