SC-900 Describe the capabilities of Microsoft Entra Practice Test 12 — 15 Questions

Question 1

A company wants to provide external consultants with access to a specific application using their LinkedIn or Google accounts. Which Microsoft Entra feature allows this?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct feature because it enables external users—such as consultants—to sign in using their own identity providers (IdPs) like LinkedIn or Google via federation. This allows the company to grant access to a specific application without creating separate Microsoft Entra accounts for each consultant, leveraging social identity providers through OpenID Connect or OAuth 2.0 protocols.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 2

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Federation with AD FS

Question 3

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

Accepted Answer

Conditional Access policy feedback. Option D is correct because enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.

Answer

Self-Service Password Reset

Answer

Multifactor Authentication registration

Answer

Identity Protection risk policies

Question 4

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management is a core feature of Microsoft Entra ID Governance that enables organizations to manage the lifecycle of access rights across internal and external users. It automates access requests, approvals, and assignments through configurable access packages, ensuring that users have the right access for the right duration. This directly supports governance by enforcing policies for who gets access, for how long, and under what conditions.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 5

Which THREE are benefits of using Microsoft Entra ID as an identity provider? (Choose three.)

Accepted Answer

Conditional Access policies. Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service. Conditional Access policies (B) are a core feature that allow you to enforce access controls based on signals like user, location, and device state, making it a direct benefit of using Entra ID as an identity provider.

Answer

Web application hosting

Answer

Centralized database management

Question 6

Which TWO capabilities are provided by Microsoft Entra External ID? (Choose two.)

Accepted Answer

Support for social identity providers like Google. Options A and D are correct. External ID allows collaboration with users from other organizations and supports various identity providers. Option B is wrong because device management is Intune. Option C is wrong because risk detection is Identity Protection.

Answer

Mobile device management

Answer

On-premises server monitoring

Answer

Identity risk detection

Question 7

The exhibit shows a Conditional Access policy named 'Block Legacy Auth'. The admin notices that the policy is not blocking legacy authentication as intended. Based on the output, what is the most likely reason?

Accepted Answer

The policy does not have any client app types configured to block.. The policy is not blocking legacy authentication because it lacks configured client app types. Conditional Access policies require explicit selection of client apps (e.g., Exchange ActiveSync, other clients) to target legacy authentication protocols like POP3, IMAP, and SMTP. Without this configuration, the policy has no conditions to enforce, so it cannot block any authentication attempts.

Answer

The policy name is incorrect.

Answer

The policy is assigned to no users.

Answer

The policy is disabled.

Question 8

The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?

Accepted Answer

Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.. The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.

Answer

Disable MFA for the user.

Answer

Assign a Microsoft Entra ID P2 license to the user.

Answer

Reset the user's password.

Question 9

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 10

A company wants to ensure that only users with specific IP addresses can access its critical applications. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that enforce access controls based on conditions such as IP address location. By configuring a Conditional Access policy with a 'Locations' condition that includes only trusted IP address ranges, the company can block or grant access to critical applications based on the user's network location. This directly meets the requirement to restrict access to specific IP addresses.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Question 11

A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?

Accepted Answer

Conditional Access 'What If' tool. The Conditional Access 'What If' tool is specifically designed to simulate how a Conditional Access policy would apply to a given user, application, and sign-in condition. It allows the admin to test policy effects without affecting the user's actual sign-in, making it the ideal diagnostic tool when a policy is suspected of blocking access.

Answer

Sign-in logs

Answer

My Apps portal

Answer

Audit logs

Question 12

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

Accepted Answer

Entra External ID. Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 13

A multinational company needs to enforce multi-factor authentication for all users but exclude a break-glass emergency account. Which approach should they take in Microsoft Entra ID?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding the break-glass account. Option D is correct because Conditional Access policies in Microsoft Entra ID allow granular control over authentication requirements, including the ability to exclude specific users or groups. By creating a policy that requires multi-factor authentication (MFA) for all users but explicitly excludes the break-glass account, the company ensures security while maintaining emergency access. This approach is more flexible and scalable than per-user MFA or security defaults, which lack the ability to selectively bypass MFA for critical accounts.

Answer

Use identity protection to require MFA only for high-risk users

Answer

Enable security defaults and add the break-glass account to a group that bypasses MFA

Answer

Enable per-user MFA for all users and turn off for the break-glass account

Question 14

An organization wants to automatically revoke access to cloud apps when an employee leaves the company. Which Microsoft Entra feature should they use?

Accepted Answer

Automated user provisioning. Automated user provisioning (B) is the correct answer because it can automatically disable or remove a user's access to cloud apps when the user is deleted or deactivated in the HR system or on-premises directory. This feature synchronizes identity lifecycle events (e.g., termination) to connected SaaS applications, ensuring revocation of access without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 15

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

Accepted Answer

Deploy Microsoft Entra Kerberos authentication and register the app. Option A is correct because Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Answer

Use password hash synchronization (PHS) and configure the app for OAuth

Answer

Use pass-through authentication (PTA) and configure the app for SAML

Answer

Federate with Active Directory Federation Services (ADFS)