SC-900 Describe the capabilities of Microsoft Entra Practice Test 14 — 15 Questions

Question 1

You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?

Accepted Answer

A decentralized identifier (DID) for your organization. Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.

Answer

A public key infrastructure (PKI) certificate

Answer

A custom application registered in Microsoft Entra ID

Answer

A blockchain node for the decentralized ledger

Question 2

Your company uses Microsoft Entra ID with P2 licenses. You want to require approval for users to activate the Global Administrator role. Which feature should you configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time privileged access, including the ability to require approval for role activation. By configuring PIM for the Global Administrator role, you can enforce that users must request activation and receive approval before gaining the role's permissions, ensuring least-privilege and auditability.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access reviews

Question 3

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

Accepted Answer

Permissions Analytics Report. Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Answer

Audit trail

Answer

Identity governance

Answer

Activity trail

Question 4

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

Accepted Answer

SAML 2.0. SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Answer

OAuth 2.0

Answer

SCIM

Answer

OpenID Connect

Question 5

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

Accepted Answer

MFA registration campaign. The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Answer

Identity Protection

Answer

Conditional Access

Answer

Security defaults

Question 6

Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?

Accepted Answer

Global Secure Access. Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.

Answer

Conditional Access

Answer

DDoS protection

Answer

Network segmentation

Question 7

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 8

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

Accepted Answer

Block legacy authentication protocols. The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Answer

Require MFA for all applications

Answer

Disable the policy for emergency access

Answer

Allow only iOS devices

Question 9

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

Accepted Answer

Create a Conditional Access policy requiring compliant device. The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Answer

Reset the user's password

Answer

Block all personal devices

Answer

Enable MFA for the user

Question 10

Refer to the exhibit. User2 attempts to activate the Global Administrator role. What must happen before User2 gains the role?

Accepted Answer

An approver defined in PIM must approve the request. User2 is attempting to activate the Global Administrator role via Privileged Identity Management (PIM). In PIM, role activation requires approval from a designated approver before the role is granted. Option B correctly identifies that an approver defined in PIM must approve the request, which is the required step for activation.

Answer

User3 must approve the activation request

Answer

User1 must approve the activation request

Answer

User2 must pass MFA

Question 11

A company wants to allow its partners to access a specific SharePoint Online site using their own corporate credentials. The company does not want to manage partner accounts. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows organizations to grant external partners access to resources like SharePoint Online using their own corporate or social identities. This eliminates the need to create and manage separate user accounts for partners, as they authenticate through their home identity provider via federation or invitation redemption.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 12

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

Accepted Answer

Microsoft Entra ID Governance Lifecycle Workflows. Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Terms of Use

Question 13

A user reports that they cannot access Microsoft 365 apps from a public Wi-Fi network. The admin sees a Conditional Access policy requiring a compliant device and a trusted location. Which component enforces this policy?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID enforces Conditional Access policies during the authentication process. While Conditional Access is where policies are defined, the actual enforcement—checking conditions like location and device compliance—occurs within the Microsoft Entra ID service when a token is issued.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Intune

Question 14

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra Self-Service Password Reset. Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 15

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

Accepted Answer

SAML-based single sign-on. D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Answer

Kerberos delegation

Answer

OpenID Connect authentication

Answer

SCIM-based user provisioning