SC-900 Describe the capabilities of Microsoft Entra — 20 Questions

Question 1

A security team is using Microsoft Entra ID Protection. They want to automatically block sign-ins from known malicious IP addresses, but if a user's account is compromised (e.g., leaked credentials), they want to force the user to change their password upon next sign-in. Which two risk policies should they configure? (Select all that apply.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sign-in risk policy set to 'Block access' for High risk. The sign-in risk policy in Microsoft Entra ID Protection can be configured to automatically block access when a sign-in is detected as high risk, such as from a known malicious IP address. This policy evaluates real-time risk signals during authentication and enforces the specified action (e.g., 'Block access'). The user risk policy, on the other hand, evaluates the cumulative risk of a user account (e.g., leaked credentials) and can be configured to require a password change upon next sign-in for high-risk users.

Answer

MFA registration policy

Answer

Conditional Access policy with a custom block rule

Question 2

A company uses Microsoft Entra ID (Azure AD). The security team wants to create a Conditional Access policy that meets the following requirements: - Require multi-factor authentication (MFA) when users access a sensitive financial application from an untrusted network. - Additionally, require that the device accessing the app is compliant with company policies (e.g., encryption enabled). Which two conditions should the team configure in the Conditional Access policy? (Choose two.)

Accepted Answer

Location. Both (Location) and (Device state) are correct. (Location) is correct because the policy requires MFA when users access the sensitive financial application from an untrusted network. In Microsoft Entra ID Conditional Access, the Location condition uses named locations (such as trusted IP ranges or countries) to determine whether a network is trusted or untrusted, enabling the policy to trigger MFA only when access originates from an untrusted location. (Device state) is correct because the policy requires that the device accessing the app is compliant with company policies. The Device state condition allows you to enforce requirements like 'Require device to be marked as compliant' or 'Require Hybrid Azure AD joined device'.

Answer

Sign-in risk

Answer

Application

Question 3

A company wants to allow external customers to sign in to a custom web application using their existing Google or Facebook accounts. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID B2C. Microsoft Entra ID B2C (Business-to-Consumer) is the correct feature because it is specifically designed for customer-facing applications that need to support external identity providers like Google and Facebook. It allows users to sign in with their existing social accounts via OAuth 2.0 and OpenID Connect protocols, while providing customizable user journeys and branding. This is distinct from B2B collaboration, which is intended for business partner access to enterprise resources.

Answer

Microsoft Entra ID B2B collaboration

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 4

A company uses Microsoft Entra ID. They want to implement two security baseline requirements: (1) Users must register for multifactor authentication (MFA) before they can use self-service password reset (SSPR). (2) Administrators must have just-in-time (JIT) access to Azure resources with approval required. Which two Microsoft Entra features should they use? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct feature for requirement (2) because it provides just-in-time (JIT) access to Azure resources, requiring approval for role activation. PIM allows administrators to request time-bound, approved elevation of privileges, meeting the JIT and approval requirement exactly. Combined registration for SSPR and MFA is the correct feature for requirement (1) as it unifies the registration experience for both, ensuring that users register for MFA when they register for SSPR, thereby meeting the prerequisite that MFA registration occurs before SSPR can be fully utilized.

Answer

Identity Protection

Answer

Conditional Access

Question 5

You are a consultant helping a client migrate from on-premises Active Directory to Microsoft Entra ID. The client has a large number of user accounts and wants to synchronize identities while allowing users to use their existing on-premises passwords. Which tool should you recommend?

Accepted Answer

Microsoft Entra Connect with password hash synchronization. Microsoft Entra Connect with password hash synchronization (PHS) is the correct tool because it synchronizes user identities from on-premises Active Directory to Microsoft Entra ID and allows users to keep their existing on-premises passwords by hashing and syncing password hashes to the cloud. This meets the client's requirement for identity synchronization without requiring password changes or additional infrastructure.

Answer

Microsoft Entra Connect Sync (older version)

Answer

Microsoft Graph API with custom sync script

Answer

Microsoft Entra Connect Provisioning Agent

Question 6

Your organization wants to ensure that users cannot install applications from the Microsoft Store on their company-managed Windows devices. Which Microsoft Entra ID feature should you combine with Microsoft Intune to enforce this?

Accepted Answer

Conditional Access. Conditional Access (A) is the correct feature because it is the Microsoft Entra ID capability that integrates with Microsoft Intune's device compliance. While Intune directly enforces device restrictions, such as blocking the Microsoft Store, Conditional Access policies can be configured to require devices to be marked as compliant by Intune before allowing access to corporate resources. This ensures that users on devices that do not adhere to all organizational policies (e.g., if the Microsoft Store is not blocked as per Intune policy) are prevented from accessing sensitive data, thereby reinforcing the overall security posture. The other options do not provide this integration for device-level policy enforcement.

Answer

Privileged Identity Management

Answer

Multifactor authentication

Answer

Identity Protection

Question 7

Which THREE of the following are features of Microsoft Entra ID Governance? (Select three.)

Accepted Answer

Access reviews. Microsoft Entra ID Governance focuses on managing identity and access lifecycle, ensuring the right people have the right access to the right resources at the right time.

**Access reviews** are a core feature, enabling administrators to periodically review and certify user access rights to ensure they remain appropriate. This supports compliance, security, and lifecycle management by automating attestation workflows.

**Privileged Identity Management (PIM)** is another key feature, helping organizations manage, control, and monitor access to important resources in Microsoft Entra ID, Azure, and other Microsoft online services. It provides just-in-time access and role activation.

**Entitlement management** allows organizations to manage identity and access lifecycle at scale by automating access requests, approvals, and provisioning for various resources, including groups, applications, and SharePoint sites.

Answer

Self-service password reset

Answer

Multifactor authentication

Question 8

Which TWO of the following are supported identity types for Microsoft Entra External ID? (Select two.)

Accepted Answer

Social identities (e.g., Google, Facebook). Microsoft Entra External ID supports social identities (like Google and Facebook) as external identity providers, allowing users to sign in with their existing social accounts. This is a core feature of External ID, enabling B2B and B2C scenarios without requiring users to create new Microsoft accounts. Additionally, External ID supports enterprise identities from other organizations that use SAML/WS-Federation identity providers, facilitating B2B collaboration by allowing partners to use their existing corporate credentials.

Answer

OAuth 2.0 token identities

Answer

X.509 certificate-based identities

Answer

Biometric identities (fingerprint, face)

Question 9

Which THREE of the following are types of identities that can be managed in Microsoft Entra ID? (Select three.)

Accepted Answer

User identities. User identities represent individual users who need access to resources, and they are the most fundamental identity type in Microsoft Entra ID. Service principal identities (application identities) are used to represent applications and automated tools, enabling them to authenticate and access resources securely. Device identities represent devices such as Windows, macOS, iOS, and Android endpoints that are registered or joined to Microsoft Entra ID and can be authenticated and managed.

Answer

Group objects

Answer

Policy objects

Question 10

Your organization uses Microsoft Entra ID to allow users to access cloud applications. You need to ensure that any sign-in from a known malicious IP address is blocked. Which feature should you configure?

Accepted Answer

Identity Protection risk policy. Identity Protection in Microsoft Entra ID includes a built-in detection for 'Sign-ins from malicious IP addresses,' which leverages Microsoft's global threat intelligence to identify and flag risky sign-ins. To block these sign-ins, you configure an Identity Protection risk policy (which is a type of Conditional Access policy) to block users when their sign-in risk level (triggered by the malicious IP detection) reaches a certain threshold. This is the most direct and automated feature for addressing sign-ins from dynamically identified malicious IP addresses.

Answer

Privileged Identity Management

Answer

Self-service password reset

Answer

Conditional Access policy with a location condition

Question 11

Your organization uses Microsoft Entra ID Governance. You need to ensure that guest users' access to internal applications is automatically removed after 90 days. What should you configure?

Accepted Answer

Entitlement management. Microsoft Entra ID Governance's Entitlement Management allows you to define access packages with specific policies, including an expiration date for assignments. By configuring an access package to grant access to the internal applications and setting its assignment policy to expire after 90 days, guest users' access will be automatically revoked at the end of that period. This directly fulfills the requirement for time-based automatic removal after 90 days.

Answer

Access reviews

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 12

Which TWO Microsoft Entra features can be used to enforce multifactor authentication (MFA)?

Accepted Answer

Security defaults. Security defaults is a baseline security policy that Microsoft automatically enables for eligible tenants, enforcing MFA registration and requiring MFA for all users during sign-in. It provides a simple, pre-configured way to enforce MFA without requiring additional licensing or configuration of Conditional Access policies. Conditional Access policies provide granular control to enforce MFA based on various conditions such as user, group, location, device state, and application, allowing organizations to define specific scenarios where MFA is required.

Answer

Self-Service Password Reset

Answer

Identity Protection

Answer

Privileged Identity Management

Question 13

Which TWO authentication methods in Microsoft Entra ID support passwordless sign-in?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method in Microsoft Entra ID that uses biometric or PIN-based credentials tied to a user's device, leveraging asymmetric key pairs to authenticate without transmitting a password. It is considered passwordless because the user signs in with a gesture (e.g., fingerprint or PIN) that unlocks a private key stored in hardware, eliminating the need for a shared secret. FIDO2 security keys are also a passwordless authentication method, using public-key cryptography where the user authenticates by interacting with a physical security key (e.g., touch, PIN on the key), which then performs cryptographic operations to prove identity without ever sending a password to the server.

Answer

Certificate-based authentication

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 14

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management is a core feature of Microsoft Entra ID Governance that enables organizations to manage the lifecycle of access rights across internal and external users. It automates access requests, approvals, and assignments through configurable access packages, ensuring that users have the right access for the right duration. Access Reviews are also a critical component, allowing organizations to periodically review users' access to resources to ensure only authorized individuals maintain access, thereby preventing 'access sprawl' and enforcing the principle of least privilege. Both features directly support governance by enforcing policies for who gets access, for how long, and under what conditions, with periodic verification.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 15

Which THREE are benefits of using Microsoft Entra ID as an identity provider? (Choose three.)

Accepted Answer

Conditional Access policies. Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service. Conditional Access policies (B) are a core feature that allow you to enforce access controls based on signals like user, location, and device state, making it a direct benefit of using Entra ID as an identity provider. Multifactor authentication (D) is another key security feature provided by Entra ID, adding an extra layer of security beyond just a password. Single sign-on (E) is a primary benefit, allowing users to access thousands of cloud applications with a single set of credentials, improving user experience and reducing password fatigue.

Answer

Web application hosting

Answer

Centralized database management

Question 16

A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?

Accepted Answer

Sign-in logs. Sign-in logs provide detailed information about every sign-in attempt, including whether Conditional Access policies were applied, which policies were triggered, and the outcome (success or failure). When a user reports they cannot access an app and a Conditional Access policy is suspected, reviewing the sign-in logs for that user's attempts will directly show if a policy blocked access and why, making it the primary diagnostic tool for an existing issue.

Answer

My Apps portal

Answer

Conditional Access 'What If' tool

Answer

Audit logs

Question 17

An administrator notices that some users are being prompted for MFA even though they are inside the corporate network. The Conditional Access policy includes a condition for 'All locations' except trusted IPs. What is the most likely cause?

Accepted Answer

The corporate network's public IP address is not added to the trusted IPs list. If the corporate network's public IP is not added to the trusted IPs list, users inside the network will be prompted for MFA because the location is not recognized as trusted. Option A is correct. Option B is wrong because whether users have registered for MFA or not doesn't explain *why* the Conditional Access policy is triggering MFA for them when they are inside the corporate network and the policy is configured to exclude trusted IPs. The issue is about the policy's location condition, not the user's MFA registration status. Option C is wrong because if users are not assigned to the policy (even via a nested group), the policy would not apply to them at all, and they wouldn't be prompted for MFA by this policy. If they *are* assigned, this option doesn't explain why the 'except trusted IPs' condition isn't working as expected. Option D is wrong because session controls are typically applied after authentication or during the session and do not directly cause MFA prompts based on location conditions.

Answer

The users have not registered for MFA

Answer

The users are not assigned to the policy but are in a nested group

Answer

The Conditional Access policy has session controls enabled

Question 18

Which THREE are valid authentication methods in Microsoft Entra ID?

Accepted Answer

FIDO2 security keys. FIDO2 security keys provide passwordless, phishing-resistant authentication using public-key cryptography, making them a strong primary method. Password authentication remains a fundamental and widely used method for signing into Microsoft Entra ID. The Microsoft Authenticator app supports various primary authentication methods, including passwordless phone sign-in and number matching, offering a secure and convenient way to sign in. SMS-based verification is typically used as a secondary factor for multi-factor authentication or password reset, not as a standalone primary sign-in method. Physical smart cards, while usable in hybrid environments, generally require federation services (like AD FS) and are not considered native, cloud-only primary authentication methods directly within Microsoft Entra ID.

Answer

Smart card (physical)

Answer

SMS-based verification

Question 19

You are reviewing a Conditional Access policy JSON:

{
  "displayName": "Require MFA or compliant device for Office 365 from untrusted locations",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["Office365"]
    },
    "locations": {
      "includeLocations": ["All"],
      "excludeLocations": ["AllTrusted"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa", "compliantDevice"]
  }
}

What is the result of this policy?

Accepted Answer

Users from untrusted locations must complete MFA or use a compliant device to access Office 365. The policy JSON grants access to Office 365 if the user is from an untrusted location and either completes MFA or uses a compliant device. This matches option B exactly. The 'OR' condition between MFA and compliant device is key, and the scope is limited to Office 365, not all cloud apps.

Answer

All users must complete MFA to access all cloud apps

Answer

Users must complete MFA and use a compliant device from all locations

Answer

Users from trusted locations must complete MFA and use a compliant device

Question 20

You are analyzing a PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. What is the duration of the activation?

Accepted Answer

4 hours. By default, the activation duration for a PIM role is 4 hours. While the maximum allowed activation duration for any role, including Global Administrator, is 8 hours, the system's default setting is 4 hours if no custom configuration is applied. Highly privileged roles like Global Administrator are often configured with an 8-hour maximum by organizations, but the system default is 4 hours.

Answer

8 hours

Answer

8 minutes

Answer

8 days