SC-900 Describe the capabilities of Microsoft Entra Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID for identity management. You need to allow external partners to access a specific SharePoint Online site without requiring them to have a Microsoft Entra ID account in your tenant. Which feature should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration to invite partners as guest users.. Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external partners as guest users who can access resources like SharePoint Online using their own identity (e.g., a Microsoft account or a corporate account from another identity provider) without requiring a separate Microsoft Entra ID account in your tenant. This leverages the B2B collaboration protocol, which uses SAML/WS-Federation or OIDC for federation, enabling seamless access while maintaining centralized access control.

Answer

Set up identity protection to allow external access.

Answer

Configure Microsoft Entra B2C for the partners.

Answer

Create guest user accounts for each partner.

Question 2

Your organization wants to ensure that users cannot install applications from the Microsoft Store on their company-managed Windows devices. Which Microsoft Entra ID feature should you combine with Microsoft Intune to enforce this?

Accepted Answer

Conditional Access. Option D is correct because Conditional Access can enforce device compliance policies managed by Intune, which can restrict app installations. Option A is wrong because identity protection is about risk. Option B is wrong because MFA is for authentication. Option C is wrong because privileged identity management is for admin roles.

Answer

Privileged Identity Management

Answer

Multifactor authentication

Answer

Identity Protection

Question 3

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.. Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Answer

Require all users to register for Microsoft Entra MFA.

Answer

Configure Microsoft Entra password protection.

Answer

Implement Privileged Identity Management (PIM).

Question 4

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Accepted Answer

Identity as a Service (IDaaS) for cloud applications. Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Answer

Antivirus and antimalware protection

Answer

Provide network firewall services

Answer

Manage mobile devices and applications

Question 5

Which THREE of the following are features of Microsoft Entra ID Governance? (Select three.)

Accepted Answer

Access reviews. Access reviews are a core feature of Microsoft Entra ID Governance, enabling administrators to periodically review and certify user access rights to ensure they remain appropriate. This supports compliance, security, and lifecycle management by automating attestation workflows.

Answer

Self-service password reset

Answer

Multifactor authentication

Question 6

Which TWO of the following are supported identity types for Microsoft Entra External ID? (Select two.)

Accepted Answer

Social identities (e.g., Google, Facebook). Microsoft Entra External ID supports social identities (like Google and Facebook) as external identity providers, allowing users to sign in with their existing social accounts. This is a core feature of External ID, enabling B2B and B2C scenarios without requiring users to create new Microsoft accounts.

Answer

OAuth 2.0 token identities

Answer

X.509 certificate-based identities

Answer

Biometric identities (fingerprint, face)

Question 7

Which THREE of the following are capabilities provided by Microsoft Entra ID Protection? (Select three.)

Accepted Answer

Automated investigation and remediation of identity risks. Option A is correct because Microsoft Entra ID Protection includes automated investigation and remediation capabilities that respond to detected identity risks. When a risk is identified, such as a compromised user account, the service can automatically trigger actions like requiring a password reset or blocking sign-in attempts, reducing the need for manual intervention.

Answer

Passwordless authentication options

Answer

Device compliance assessment

Question 8

Which TWO of the following are types of identities that can be managed in Microsoft Entra ID? (Select two.)

Accepted Answer

User identities. Option B is correct because user identities represent individual users who need access to resources, and they are the most fundamental identity type in Microsoft Entra ID. Option C is correct because service principal identities (application identities) are used to represent applications and automated tools, enabling them to authenticate and access resources securely.

Answer

Group objects

Answer

Policy objects

Answer

Device objects

Question 9

Your organization uses Microsoft Entra ID to allow users to access cloud applications. You need to ensure that any sign-in from a known malicious IP address is blocked. Which feature should you configure?

Accepted Answer

Conditional Access policy with a location condition. Conditional Access policies in Microsoft Entra ID allow you to enforce access controls based on conditions such as the user's location or IP address. By configuring a location condition that includes known malicious IP addresses, you can block sign-ins from those IPs. This is the correct feature because it directly evaluates the network location at sign-in time and applies a block grant control.

Answer

Privileged Identity Management

Answer

Self-service password reset

Answer

Identity Protection risk policy

Question 10

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Answer

Self-Service Password Reset (SSPR)

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 11

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user passwords and enable password writeback for self-service password reset. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync (formerly Azure AD Connect) is the correct tool because it synchronizes on-premises Active Directory objects, including password hashes, to Microsoft Entra ID and supports password writeback, which enables self-service password reset (SSPR) to write changed passwords back to on-premises AD. The question specifically requires both password synchronization and writeback, which are core features of Entra Connect Sync.

Answer

Microsoft Entra admin center

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Connect (deprecated)

Question 12

You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?

Accepted Answer

A decentralized identifier (DID) for your organization. Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.

Answer

A public key infrastructure (PKI) certificate

Answer

A custom application registered in Microsoft Entra ID

Answer

A blockchain node for the decentralized ledger

Question 13

Your organization uses Microsoft Entra ID Governance. You need to ensure that guest users' access to internal applications is automatically removed after 90 days. What should you configure?

Accepted Answer

Access reviews. Access reviews in Microsoft Entra ID Governance allow you to configure recurring reviews of guest user access to internal applications. By creating an access review with a duration of 90 days and enabling automatic removal of denied users, you ensure that guest access is automatically revoked after the review period ends. This directly meets the requirement for time-based automatic removal.

Answer

Entitlement management

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 14

Your company uses Microsoft Entra ID with P2 licenses. You want to require approval for users to activate the Global Administrator role. Which feature should you configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time privileged access, including the ability to require approval for role activation. By configuring PIM for the Global Administrator role, you can enforce that users must request activation and receive approval before gaining the role's permissions, ensuring least-privilege and auditability.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access reviews

Question 15

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

Accepted Answer

Permissions Analytics Report. Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Answer

Audit trail

Answer

Identity governance

Answer

Activity trail