SC-900 Describe the capabilities of Microsoft Entra Practice Test 13 — 15 Questions

Question 1

An administrator notices that some users are being prompted for MFA even though they are inside the corporate network. The Conditional Access policy includes a condition for 'All locations' except trusted IPs. What is the most likely cause?

Accepted Answer

The corporate network's public IP address is not added to the trusted IPs list. If the corporate network's public IP is not added to the trusted IPs list, users inside the network will be prompted for MFA because the location is not recognized as trusted. Option A is correct. Option B is wrong because if the IP is correctly configured, it should work. Option C is wrong because MFA registration status doesn't affect the prompt if policy requires it. Option D is wrong because session control doesn't bypass MFA.

Answer

The users have not registered for MFA

Answer

The users are not assigned to the policy but are in a nested group

Answer

The Conditional Access policy has session controls enabled

Question 2

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Answer

Entra Verified ID

Answer

Identity Protection

Answer

Conditional Access

Question 3

A company has a Microsoft Entra ID tenant with thousands of users. They need to ensure that only users with a 'Manager' attribute populated can access a sensitive app. Which approach should they use?

Accepted Answer

Create a dynamic group rule that includes users with a non-empty Manager attribute, then target the group in a Conditional Access policy. Option B is correct because a dynamic group rule can evaluate the 'Manager' attribute and include only users where it is populated. This group can then be assigned to a Conditional Access policy that requires the group membership for access to the sensitive app, ensuring only users with a manager can authenticate.

Answer

Use HR-driven provisioning to populate an on-premises attribute and sync it

Answer

Create an access package in Entitlement Management that requires manager approval

Answer

Create an Administrative Unit for users with managers and assign the app to that unit

Question 4

Which TWO Microsoft Entra features can be used together to enforce risk-based conditional access?

Accepted Answer

Conditional Access. Conditional Access (B) is correct because it is the policy engine that enforces access decisions based on signals, including risk levels. Identity Protection (C) is correct because it detects and calculates user and sign-in risk in real time using machine learning. Together, Identity Protection provides the risk assessment, and Conditional Access enforces the policy (e.g., block or require MFA) based on that risk.

Answer

Entra Verified ID

Answer

Self-Service Password Reset

Answer

Privileged Identity Management

Question 5

Which THREE are valid authentication methods in Microsoft Entra ID?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are a valid authentication method in Microsoft Entra ID because they provide passwordless, phishing-resistant authentication using public-key cryptography. Users register a hardware key that generates a key pair, and the private key never leaves the device, meeting strong authentication requirements for modern security.

Answer

Smart card (physical)

Answer

SMS-based verification

Question 6

Which TWO capabilities are part of Microsoft Entra ID Governance?

Accepted Answer

Entitlement Management. Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.

Answer

Identity Protection

Answer

Conditional Access

Answer

Self-Service Password Reset

Question 7

You are reviewing a Conditional Access policy JSON. What is the result of this policy?

Accepted Answer

Users from untrusted locations must complete MFA or use a compliant device to access Office 365. The policy JSON grants access to Office 365 if the user is from an untrusted location and either completes MFA or uses a compliant device. This matches option B exactly. The 'OR' condition between MFA and compliant device is key, and the scope is limited to Office 365, not all cloud apps.

Answer

All users must complete MFA to access all cloud apps

Answer

Users must complete MFA and use a compliant device from all locations

Answer

Users from trusted locations must complete MFA and use a compliant device

Question 8

You are analyzing a PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. What is the duration of the activation?

Accepted Answer

8 hours. By default, the maximum activation duration for a Global Administrator role in Privileged Identity Management (PIM) is 8 hours. This is the longest allowed activation period for highly privileged roles like Global Administrator, ensuring elevated access is time-limited to reduce security risk.

Answer

4 hours

Answer

8 minutes

Answer

8 days

Question 9

You are viewing an application registration in Microsoft Entra ID. What can you conclude about this app?

Accepted Answer

The app is a single-tenant application that is enabled but has no app roles defined. The application registration shows 'App roles' with a value of 0, which means no app roles are defined. The 'Supported account types' setting indicates 'Accounts in this organizational directory only', confirming it is a single-tenant application. The 'Enabled for users to sign-in?' toggle is set to 'Yes', so the app is enabled and can be used.

Answer

The app is disabled and cannot be used

Answer

The app has custom roles for role-based access

Answer

The app is multi-tenant and can be used by other tenants

Question 10

Your company uses Microsoft Entra ID. You need to enable users to sign in to third-party SaaS applications using their corporate credentials without storing passwords in those apps. Which Microsoft Entra feature should you configure?

Accepted Answer

Configure single sign-on (SSO) using federation. Option A is correct because configuring single sign-on (SSO) using federation allows users to authenticate against Microsoft Entra ID (their corporate identity provider) and then pass a security token to third-party SaaS applications. This eliminates the need for the SaaS app to store or manage user passwords, as authentication happens via standards like SAML 2.0 or WS-Federation, and the app trusts the token issued by Entra ID.

Answer

Deploy Microsoft Entra Self-Service Password Reset

Answer

Configure conditional access policies with MFA

Answer

Enable Microsoft Entra Identity Protection

Question 11

A user reports they cannot access the company portal from their personal device. The device is not enrolled in Microsoft Intune. The admin wants to ensure only compliant devices can access corporate resources. What should the admin configure?

Accepted Answer

Conditional Access policy requiring device compliance. A is correct because a Conditional Access policy can require device compliance before granting access to corporate resources. When the device is not enrolled in Microsoft Intune, it cannot report compliance status, so the policy blocks access. This ensures only managed, compliant devices can access the company portal.

Answer

Enable password writeback

Answer

Enable Identity Protection sign-in risk policy

Answer

Microsoft Entra Privileged Identity Management

Question 12

Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?

Accepted Answer

Access is blocked. The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.

Answer

Access is granted because the policy is only for Office 365 and the user uses Exchange Online

Answer

Access is granted after MFA registration prompt

Answer

Access is granted because the device is compliant

Question 13

Your organization uses Microsoft Entra ID with P2 licenses. You need to review and approve role activations for the Global Administrator role on a weekly basis. Which feature should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Option A is correct because Microsoft Entra Privileged Identity Management (PIM) allows you to manage and approve role activations. Option B is wrong because Identity Protection is for risk. Option C is wrong because Access Reviews can review assignments but not activations. Option D is wrong because Conditional Access controls access conditions.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Access Reviews

Question 14

A company wants to allow employees to sign in using their Microsoft credentials (e.g., personal Outlook.com) to access internal applications. Which Microsoft Entra feature should be configured?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) allows organizations to enable external users—including consumers with personal Microsoft accounts (e.g., Outlook.com)—to sign in to internal applications using their own credentials. This feature supports identity providers like Microsoft Accounts (MSA), Google, Facebook, and SAML/WS-Fed IdPs, making it the correct choice for allowing employees to use personal Outlook.com credentials for access.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra device enrollment

Answer

Microsoft Entra hybrid identity

Question 15

Refer to the exhibit. A user accesses a web app from a device that is Microsoft Entra joined but not Intune compliant. Which condition will be satisfied?

Accepted Answer

Neither condition. The device is Microsoft Entra joined, which satisfies the 'Domain joined' condition for Conditional Access, but it is not Intune compliant, so the 'Compliant device' condition is not met. Since the question asks which condition will be satisfied, and the device only meets one of the two, the correct answer is 'Neither condition' because the user is accessing a web app and the conditions are evaluated together as a single requirement (e.g., requiring both domain join and compliance). In Conditional Access, if a policy requires both conditions, the device must satisfy both to be granted access; here, it fails the compliance check, so neither condition is fully satisfied for the policy's intent.

Answer

Domain joined

Answer

Compliant device

Answer

Both conditions