SC-900 Describe the capabilities of Microsoft Entra Practice Test 15 — 15 Questions

Question 1

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 2

A company wants to provide external consultants with access to a specific application using their LinkedIn or Google accounts. Which Microsoft Entra feature allows this?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct feature because it enables external users—such as consultants—to sign in using their own identity providers (IdPs) like LinkedIn or Google via federation. This allows the company to grant access to a specific application without creating separate Microsoft Entra accounts for each consultant, leveraging social identity providers through OpenID Connect or OAuth 2.0 protocols.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 3

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Federation with AD FS

Question 4

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

Accepted Answer

Conditional Access policy feedback. Enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.

Answer

Self-Service Password Reset

Answer

Multifactor Authentication registration

Answer

Identity Protection risk policies

Question 5

Which TWO capabilities are provided by Microsoft Entra External ID? (Choose two.)

Accepted Answer

Support for social identity providers like Google. Options A and C are correct. Microsoft Entra External ID enables collaboration with external users from partner organizations (option C) and supports social identity providers like Google, Facebook, and Microsoft accounts (option A). Option B is incorrect because mobile device management is handled by Microsoft Intune, not Entra External ID. Option D is incorrect because on-premises server monitoring is not a capability of Entra External ID; it is unrelated to identity and access management. Option E is incorrect because identity risk detection is part of Microsoft Entra Identity Protection, not External ID.

Answer

Mobile device management

Answer

On-premises server monitoring

Answer

Identity risk detection

Question 6

The exhibit shows a Conditional Access policy named 'Block Legacy Auth'. The admin notices that the policy is not blocking legacy authentication as intended. Based on the output, what is the most likely reason?

Accepted Answer

The policy does not have any client app types configured to block.. The policy is not blocking legacy authentication because it lacks configured client app types. Conditional Access policies require explicit selection of client apps (e.g., Exchange ActiveSync, other clients) to target legacy authentication protocols like POP3, IMAP, and SMTP. Without this configuration, the policy has no conditions to enforce, so it cannot block any authentication attempts.

Answer

The policy name is incorrect.

Answer

The policy is assigned to no users.

Answer

The policy is disabled.

Question 7

The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?

Accepted Answer

Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.. The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.

Answer

Disable MFA for the user.

Answer

Assign a Microsoft Entra ID P2 license to the user.

Answer

Reset the user's password.

Question 8

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 9

A company wants to ensure that only users with specific IP addresses can access its critical applications. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that enforce access controls based on conditions such as IP address location. By configuring a Conditional Access policy with a 'Locations' condition that includes only trusted IP address ranges, the company can block or grant access to critical applications based on the user's network location. This directly meets the requirement to restrict access to specific IP addresses.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Question 10

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

Accepted Answer

Entra External ID. Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 11

A multinational company needs to enforce multi-factor authentication for all users but exclude a break-glass emergency account. Which approach should they take in Microsoft Entra ID?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding the break-glass account. Conditional Access policies in Microsoft Entra ID allow granular control over authentication requirements, including the ability to exclude specific users or groups. By creating a policy that requires multi-factor authentication (MFA) for all users but explicitly excludes the break-glass account, the company ensures security while maintaining emergency access. This approach is more flexible and scalable than per-user MFA or security defaults, which lack the ability to selectively bypass MFA for critical accounts.

Answer

Use identity protection to require MFA only for high-risk users

Answer

Enable security defaults and add the break-glass account to a group that bypasses MFA

Answer

Enable per-user MFA for all users and turn off for the break-glass account

Question 12

An organization wants to automatically revoke access to cloud apps when an employee leaves the company. Which Microsoft Entra feature should they use?

Accepted Answer

Automated user provisioning. Automated user provisioning (B) is the correct answer because it can automatically disable or remove a user's access to cloud apps when the user is deleted or deactivated in the HR system or on-premises directory. This feature synchronizes identity lifecycle events (e.g., termination) to connected SaaS applications, ensuring revocation of access without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 13

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

Accepted Answer

Deploy Microsoft Entra Kerberos authentication and register the app. Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Answer

Use password hash synchronization (PHS) and configure the app for OAuth

Answer

Use pass-through authentication (PTA) and configure the app for SAML

Answer

Federate with Active Directory Federation Services (ADFS)

Question 14

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Answer

Entra Verified ID

Answer

Identity Protection

Answer

Conditional Access

Question 15

A company has a Microsoft Entra ID tenant with thousands of users. They need to ensure that only users with a 'Manager' attribute populated can access a sensitive app. Which approach should they use?

Accepted Answer

Create a dynamic group rule that includes users with a non-empty Manager attribute, then target the group in a Conditional Access policy. A dynamic group rule can evaluate the 'Manager' attribute and include only users where it is populated. This group can then be assigned to a Conditional Access policy that requires the group membership for access to the sensitive app, ensuring only users with a manager can authenticate.

Answer

Use HR-driven provisioning to populate an on-premises attribute and sync it

Answer

Create an access package in Entitlement Management that requires manager approval

Answer

Create an Administrative Unit for users with managers and assign the app to that unit