SC-900 Describe the capabilities of Microsoft Entra Practice Test 12 — 15 Questions

Question 1

A company uses Microsoft Entra ID and wants to enforce multifactor authentication (MFA) for all users accessing a sensitive customer relationship management (CRM) application, but only when the access request originates from outside the corporate network. Which component of a Conditional Access policy should the administrator configure to specify this location-based requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditions. The 'Conditions' section of a Conditional Access policy allows administrators to define the circumstances under which the policy is applied, including the location from which an access request originates. By configuring a location condition, you can specify that MFA is enforced only when users access the CRM application from outside the corporate network, using named locations or IP ranges. This is the correct component to enforce the location-based requirement.

Answer

Assignments

Answer

Grant controls

Answer

Session controls

Question 2

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 90 days on trusted devices, but force MFA for every sign-in on untrusted devices. Which Conditional Access session control must they configure to meet this requirement?

Accepted Answer

Sign-in frequency. Sign-in frequency is the Conditional Access session control that allows administrators to define the time interval after which a user must re-authenticate, even on a trusted device. By setting the sign-in frequency to 90 days for trusted devices and requiring re-authentication for every sign-in on untrusted devices (by setting the frequency to 0 or 1), the requirement is met. This control directly manages the re-prompt interval for MFA, independent of the session token lifetime.

Answer

Application enforced restrictions

Answer

Use app enforced restrictions

Answer

Persistent browser session

Question 3

A multinational organization uses Microsoft Entra ID. The IT help desk team is responsible for password resets and group management, but only for users located in the European region. The organization has created a group containing all European user accounts. Which Microsoft Entra feature should an administrator use to delegate these administrative tasks specifically to the help desk team, limited to the European user scope?

Accepted Answer

Administrative units. Administrative units (AUs) in Microsoft Entra ID allow administrators to delegate administrative permissions scoped to a specific subset of users, groups, or devices. By creating an AU containing only the European user group, the administrator can assign the help desk team roles (e.g., Helpdesk Administrator or User Administrator) limited to that AU, ensuring they can perform password resets and group management only for European users.

Answer

Access reviews

Answer

Conditional Access

Answer

Self-service password reset (SSPR)

Question 4

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 30 days on devices that are marked as compliant, but require MFA for every sign-in attempt on non-compliant devices. Which Conditional Access control should they configure to meet this requirement?

Accepted Answer

Session control: Sign-in frequency. The requirement specifies different MFA frequency based on device compliance: every 30 days for compliant devices and every sign-in for non-compliant devices. This is achieved by configuring a Session control called 'Sign-in frequency' in a Conditional Access policy, which allows administrators to set the reauthentication interval (e.g., 30 days) and can be scoped to specific conditions like device state (compliant vs. non-compliant). Grant controls like 'Require MFA' enforce MFA but do not control the frequency of re-prompting.

Answer

Grant control: Require MFA

Answer

Conditions: Device state

Answer

Session control: Application restrictions

Question 5

A company uses Microsoft Entra ID. They want to ensure that only users with a specific role can reset passwords for other users in their organization. Which feature should they use?

Accepted Answer

Administrative Units. Administrative Units allow you to delegate administrative tasks, such as password resets, to users who have a specific role scoped to a subset of users. By assigning the Helpdesk Administrator role to an Administrative Unit, you ensure that only those users can reset passwords for members of that unit, meeting the requirement precisely.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Identity Protection

Question 6

A company uses Microsoft Entra ID. They want to enforce multifactor authentication (MFA) for all access to a sensitive HR application. However, they only want to require MFA when the sign-in risk is assessed as medium or high, and block access if the risk is high. Which Conditional Access components must the administrator configure to meet these requirements? (Choose the best answer)

Accepted Answer

Conditions (Sign-in risk) and Grant controls (Require multifactor authentication, Block access). The scenario requires evaluating sign-in risk as a condition, which is configured under Conditions (Sign-in risk) in Conditional Access. The Grant controls then enforce 'Require multifactor authentication' for medium/high risk and 'Block access' for high risk, directly matching the requirements.

Answer

Assignments (Users and cloud apps) and Session controls (Sign-in frequency)

Answer

Conditions (Device platforms) and Grant controls (Require approved client app)

Answer

Grant controls (Require multifactor authentication) and Session controls (Application enforce restrictions)

Question 7

An organization uses Microsoft Entra ID. They want to automatically detect when a user's sign-in shows a high risk of compromise (e.g., impossible travel, anonymous IP address) and immediately require the user to reset their password. Which Microsoft Entra capability should they use?

Accepted Answer

Identity Protection. B is correct because Microsoft Entra ID Identity Protection uses machine learning to detect risk signals such as impossible travel and anonymous IP addresses. When a user's sign-in is flagged as high risk, Identity Protection can be configured to automatically trigger a password reset as a remediation action, enforcing the principle of least privilege and reducing the window of compromise.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Access Reviews

Question 8

A company uses Microsoft Entra ID and wants to enforce multifactor authentication (MFA) for all users accessing a sensitive customer relationship management (CRM) application, but only when the access request originates from outside the corporate network. Which component of a Conditional Access policy should the administrator configure to specify this location-based requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Self-Service Password Reset (SSPR) settings. Self-Service Password Reset (SSPR) settings in Microsoft Entra ID include a configuration option to require users to register for multifactor authentication (MFA) before they can use SSPR. By enabling the 'Require users to register when they sign in' setting under SSPR, the administrator ensures that only MFA-registered users can reset their own passwords, meeting the requirement without additional policies.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management

Question 9

A company has a hybrid identity environment with Active Directory synchronizing to Microsoft Entra ID. They want users to be able to reset their own on-premises passwords via the cloud SSPR portal. What is the minimum license required for this capability?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 is the minimum license required for password writeback, which enables users to reset their on-premises Active Directory passwords via the cloud SSPR portal. This feature requires Microsoft Entra ID P1 or higher because it involves synchronizing password changes back to on-premises AD using Microsoft Entra Connect.

Answer

Microsoft Entra ID Free

Answer

Microsoft Entra ID P2

Answer

Microsoft 365 Business Basic

Question 10

A company uses Microsoft Entra ID. The IT department wants to ensure that users are prompted to change their password only when there is a high likelihood that their credentials have been compromised, rather than forcing periodic password changes. They also want to block users from using common passwords from a custom list of banned passwords. Which Microsoft Entra features should they use?

Accepted Answer

Identity Protection and Password Protection. Identity Protection uses machine learning to detect leaked credentials and risky sign-in behaviors, triggering a password change prompt only when compromise is likely, not on a fixed schedule. Password Protection enforces custom banned password lists (e.g., common passwords or company-specific terms) at the time of password change or reset, blocking weak passwords in real time.

Answer

Conditional Access and Multi-Factor Authentication

Answer

Privileged Identity Management and Identity Governance

Answer

Access Reviews and Entitlement Management

Question 11

A company uses Microsoft Entra ID. The security team needs to block all sign-in attempts from a list of known malicious IP addresses. They also want to block sign-ins that originate from anonymous proxy services. Which Microsoft Entra capability should they configure to meet these requirements?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow administrators to define conditions under which sign-ins are blocked or allowed. By configuring a policy that includes 'Locations' as a condition, you can specify a list of known malicious IP addresses and also enable the 'Anonymous IP address' risk detection to block sign-ins from anonymous proxy services. This directly meets the requirement to block sign-ins from both specific IPs and anonymous proxies.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Access Reviews

Question 12

A company uses Microsoft Entra ID. The IT help desk team needs to be able to reset passwords and manage user account properties, but only for users located in the United Kingdom. The organization has created a dynamic group that contains all UK users. Which Microsoft Entra feature should an administrator use to delegate these administrative permissions specifically to the help desk team, limited to the UK user scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow an administrator to delegate administrative permissions over a subset of users, groups, or devices, scoped to a specific organizational boundary. By creating an AU that contains the dynamic group of UK users, the administrator can assign the Helpdesk Administrator role scoped to that AU, granting the help desk team the ability to reset passwords and manage user account properties only for those UK users. This directly meets the requirement of delegating permissions limited to the UK user scope.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Access Packages

Question 13

A company uses Microsoft Entra ID. They have a critical application that requires additional security. The security team wants to enforce multifactor authentication (MFA) for every access to the application, but they also want users to reauthenticate with MFA if a session lasts longer than 60 minutes, regardless of device compliance. Which Conditional Access control should the administrator configure?

Accepted Answer

Session control: Sign-in frequency. The requirement to force reauthentication with MFA after a specific time period (60 minutes) is a session-level control, not a grant control. The 'Sign-in frequency' session control in Conditional Access allows administrators to define how often a user must reauthenticate, including re-prompting for MFA, regardless of device compliance. This directly meets the scenario's need for a time-based reauthentication policy.

Answer

Grant control: Require multifactor authentication

Answer

Session control: Application enforced restrictions

Answer

Grant control: Require device to be marked as compliant

Question 14

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-limited administrative access to Azure subscriptions only when needed, with an approval workflow. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure AD and Azure resources, including Azure subscriptions. PIM supports time-bound role activation with an approval workflow, allowing the security team to grant temporary administrative access only when needed, which directly matches the requirement.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entra ID Governance

Question 15

A company uses Microsoft Entra ID. The security team wants to provide just-in-time (JIT) administrative access to Azure resources. They require that administrators must request approval before gaining elevated privileges, and that the elevated access automatically expires after the task is completed. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. PIM allows administrators to request elevation for a specific role, which must be approved by designated approvers, and the elevated access automatically expires after the configured duration (e.g., 1–8 hours). This directly meets the security team's requirements for approval-based, time-limited administrative access.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)