SC-900 Describe the capabilities of Microsoft Entra Practice Test 14 — 15 Questions

Question 1

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

Accepted Answer

Conditional Access with Identity Protection integration. Option A is correct because Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 2

Your organization uses Microsoft Entra ID. You want to provide external partners with access to a SharePoint site using their own identity providers (e.g., Google, Facebook). Which feature should you use?

Accepted Answer

Microsoft Entra External ID (B2C). Option C is correct because Microsoft Entra External ID (B2C) is specifically designed for customer-facing applications where external users authenticate using social identity providers like Google, Facebook, or Microsoft accounts. It supports OAuth 2.0 and OpenID Connect protocols to allow partners to sign in with their own identity providers, and it can be integrated with SharePoint sites via custom policies or app registrations. This feature provides the necessary federation and user self-service capabilities for external partner access with social identities.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Conditional Access policies

Question 3

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

Accepted Answer

Access is granted. The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Answer

Access is blocked

Answer

User is redirected to a password reset page

Answer

User is prompted for MFA

Question 4

Which TWO features are part of Microsoft Entra ID P2 licensing? (Choose two.)

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra ID P2 licensing includes advanced security features such as Microsoft Entra Identity Protection and Microsoft Entra Privileged Identity Management (PIM). Identity Protection uses machine learning to detect and remediate identity-based risks like leaked credentials and anomalous sign-in patterns, while PIM provides just-in-time privileged access and approval workflows. These capabilities are exclusive to P2 and are not available in P1 or free tiers.

Answer

Conditional Access

Answer

Basic Mobility and Security

Answer

Microsoft Entra Self-Service Password Reset

Question 5

Which TWO scenarios are supported by Microsoft Entra B2B collaboration? (Choose two.)

Accepted Answer

Invite external users via email to access resources. Option B is correct because Microsoft Entra B2B collaboration allows you to invite external users via email to access your organization's resources. This is the core functionality of B2B collaboration, where an invitation email is sent to the external user, and upon accepting, they are granted access to the specified applications or resources.

Answer

Set up federation with social identity providers

Answer

External users authenticate using Google or Facebook accounts

Answer

External users are provisioned with on-premises Active Directory accounts

Question 6

Which THREE components are part of Microsoft Entra ID's identity governance? (Choose three.)

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is a core component of Microsoft Entra ID's identity governance because it provides just-in-time privileged access to Azure AD and Azure resources, with time-bound approvals and activation workflows. It enables organizations to manage, control, and monitor access to critical resources, reducing the risk of standing admin privileges.

Answer

Self-Service Password Reset

Answer

Conditional Access

Question 7

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Accepted Answer

Device platform. Option C is correct because Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Answer

MFA registration status

Answer

Password complexity

Answer

Login frequency

Question 8

Which THREE features are included in Microsoft Entra ID Free? (Choose three.)

Accepted Answer

Security reports and alerts. Option A is correct because Microsoft Entra ID Free includes basic security reports and alerts that provide insights into sign-in activities and potential risks, such as sign-ins from unfamiliar locations or devices. These reports are part of the built-in Identity Security Reports, which are available at no additional cost in the Free tier.

Answer

Self-service password reset with on-premises writeback

Answer

Conditional Access

Question 9

Which THREE capabilities are provided by Microsoft Entra Identity Protection? (Choose three.)

Accepted Answer

Detect leaked credentials. Option A is correct because Microsoft Entra Identity Protection continuously monitors user authentication patterns and compares password hashes against a database of known leaked credentials from public breach sources. When a match is detected, it flags the user or sign-in as risky, enabling automated remediation or blocking.

Answer

Allow users to reset their own passwords

Answer

Provide just-in-time privileged access

Question 10

Your company is implementing Microsoft Entra ID and wants to ensure that users can sign in using their existing social media accounts. Which feature should you configure?

Accepted Answer

External Identities. External Identities in Microsoft Entra ID allows you to configure identity providers for social media accounts (e.g., Google, Facebook) so users can sign in with their existing credentials. This is done by enabling federation with social identity providers via the External Identities blade, which uses OAuth 2.0 and OpenID Connect protocols to authenticate users without creating a separate Microsoft account.

Answer

B2B collaboration

Answer

Conditional Access

Answer

Identity Protection

Question 11

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

Accepted Answer

A conditional access policy is blocking access to that specific app.. The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Answer

The user's account is disabled.

Answer

The tenant is blocked for all sign-ins.

Answer

The user's password expired.

Question 12

Your organization uses Microsoft Entra ID Governance. You need to ensure that when a user leaves the company, all their access to critical applications is automatically removed. Which feature should you use?

Accepted Answer

Access Reviews with automatic removal. Access Reviews with automatic removal is the correct feature because it allows administrators to define recurring reviews of user access to critical applications and, upon completion, automatically remove access for users who are no longer approved. This directly addresses the requirement of removing all access when a user leaves the company, as the review process can be triggered by the user's departure or scheduled to run regularly, ensuring that stale access is revoked without manual intervention.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Entitlement Management

Question 13

Your company wants to provide a single sign-on experience for all cloud applications. Which Microsoft Entra ID feature should you implement?

Accepted Answer

App registration and SSO configuration. App registration and SSO configuration in Microsoft Entra ID enables single sign-on (SSO) by registering each cloud application as an enterprise application and configuring federation protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0. This allows users to authenticate once with their Entra ID credentials and access all configured cloud applications without repeated logins.

Answer

B2B collaboration

Answer

Identity Protection

Answer

Conditional Access

Question 14

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

Accepted Answer

Identity Protection risk detections. Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Answer

Audit logs

Answer

Conditional Access policies

Answer

Multifactor authentication

Question 15

Your organization uses Microsoft Entra ID with P2 licenses. You need to delegate the ability to manage role assignments in Entra ID without granting global admin rights. Which feature should you use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 enables just-in-time, time-bound, and approval-based role assignments, allowing you to delegate role management without granting permanent global admin rights. PIM provides role activation workflows and auditing, making it the correct feature for delegating role assignment management.

Answer

Entitlement Management

Answer

Conditional Access

Answer

Administrative Units