SC-900 Describe the capabilities of Microsoft Entra Practice Test 15 — 15 Questions

Question 1

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 2

A company wants to ensure that only users with specific IP addresses can access its critical applications. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that enforce access controls based on conditions such as IP address location. By configuring a Conditional Access policy with a 'Locations' condition that includes only trusted IP address ranges, the company can block or grant access to critical applications based on the user's network location. This directly meets the requirement to restrict access to specific IP addresses.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Question 3

A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?

Accepted Answer

Sign-in logs. Sign-in logs provide detailed information about every sign-in attempt, including whether Conditional Access policies were applied, which policies were triggered, and the outcome (success or failure). When a user reports they cannot access an app and a Conditional Access policy is suspected, reviewing the sign-in logs for that user's attempts will directly show if a policy blocked access and why, making it the primary diagnostic tool for an existing issue.

Answer

My Apps portal

Answer

Conditional Access 'What If' tool

Answer

Audit logs

Question 4

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

Accepted Answer

Entra External ID. Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 5

A multinational company needs to enforce multi-factor authentication for all users but exclude a break-glass emergency account. Which approach should they take in Microsoft Entra ID?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding the break-glass account. Conditional Access policies in Microsoft Entra ID allow granular control over authentication requirements, including the ability to exclude specific users or groups. By creating a policy that requires multi-factor authentication (MFA) for all users but explicitly excludes the break-glass account, the company ensures security while maintaining emergency access. This approach is more flexible and scalable than per-user MFA or security defaults, which lack the ability to selectively bypass MFA for critical accounts.

Answer

Use identity protection to require MFA only for high-risk users

Answer

Enable security defaults and add the break-glass account to a group that bypasses MFA

Answer

Enable per-user MFA for all users and turn off for the break-glass account

Question 6

An organization wants to automatically revoke access to cloud apps when an employee leaves the company. Which Microsoft Entra feature should they use?

Accepted Answer

Automated user provisioning. Automated user provisioning (B) is the correct answer because it can automatically disable or remove a user's access to cloud apps when the user is deleted or deactivated in the HR system or on-premises directory. This feature synchronizes identity lifecycle events (e.g., termination) to connected SaaS applications, ensuring revocation of access without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 7

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

Accepted Answer

Deploy Microsoft Entra Kerberos authentication and register the app. Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Answer

Use password hash synchronization (PHS) and configure the app for OAuth

Answer

Use pass-through authentication (PTA) and configure the app for SAML

Answer

Federate with Active Directory Federation Services (ADFS)

Question 8

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Answer

Entra Verified ID

Answer

Identity Protection

Answer

Conditional Access

Question 9

A company has a Microsoft Entra ID tenant with thousands of users. They need to ensure that only users with a 'Manager' attribute populated can access a sensitive app. Which approach should they use?

Accepted Answer

Create a dynamic group rule that includes users with a non-empty Manager attribute, then target the group in a Conditional Access policy. A dynamic group rule can evaluate the 'Manager' attribute and include only users where it is populated. This group can then be assigned to a Conditional Access policy that requires the group membership for access to the sensitive app, ensuring only users with a manager can authenticate.

Answer

Use HR-driven provisioning to populate an on-premises attribute and sync it

Answer

Create an access package in Entitlement Management that requires manager approval

Answer

Create an Administrative Unit for users with managers and assign the app to that unit

Question 10

Which TWO Microsoft Entra features can be used together to enforce risk-based conditional access?

Accepted Answer

Conditional Access. Conditional Access (B) is correct because it is the policy engine that enforces access decisions based on signals, including risk levels. Identity Protection (C) is correct because it detects and calculates user and sign-in risk in real time using machine learning. Together, Identity Protection provides the risk assessment, and Conditional Access enforces the policy (e.g., block or require MFA) based on that risk.

Answer

Entra Verified ID

Answer

Self-Service Password Reset

Answer

Privileged Identity Management

Question 11

Which TWO capabilities are part of Microsoft Entra ID Governance?

Accepted Answer

Entitlement Management. Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.

Answer

Identity Protection

Answer

Conditional Access

Answer

Self-Service Password Reset

Question 12

You are reviewing a Conditional Access policy JSON:

{
  "displayName": "Require MFA or compliant device for Office 365 from untrusted locations",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["Office365"]
    },
    "locations": {
      "includeLocations": ["All"],
      "excludeLocations": ["AllTrusted"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa", "compliantDevice"]
  }
}

What is the result of this policy?

Accepted Answer

Users from untrusted locations must complete MFA or use a compliant device to access Office 365. The policy JSON grants access to Office 365 if the user is from an untrusted location and either completes MFA or uses a compliant device. This matches option B exactly. The 'OR' condition between MFA and compliant device is key, and the scope is limited to Office 365, not all cloud apps.

Answer

All users must complete MFA to access all cloud apps

Answer

Users must complete MFA and use a compliant device from all locations

Answer

Users from trusted locations must complete MFA and use a compliant device

Question 13

You are analyzing a PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. What is the duration of the activation?

Accepted Answer

4 hours. By default, the activation duration for a PIM role is 4 hours. While the maximum allowed activation duration for any role, including Global Administrator, is 8 hours, the system's default setting is 4 hours if no custom configuration is applied. Highly privileged roles like Global Administrator are often configured with an 8-hour maximum by organizations, but the system default is 4 hours.

Answer

8 hours

Answer

8 minutes

Answer

8 days

Question 14

You are viewing an application registration in Microsoft Entra ID. What can you conclude about this app?

Accepted Answer

The app is a single-tenant application that is enabled but has no app roles defined. The application registration shows 'App roles' with a value of 0, which means no app roles are defined. The 'Supported account types' setting indicates 'Accounts in this organizational directory only', confirming it is a single-tenant application. The 'Enabled for users to sign-in?' toggle is set to 'Yes', so the app is enabled and can be used.

Answer

The app is disabled and cannot be used

Answer

The app has custom roles for role-based access

Answer

The app is multi-tenant and can be used by other tenants

Question 15

Your company uses Microsoft Entra ID. You need to enable users to sign in to third-party SaaS applications using their corporate credentials without storing passwords in those apps. Which Microsoft Entra feature should you configure?

Accepted Answer

Configure single sign-on (SSO) using federation. Configuring single sign-on (SSO) using federation allows users to authenticate against Microsoft Entra ID (their corporate identity provider) and then pass a security token to third-party SaaS applications. This eliminates the need for the SaaS app to store or manage user passwords, as authentication happens via standards like SAML 2.0 or WS-Federation, and the app trusts the token issued by Entra ID.

Answer

Deploy Microsoft Entra Self-Service Password Reset

Answer

Configure conditional access policies with MFA

Answer

Enable Microsoft Entra Identity Protection