SC-900 Describe the capabilities of Microsoft Entra Practice Test 13 — 15 Questions

Question 1

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.. Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Answer

Require all users to register for Microsoft Entra MFA.

Answer

Configure Microsoft Entra password protection.

Answer

Implement Privileged Identity Management (PIM).

Question 2

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Accepted Answer

Identity as a Service (IDaaS) for cloud applications. Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Answer

Antivirus and antimalware protection

Answer

Provide network firewall services

Answer

Manage mobile devices and applications

Question 3

Which THREE of the following are features of Microsoft Entra ID Governance? (Select three.)

Accepted Answer

Access reviews. Access reviews (A) are a core Microsoft Entra ID Governance capability that lets organizations periodically recertify users' group memberships, application access, and role assignments to ensure least privilege. Privileged Identity Management (B) is included in Entra ID Governance and provides just-in-time privileged role activation, approval workflows, access reviews, and audit history for privileged access. Entitlement management (C) is also a governance feature that automates access request workflows, access packages, and lifecycle policies for internal and external users. Self-service password reset (D) is an authentication/credential-management feature, not a governance capability, and multifactor authentication (E) is an authentication method for strengthening sign-in security, so neither belongs to Entra ID Governance.

Answer

Self-service password reset

Answer

Multifactor authentication

Question 4

Which TWO of the following are supported identity types for Microsoft Entra External ID? (Select two.)

Accepted Answer

Social identities (e.g., Google, Facebook). Microsoft Entra External ID supports social identities such as Google and Facebook (option B), allowing consumers to sign in with existing accounts from these providers via built-in identity providers. It also supports enterprise identities from SAML/WS-Federation identity providers (option D), enabling federation with external organizations' IdPs for B2B collaboration scenarios. These two identity types are core to External ID's design for customer and partner access. OAuth 2.0 token identities (A) describe a protocol flow, not a supported identity type. X.509 certificate-based identities (C) are not a native External ID identity type. Biometric identities (E) are handled by the device/authenticator, not defined as an External ID identity type.

Answer

OAuth 2.0 token identities

Answer

X.509 certificate-based identities

Answer

Biometric identities (fingerprint, face)

Question 5

Which THREE of the following are capabilities provided by Microsoft Entra ID Protection? (Select three.)

Accepted Answer

Automated investigation and remediation of identity risks. Microsoft Entra ID Protection includes automated investigation and remediation capabilities that respond to detected identity risks. When a risk is identified, such as a compromised user account, the service can automatically trigger actions like requiring a password reset or blocking sign-in attempts, reducing the need for manual intervention.

Answer

Passwordless authentication options

Answer

Device compliance assessment

Question 6

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Answer

Self-Service Password Reset (SSPR)

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 7

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user passwords and enable password writeback for self-service password reset. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync (formerly Azure AD Connect) is the correct tool because it synchronizes on-premises Active Directory objects, including password hashes, to Microsoft Entra ID and supports password writeback, which enables self-service password reset (SSPR) to write changed passwords back to on-premises AD. The question specifically requires both password synchronization and writeback, which are core features of Entra Connect Sync.

Answer

Microsoft Entra admin center

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Connect (deprecated)

Question 8

You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?

Accepted Answer

A decentralized identifier (DID) for your organization. Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.

Answer

A public key infrastructure (PKI) certificate

Answer

A custom application registered in Microsoft Entra ID

Answer

A blockchain node for the decentralized ledger

Question 9

Your organization uses Microsoft Entra ID Governance. You need to ensure that guest users' access to internal applications is automatically removed after 90 days. What should you configure?

Accepted Answer

Entitlement management. Microsoft Entra ID Governance's Entitlement Management allows you to define access packages with specific policies, including an expiration date for assignments. By configuring an access package to grant access to the internal applications and setting its assignment policy to expire after 90 days, guest users' access will be automatically revoked at the end of that period. This directly fulfills the requirement for time-based automatic removal after 90 days.

Answer

Access reviews

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 10

Your company uses Microsoft Entra ID with P2 licenses. You want to require approval for users to activate the Global Administrator role. Which feature should you configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time privileged access, including the ability to require approval for role activation. By configuring PIM for the Global Administrator role, you can enforce that users must request activation and receive approval before gaining the role's permissions, ensuring least-privilege and auditability.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access reviews

Question 11

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

Accepted Answer

Permissions Analytics Report. Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Answer

Audit trail

Answer

Identity governance

Answer

Activity trail

Question 12

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

Accepted Answer

SAML 2.0. SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Answer

OAuth 2.0

Answer

SCIM

Answer

OpenID Connect

Question 13

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

Accepted Answer

MFA registration campaign. The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Answer

Identity Protection

Answer

Conditional Access

Answer

Security defaults

Question 14

Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?

Accepted Answer

Global Secure Access. Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.

Answer

Conditional Access

Answer

DDoS protection

Answer

Network segmentation

Question 15

Which TWO Microsoft Entra features can be used to enforce multifactor authentication (MFA)?

Accepted Answer

Security defaults. Security defaults (B) is correct because it is a Microsoft Entra ID setting that, when enabled, automatically enforces MFA for all users, requiring them to register for MFA and use it at sign-in. Conditional Access (E) is correct because it lets administrators create policies that require MFA based on conditions such as user, group, application, location, or risk, making it the primary policy engine for enforcing MFA. Self-Service Password Reset (A) only allows users to reset or unlock their accounts and does not enforce MFA at sign-in. Identity Protection (C) detects and reports risky sign-ins and users and can feed risk signals into Conditional Access, but by itself it does not enforce MFA. Privileged Identity Management (D) manages just-in-time role activation and approvals for privileged roles, not MFA enforcement for general sign-ins.

Answer

Self-Service Password Reset

Answer

Identity Protection

Answer

Privileged Identity Management