SC-900 Describe the capabilities of Microsoft Entra Practice Test 16 — 15 Questions

Question 1

Which TWO Microsoft Entra features can be used together to enforce risk-based conditional access?

Accepted Answer

Conditional Access. Conditional Access (B) is correct because it is the policy engine that enforces access decisions based on signals, including risk levels. Identity Protection (C) is correct because it detects and calculates user and sign-in risk in real time using machine learning. Together, Identity Protection provides the risk assessment, and Conditional Access enforces the policy (e.g., block or require MFA) based on that risk.

Answer

Entra Verified ID

Answer

Self-Service Password Reset

Answer

Privileged Identity Management

Question 2

Which TWO capabilities are part of Microsoft Entra ID Governance?

Accepted Answer

Entitlement Management. Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.

Answer

Identity Protection

Answer

Conditional Access

Answer

Self-Service Password Reset

Question 3

You are viewing an application registration in Microsoft Entra ID. What can you conclude about this app?

Accepted Answer

The app is a single-tenant application that is enabled but has no app roles defined. The application registration shows 'App roles' with a value of 0, which means no app roles are defined. The 'Supported account types' setting indicates 'Accounts in this organizational directory only', confirming it is a single-tenant application. The 'Enabled for users to sign-in?' toggle is set to 'Yes', so the app is enabled and can be used.

Answer

The app is disabled and cannot be used

Answer

The app has custom roles for role-based access

Answer

The app is multi-tenant and can be used by other tenants

Question 4

Your company uses Microsoft Entra ID. You need to enable users to sign in to third-party SaaS applications using their corporate credentials without storing passwords in those apps. Which Microsoft Entra feature should you configure?

Accepted Answer

Configure single sign-on (SSO) using federation. Configuring single sign-on (SSO) using federation allows users to authenticate against Microsoft Entra ID (their corporate identity provider) and then pass a security token to third-party SaaS applications. This eliminates the need for the SaaS app to store or manage user passwords, as authentication happens via standards like SAML 2.0 or WS-Federation, and the app trusts the token issued by Entra ID.

Answer

Deploy Microsoft Entra Self-Service Password Reset

Answer

Configure conditional access policies with MFA

Answer

Enable Microsoft Entra Identity Protection

Question 5

A user reports they cannot access the company portal from their personal device. The device is not enrolled in Microsoft Intune. The admin wants to ensure only compliant devices can access corporate resources. What should the admin configure?

Accepted Answer

Conditional Access policy requiring device compliance. A is correct because a Conditional Access policy can require device compliance before granting access to corporate resources. When the device is not enrolled in Microsoft Intune, it cannot report compliance status, so the policy blocks access. This ensures only managed, compliant devices can access the company portal.

Answer

Enable password writeback

Answer

Enable Identity Protection sign-in risk policy

Answer

Microsoft Entra Privileged Identity Management

Question 6

Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?

Accepted Answer

Access is blocked. The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.

Answer

Access is granted because the policy is only for Office 365 and the user uses Exchange Online

Answer

Access is granted after MFA registration prompt

Answer

Access is granted because the device is compliant

Question 7

Your organization uses Microsoft Entra ID with P2 licenses. You need to review and approve role activations for the Global Administrator role on a weekly basis. Which feature should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) allows you to manage, control, and monitor access to important resources in your organization, including the ability to review and approve role activations for privileged roles like Global Administrator. Option A is wrong because Identity Protection is for detecting risks and vulnerabilities. Option B is wrong because Conditional Access controls access based on conditions, not role activation approval. Option D is wrong because Access Reviews are for reviewing and recertifying access assignments, but not specifically for approving activations in real-time.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Access Reviews

Question 8

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

Accepted Answer

Conditional Access with Identity Protection integration. Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 9

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

Accepted Answer

Access is granted. The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Answer

Access is blocked

Answer

User is redirected to a password reset page

Answer

User is prompted for MFA

Question 10

Which TWO features are part of Microsoft Entra ID P2 licensing? (Choose two.)

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra ID P2 licensing includes advanced security features such as Microsoft Entra Identity Protection and Microsoft Entra Privileged Identity Management (PIM). Identity Protection uses machine learning to detect and remediate identity-based risks like leaked credentials and anomalous sign-in patterns, while PIM provides just-in-time privileged access and approval workflows. These capabilities are exclusive to P2 and are not available in P1 or free tiers.

Answer

Conditional Access

Answer

Basic Mobility and Security

Answer

Microsoft Entra Self-Service Password Reset

Question 11

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Accepted Answer

Device platform. Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Answer

MFA registration status

Answer

Password complexity

Answer

Login frequency

Question 12

Your company is implementing Microsoft Entra ID and wants to ensure that users can sign in using their existing social media accounts. Which feature should you configure?

Accepted Answer

External Identities. External Identities in Microsoft Entra ID allows you to configure identity providers for social media accounts (e.g., Google, Facebook) so users can sign in with their existing credentials. This is done by enabling federation with social identity providers via the External Identities blade, which uses OAuth 2.0 and OpenID Connect protocols to authenticate users without creating a separate Microsoft account.

Answer

B2B collaboration

Answer

Conditional Access

Answer

Identity Protection

Question 13

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

Accepted Answer

A conditional access policy is blocking access to that specific app.. The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Answer

The user's account is disabled.

Answer

The tenant is blocked for all sign-ins.

Answer

The user's password expired.

Question 14

Your company wants to provide a single sign-on experience for all cloud applications. Which Microsoft Entra ID feature should you implement?

Accepted Answer

App registration and SSO configuration. App registration and SSO configuration in Microsoft Entra ID enables single sign-on (SSO) by registering each cloud application as an enterprise application and configuring federation protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0. This allows users to authenticate once with their Entra ID credentials and access all configured cloud applications without repeated logins.

Answer

B2B collaboration

Answer

Identity Protection

Answer

Conditional Access

Question 15

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

Accepted Answer

Identity Protection risk detections. Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Answer

Audit logs

Answer

Conditional Access policies

Answer

Multifactor authentication