SC-900 Describe the capabilities of Microsoft Entra Practice Test 11 — 15 Questions

Question 1

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

Accepted Answer

SAML 2.0. SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Answer

OAuth 2.0

Answer

SCIM

Answer

OpenID Connect

Question 2

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

Accepted Answer

MFA registration campaign. The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Answer

Identity Protection

Answer

Conditional Access

Answer

Security defaults

Question 3

Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?

Accepted Answer

Global Secure Access. Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.

Answer

Conditional Access

Answer

DDoS protection

Answer

Network segmentation

Question 4

Which TWO Microsoft Entra features can be used to enforce multifactor authentication (MFA)?

Accepted Answer

Security defaults. Security defaults is a baseline security policy that Microsoft automatically enables for eligible tenants, enforcing MFA registration and requiring MFA for all users during sign-in. It provides a simple, pre-configured way to enforce MFA without requiring additional licensing or configuration of Conditional Access policies.

Answer

Self-Service Password Reset

Answer

Identity Protection

Answer

Privileged Identity Management

Question 5

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 6

Which TWO authentication methods in Microsoft Entra ID support passwordless sign-in?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method in Microsoft Entra ID that uses biometric or PIN-based credentials tied to a user's device, leveraging asymmetric key pairs to authenticate without transmitting a password. It is considered passwordless because the user signs in with a gesture (e.g., fingerprint or PIN) that unlocks a private key stored in hardware, eliminating the need for a shared secret.

Answer

Certificate-based authentication

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 7

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

Accepted Answer

Block legacy authentication protocols. The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Answer

Require MFA for all applications

Answer

Disable the policy for emergency access

Answer

Allow only iOS devices

Question 8

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

Accepted Answer

Create a Conditional Access policy requiring compliant device. The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Answer

Reset the user's password

Answer

Block all personal devices

Answer

Enable MFA for the user

Question 9

Refer to the exhibit. User2 attempts to activate the Global Administrator role. What must happen before User2 gains the role?

Accepted Answer

An approver defined in PIM must approve the request. User2 is attempting to activate the Global Administrator role via Privileged Identity Management (PIM). In PIM, role activation requires approval from a designated approver (User3 in this scenario) before the role is granted. Option B correctly identifies that an approver defined in PIM must approve the request, which is the required step for activation.

Answer

User3 must approve the activation request

Answer

User1 must approve the activation request

Answer

User2 must pass MFA

Question 10

A company wants to allow its partners to access a specific SharePoint Online site using their own corporate credentials. The company does not want to manage partner accounts. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows organizations to grant external partners access to resources like SharePoint Online using their own corporate or social identities. This eliminates the need to create and manage separate user accounts for partners, as they authenticate through their home identity provider via federation or invitation redemption.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 11

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

Accepted Answer

Microsoft Entra ID Governance Lifecycle Workflows. Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Terms of Use

Question 12

A user reports that they cannot access Microsoft 365 apps from a public Wi-Fi network. The admin sees a Conditional Access policy requiring a compliant device and a trusted location. Which component enforces this policy?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the policy engine that evaluates conditions (e.g., location, device compliance) and enforces access decisions. When a user attempts to access Microsoft 365 apps, the Conditional Access policy is evaluated by Microsoft Entra ID, which then blocks or grants access based on the policy rules. The policy itself is defined in Microsoft Entra Conditional Access, but the enforcement point is the Microsoft Entra ID authentication and authorization service.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 13

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra Self-Service Password Reset. Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 14

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

Accepted Answer

SAML-based single sign-on. D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Answer

Kerberos delegation

Answer

OpenID Connect authentication

Answer

SCIM-based user provisioning

Question 15

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Identity Protection. Option A is correct because Identity Protection uses risk detection to block suspicious sign-ins from known malicious IP addresses. Option B is wrong because SSPR deals with password reset. Option C is wrong because MFA adds verification but does not automatically block based on IP. Option D is wrong because PIM manages admin roles.

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication