SC-900 Describe the capabilities of Microsoft Entra Practice Test 13 — 15 Questions

Question 1

A company uses Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) only when users sign in from devices that are not compliant with company security policies. They also want to block sign-ins from unknown geographic locations. Which Microsoft Entra feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that evaluate signals such as device compliance and geographic location before granting access. By configuring a policy that requires MFA for non-compliant devices and blocks sign-ins from unknown locations, the security team can enforce these specific conditions. This granular control is unique to Conditional Access, which integrates with Microsoft Entra ID to enforce access decisions based on real-time risk and context.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Self-Service Password Reset (SSPR)

Question 2

Order the steps to create a conditional access policy in Azure AD.

Accepted Answer

Sign in, navigate to Conditional Access, create new policy, configure assignments and controls, enable policy and create.. Creating a conditional access policy requires admin sign-in, navigating to Conditional Access, creating a new policy, configuring assignments and controls, then enabling it.

Answer

Sign in, navigate to Conditional Access, create new policy, enable policy, then configure assignments and controls.

Answer

Navigate to Conditional Access, sign in, create new policy, configure assignments and controls, enable policy.

Answer

Sign in, create new policy, navigate to Conditional Access, configure assignments and controls, enable policy.

Question 3

Sequence the steps to set up Microsoft Sentinel for a new workspace.

Accepted Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Connect data sources → Create analytics rules → Set up automation. Setting up Sentinel requires a Log Analytics workspace, enabling Sentinel, connecting sources, creating rules, and automating responses.

Answer

Create Log Analytics workspace → Connect data sources → Enable Microsoft Sentinel → Create analytics rules → Set up automation

Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Create analytics rules → Connect data sources → Set up automation

Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Connect data sources → Set up automation → Create analytics rules

Question 4

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Accepted Answer

Access the Azure AD Identity Protection portal, then review the risky users report, then select a specific user, then analyze the risk events for that user, then take remediation action.. Identity Protection investigation involves accessing the portal, reviewing risks, selecting a user, analyzing events, and taking action.

Answer

Access the Azure AD Identity Protection portal, then select a specific user, then analyze the risk events for that user, then review the risky users report, then take remediation action.

Answer

Access the Azure AD Identity Protection portal, then review the risky users report, then take remediation action, then select a specific user, then analyze the risk events.

Answer

Access the Azure AD Identity Protection portal, then analyze the risk events, then review the risky users report, then select a specific user, then take remediation action.

Question 5

Match each compliance term to its correct definition.

Accepted Answer

Data Loss Prevention: Helps prevent sensitive information from being shared outside the organization. Compliance terms in Microsoft 365 cover data protection, communication restrictions, data governance, and legal discovery. DLP prevents data leaks, Information Barriers control internal communication, Records Management handles retention, and eDiscovery supports legal processes.

Answer

Data Loss Prevention: Restricts communication and collaboration between specific groups

Answer

Records Management: Helps prevent sensitive information from being shared outside the organization

Question 6

Match each Microsoft Defender product to its focus area.

Accepted Answer

Microsoft Defender for Cloud: Secures cloud workloads. Microsoft Defender for Cloud secures cloud workloads; Defender for Endpoint secures endpoints; Defender for Identity secures identities; Defender for Office 365 secures email and collaboration; Defender for Cloud Apps secures shadow IT and app permissions.

Answer

Microsoft Defender for Office 365: Secures shadow IT and app permissions

Answer

Microsoft Defender for Cloud Apps: Secures cloud workloads

Question 7

Match each identity term to its correct meaning.

Accepted Answer

Identity: An entity that can be authenticated (e.g., user, device, service).. Identity is the entity (user, device, service) being authenticated. Authentication verifies who you are (e.g., passwords, MFA). Authorization determines what you can access (e.g., permissions). Directory stores identity information (e.g., Azure AD). Common confusion: mixing authentication and authorization definitions.

Answer

Identity: The process of verifying credentials.

Answer

Authentication: The process of granting access rights.

Question 8

Your company is implementing a new application that requires users to authenticate using Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) for all users accessing this application, but only when they are connecting from an untrusted network. Which conditional access policy should you configure?

Accepted Answer

Grant control: 'Require multifactor authentication' with a condition on 'Locations' set to 'All trusted locations' as exclusion.. It configures a Conditional Access policy that grants access only when MFA is performed, and excludes trusted network locations. This ensures that MFA is enforced only when users connect from untrusted networks, meeting the security team's requirement.

Answer

Session control: 'Use app enforced restrictions' to block access from untrusted networks.

Answer

Assignments: 'Users and groups' including all users, then grant control: 'Require multifactor authentication' without conditions.

Answer

Grant control: 'Require device to be marked as compliant' with a condition on 'Client apps'.

Question 9

A user reports that they are unable to sign in to a SaaS application that is configured for single sign-on (SSO) with Microsoft Entra ID. The user can sign in to other applications. What should you check first?

Accepted Answer

Check if the user is assigned to the application in Microsoft Entra ID.. The most common cause of SSO failure for a single application, when the user can sign in to other apps, is that the user has not been assigned to that specific application in Microsoft Entra ID. Without explicit assignment, the user cannot authenticate via SSO even if their account is active and licensed. This is a core requirement for application-level access control in Entra ID.

Answer

Confirm the user's account is not disabled.

Answer

Verify that the user has reset their password recently.

Answer

Ensure the user has an appropriate Microsoft 365 license.

Question 10

Your organization uses Microsoft Entra ID for identity management. You need to allow external partners to access a specific SharePoint Online site without requiring them to have a Microsoft Entra ID account in your tenant. Which feature should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration to invite partners as guest users.. Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external partners as guest users who can access resources like SharePoint Online using their own identity (e.g., a Microsoft account or a corporate account from another identity provider) without requiring a separate Microsoft Entra ID account in your tenant. This leverages the B2B collaboration protocol, which uses SAML/WS-Federation or OIDC for federation, enabling seamless access while maintaining centralized access control.

Answer

Set up identity protection to allow external access.

Answer

Configure Microsoft Entra B2C for the partners.

Answer

Create guest user accounts for each partner.

Question 11

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.. Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Answer

Require all users to register for Microsoft Entra MFA.

Answer

Configure Microsoft Entra password protection.

Answer

Implement Privileged Identity Management (PIM).

Question 12

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Accepted Answer

Identity as a Service (IDaaS) for cloud applications. Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Answer

Antivirus and antimalware protection

Answer

Provide network firewall services

Answer

Manage mobile devices and applications

Question 13

Which THREE of the following are capabilities provided by Microsoft Entra ID Protection? (Select three.)

Accepted Answer

Automated investigation and remediation of identity risks. Microsoft Entra ID Protection includes automated investigation and remediation capabilities that respond to detected identity risks. When a risk is identified, such as a compromised user account, the service can automatically trigger actions like requiring a password reset or blocking sign-in attempts, reducing the need for manual intervention.

Answer

Passwordless authentication options

Answer

Device compliance assessment

Question 14

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Answer

Self-Service Password Reset (SSPR)

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 15

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user passwords and enable password writeback for self-service password reset. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync (formerly Azure AD Connect) is the correct tool because it synchronizes on-premises Active Directory objects, including password hashes, to Microsoft Entra ID and supports password writeback, which enables self-service password reset (SSPR) to write changed passwords back to on-premises AD. The question specifically requires both password synchronization and writeback, which are core features of Entra Connect Sync.

Answer

Microsoft Entra admin center

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Connect (deprecated)