SC-900 Describe the capabilities of Microsoft Entra Practice Test 10 — 15 Questions

Question 1

A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant - Require MFA and Require terms of use. The Grant control in Conditional Access allows you to require multiple conditions to be satisfied before granting access. By selecting both 'Require MFA' and 'Require terms of use' under Grant, the policy enforces that the user must complete both MFA and accept the terms of use when accessing the HR portal from an unmanaged device. This directly meets the requirement for both authentication and consent.

Answer

Session control - Use app enforced restrictions

Answer

Grant - Require approved client app

Answer

Session control - Sign-in frequency

Question 2

A multinational organization uses Microsoft Entra ID and wants to allow employees to sign in to a custom customer-facing application using their existing social identities (e.g., LinkedIn, Google). They also need to enforce a specific terms of use agreement and be able to revoke a user's access if their social account is compromised. Which Microsoft Entra capability should they configure?

Accepted Answer

Microsoft Entra External ID (B2C). Microsoft Entra External ID (B2C) is the correct choice because it is specifically designed for customer-facing applications that need to support social identity providers (like LinkedIn and Google) via OAuth 2.0 and OpenID Connect. It allows you to enforce a custom terms of use agreement during sign-up and provides the ability to revoke a user's access by disabling their account in the B2C directory or removing the social identity mapping, which directly addresses the requirement to respond to a compromised social account.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 3

A company uses Microsoft Entra ID. Employees often forget their passwords and contact the IT helpdesk to reset them. The company wants to reduce helpdesk costs by allowing users to reset their own passwords using a verified mobile phone number or email address. Which Microsoft Entra ID feature should the administrator enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without helpdesk intervention, using a verified mobile phone number or email address as authentication methods. This directly reduces helpdesk costs by shifting password reset responsibility to the user, while maintaining security through verification of registered contact methods.

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 4

A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Microsoft Entra Verified ID

Question 5

A company uses Microsoft Entra ID and wants to automate the lifecycle of guest users. When a contractor's project ends, the guest account should be automatically blocked and then removed after 30 days. Which Microsoft Entra capability should they configure to manage this process?

Accepted Answer

Entitlement Management. Entitlement Management in Microsoft Entra ID Governance allows organizations to automate the lifecycle of external identities, including guest users. By configuring an access package with a specific expiration policy (e.g., 30 days after project end), the system can automatically block and then remove the guest account when the entitlement expires, without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Governance

Question 6

A company uses Microsoft Entra ID and Intune to manage devices. They want to enforce a policy that allows access to financial data from SharePoint Online only when the user's device is compliant (e.g., encrypted, patched) AND the user authenticates from a trusted IP address range. Additionally, if the sign-in risk is assessed as medium or high by Identity Protection, the user must also perform multifactor authentication (MFA). Which Conditional Access components should the administrator configure?

Accepted Answer

Configure conditions for sign-in risk and locations, and use Grant controls to require MFA and device compliance.. Conditional Access in Microsoft Entra ID allows combining multiple conditions (sign-in risk, locations) with grant controls (require MFA, require device compliance) to enforce the described policy. The administrator configures conditions for sign-in risk (medium/high) and locations (trusted IP range), then uses Grant controls to require MFA and device compliance, ensuring access is allowed only when all requirements are met.

Answer

Configure a session control to require device compliance and an assignment for sign-in risk to trigger MFA.

Answer

Use Microsoft Entra ID Protection to automatically enforce MFA and device compliance for all users regardless of location.

Answer

Configure a compliance policy in Intune and link it directly to SharePoint Online to block non-compliant devices.

Question 7

A company has many guest users in Microsoft Entra ID who collaborate on a project in a specific SharePoint site. The compliance team needs to periodically verify that these guest users still require access to the site. If a reviewer does not respond within 30 days, the guest's access should be automatically removed. Additionally, the company wants to ensure that once access is removed, the guest user object is eventually deleted from the directory after 90 days. Which Microsoft Entra Identity Governance features should they use together?

Accepted Answer

Access Reviews configured to auto-apply results and delete guest users after a specified number of days. Access Reviews in Microsoft Entra ID can be configured to automatically apply results, removing guest access when a reviewer does not respond within a specified period (e.g., 30 days). Additionally, the 'Delete guest users not reviewed within' setting allows automatic deletion of the guest user object from the directory after a configurable number of days (e.g., 90 days). This directly meets both requirements: periodic verification of access and eventual cleanup of the directory object.

Answer

Entitlement Management access packages with an expiration policy

Answer

Lifecycle Workflows to schedule a periodic task

Answer

Privileged Identity Management (PIM) for guest roles

Question 8

A company wants to provide secure external access to a partner application without creating user accounts manually. They need to allow partners to authenticate using their existing corporate identities (e.g., from other organizations) and configure policies for access. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID (B2B collaboration). Microsoft Entra External ID (B2B collaboration) allows organizations to securely share applications and resources with external partners by letting them authenticate using their own corporate identities (e.g., from other Microsoft Entra ID tenants, Microsoft accounts, or social identity providers). It eliminates the need to manually create and manage user accounts for partners, while enabling you to apply conditional access policies for granular control over external access.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Domain Services

Question 9

A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require multi-factor authentication. The scenario explicitly requires multifactor authentication (MFA) when a user accesses the finance application from an unmanaged device. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control enforces MFA as part of the policy, directly meeting this requirement. Option B is correct because the scenario also requires blocking access if the sign-in risk level is high. The 'Block access' grant control is the appropriate control to deny authentication when a high-risk sign-in is detected, as it overrides any other grant controls.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Question 10

A company with Microsoft 365 wants employees to access corporate applications from their personal Android and iOS devices. The security team requires that these devices be enrolled in mobile device management (MDM) for compliance policies, and that company data can be selectively wiped from the device without affecting personal data. Which Microsoft Entra device identity type should they configure for these personal devices?

Accepted Answer

Microsoft Entra registered. Microsoft Entra registered is the correct device identity type for personal (BYOD) devices because it supports enrollment in MDM for compliance policies and enables selective wipe of company data without affecting personal data. This identity type registers the device with Entra ID without requiring organizational ownership, allowing users to access corporate applications while maintaining personal data separation.

Answer

Microsoft Entra joined

Answer

Microsoft Entra hybrid joined

Answer

Microsoft Entra managed

Question 11

A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device state, Locations, and Sign-in risk. The scenario requires three distinct conditions: device compliance (Device state), trusted network locations (Locations), and high sign-in risk (Sign-in risk). Conditional Access policies in Microsoft Entra ID allow combining these assignments to enforce granular access controls. Only by including all three can the administrator block access when the user's sign-in risk is high, while also requiring a managed device and trusted IP range.

Answer

Only Device state and Locations

Answer

Only Sign-in risk and Device state

Answer

Only Locations and Sign-in risk

Question 12

A company uses Microsoft Entra ID. The security team wants to automatically detect user behaviors that indicate possible compromise, such as leaked credentials, impossible travel, or anomalous login patterns. When a user is determined to be at high risk, the system should automatically require the user to reset their password the next time they sign in. Which Microsoft Entra capability should they use?

Accepted Answer

Identity Protection. Identity Protection is the correct Microsoft Entra capability because it is specifically designed to automatically detect risky user behaviors such as leaked credentials, impossible travel, and anomalous sign-in patterns. It assigns a risk level to users and sign-ins, and can be configured with a Conditional Access policy to enforce actions like requiring a password reset at next sign-in when a user is deemed high risk. This directly matches the security team's requirement for automated detection and remediation.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Question 13

A company uses Microsoft Entra ID. The security team needs to grant temporary elevated access to the Global Administrator role for a specific task, such as configuring a new security policy. They want the user to request activation, which is then approved by a manager, and the privileges automatically expire after 4 hours. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing users to request activation of roles like Global Administrator. The activation can require approval from a manager and is automatically deactivated after a configurable maximum duration (e.g., 4 hours), directly meeting the security team's requirements.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)

Question 14

A company uses Microsoft Entra ID and wants to enable employees to reset their own passwords without needing to contact the help desk. They want to enforce multifactor authentication when the employee performs the reset. Which Microsoft Entra feature should they enable?

Accepted Answer

Microsoft Entra Self-Service Password Reset (SSPR). Microsoft Entra Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention, and it can be configured to require multifactor authentication (MFA) during the reset process. This aligns directly with the scenario of enabling self-service password changes while enforcing MFA for security.

Answer

Microsoft Entra ID Federation

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 15

A company wants employees to be able to access corporate applications from their personal mobile devices, but only if those devices are enrolled in mobile device management (MDM) and have a PIN code set. Which Microsoft Entra capability should the administrator use to enforce these requirements?

Accepted Answer

Conditional Access. Conditional Access is the correct Microsoft Entra capability because it allows administrators to create policies that enforce specific requirements—such as device enrollment in MDM and a PIN code—before granting access to corporate applications. By configuring a Conditional Access policy with a grant control requiring 'Require device to be marked as compliant' (which depends on MDM enrollment and PIN compliance), the administrator can block access from personal devices that do not meet these conditions.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Enterprise App Registration