SC-900 Describe the capabilities of Microsoft Entra Practice Test 14 — 15 Questions

Question 1

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 2

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

Accepted Answer

Block legacy authentication protocols. The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Answer

Require MFA for all applications

Answer

Disable the policy for emergency access

Answer

Allow only iOS devices

Question 3

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

Accepted Answer

Create a Conditional Access policy requiring compliant device. The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Answer

Reset the user's password

Answer

Block all personal devices

Answer

Enable MFA for the user

Question 4

A company wants to allow its partners to access a specific SharePoint Online site using their own corporate credentials. The company does not want to manage partner accounts. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows organizations to grant external partners access to resources like SharePoint Online using their own corporate or social identities. This eliminates the need to create and manage separate user accounts for partners, as they authenticate through their home identity provider via federation or invitation redemption.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 5

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

Accepted Answer

Microsoft Entra ID Governance Lifecycle Workflows. Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Terms of Use

Question 6

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra Self-Service Password Reset. Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 7

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

Accepted Answer

SAML-based single sign-on. D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Answer

Kerberos delegation

Answer

OpenID Connect authentication

Answer

SCIM-based user provisioning

Question 8

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 9

A company wants to provide external consultants with access to a specific application using their LinkedIn or Google accounts. Which Microsoft Entra feature allows this?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct feature because it enables external users—such as consultants—to sign in using their own identity providers (IdPs) like LinkedIn or Google via federation. This allows the company to grant access to a specific application without creating separate Microsoft Entra accounts for each consultant, leveraging social identity providers through OpenID Connect or OAuth 2.0 protocols.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 10

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Federation with AD FS

Question 11

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

Accepted Answer

Conditional Access policy feedback. Enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.

Answer

Self-Service Password Reset

Answer

Multifactor Authentication registration

Answer

Identity Protection risk policies

Question 12

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management (A) is a core Microsoft Entra ID Governance capability that lets organizations manage the lifecycle of access through access packages, catalogs, connected organizations, and policies for internal and external users, automating assignment and removal of resource access. Access Reviews (B) is also part of Entra ID Governance, enabling periodic recertification of group memberships, application assignments, and privileged role assignments so that access is reviewed and revoked when no longer needed. Conditional Access (C) is a Microsoft Entra ID access-control policy engine that enforces signals and conditions at sign-in, but it is not classified as an Entra ID Governance feature. Self-Service Password Reset (D) is an authentication/credential-management feature in Entra ID, not a governance workload. Identity Protection (E) is a risk-detection and remediation service for identity risk signals, and while related to security, it is not one of the Entra ID Governance features asked for here.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 13

Which THREE are benefits of using Microsoft Entra ID as an identity provider? (Choose three.)

Accepted Answer

Conditional Access policies. Option B (Conditional Access policies) is correct because Microsoft Entra ID provides a policy engine that evaluates signals such as user, device, location, and risk to enforce access controls like requiring MFA or blocking access, which is a core identity-provider benefit. Option D (Multifactor authentication) is correct because Entra ID natively supports MFA methods (Microsoft Authenticator, FIDO2 keys, SMS/voice, OATH tokens) and can enforce them through security defaults or Conditional Access. Option E (Single sign-on to thousands of cloud apps) is correct because Entra ID acts as an IdP using protocols like SAML 2.0, WS-Federation, OpenID Connect, and OAuth 2.0, with a gallery of thousands of pre-integrated SaaS applications for SSO. Option A (Web application hosting) is not a benefit of an identity provider, since hosting compute and web content is the role of services like Azure App Service or IIS, not Entra ID. Option C (Centralized database management) is also unrelated, as Entra ID stores identity objects (users, groups, app registrations) but does not provide general-purpose database management like Azure SQL Database or SQL Server.

Answer

Web application hosting

Answer

Centralized database management

Question 14

The exhibit shows a Conditional Access policy named 'Block Legacy Auth'. The admin notices that the policy is not blocking legacy authentication as intended. Based on the output, what is the most likely reason?

Accepted Answer

The policy does not have any client app types configured to block.. The policy is not blocking legacy authentication because it lacks configured client app types. Conditional Access policies require explicit selection of client apps (e.g., Exchange ActiveSync, other clients) to target legacy authentication protocols like POP3, IMAP, and SMTP. Without this configuration, the policy has no conditions to enforce, so it cannot block any authentication attempts.

Answer

The policy name is incorrect.

Answer

The policy is assigned to no users.

Answer

The policy is disabled.

Question 15

The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?

Accepted Answer

Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.. The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.

Answer

Disable MFA for the user.

Answer

Assign a Microsoft Entra ID P2 license to the user.

Answer

Reset the user's password.