SC-900 Describe the capabilities of Microsoft Entra Practice Test 16 — 15 Questions

Question 1

A user reports they cannot access the company portal from their personal device. The device is not enrolled in Microsoft Intune. The admin wants to ensure only compliant devices can access corporate resources. What should the admin configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy requiring device compliance. A is correct because a Conditional Access policy can require device compliance before granting access to corporate resources. When the device is not enrolled in Microsoft Intune, it cannot report compliance status, so the policy blocks access. This ensures only managed, compliant devices can access the company portal.

Answer

Enable password writeback

Answer

Enable Identity Protection sign-in risk policy

Answer

Microsoft Entra Privileged Identity Management

Question 2

Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?

Accepted Answer

Access is blocked. The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.

Answer

Access is granted because the policy is only for Office 365 and the user uses Exchange Online

Answer

Access is granted after MFA registration prompt

Answer

Access is granted because the device is compliant

Question 3

Refer to the exhibit. A user accesses a web app from a device that is Microsoft Entra joined but not Intune compliant. Which condition will be satisfied?

Accepted Answer

Neither condition. The exhibit shows a Conditional Access policy that requires both 'Domain joined' and 'Compliant device' conditions. The device is Microsoft Entra joined. In Conditional Access, the 'Domain joined' condition specifically refers to devices that are *Hybrid Microsoft Entra ID joined* (joined to an on-premises Active Directory and registered with Microsoft Entra ID). A device that is *only* Microsoft Entra joined does not satisfy the 'Domain joined' condition. Additionally, the device is stated as 'not Intune compliant', so it fails the 'Compliant device' condition. Therefore, neither the 'Domain joined' nor the 'Compliant device' condition is satisfied, making option B correct.

Answer

Domain joined

Answer

Compliant device

Answer

Both conditions

Question 4

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

Accepted Answer

Conditional Access with Identity Protection integration. Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 5

Your organization uses Microsoft Entra ID. You want to provide external partners with access to a SharePoint site using their own identity providers (e.g., Google, Facebook). Which feature should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration allows you to invite external users (guests) to your Microsoft Entra ID tenant and grant them access to your organization's resources, such as SharePoint sites. B2B supports various identity providers for guest users, including other Microsoft Entra ID tenants, Microsoft accounts, email one-time passcodes, and crucially, social identity providers like Google and Facebook. By configuring federation with these social providers, external partners can use their existing Google or Facebook accounts to sign in as guests and access the SharePoint site. Microsoft Entra External ID (B2C) is primarily designed for customer-facing applications and managing consumer identities in a separate tenant, not for directly granting partners access to internal resources like SharePoint within the main Entra ID tenant.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra External ID (B2C)

Answer

Conditional Access policies

Question 6

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

Accepted Answer

Access is granted. The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Answer

Access is blocked

Answer

User is redirected to a password reset page

Answer

User is prompted for MFA

Question 7

Which TWO features are part of Microsoft Entra ID P2 licensing? (Choose two.)

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra ID P2 licensing includes advanced security features such as Microsoft Entra Identity Protection and Microsoft Entra Privileged Identity Management (PIM). Identity Protection uses machine learning to detect and remediate identity-based risks like leaked credentials and anomalous sign-in patterns, while PIM provides just-in-time privileged access and approval workflows. These capabilities are exclusive to P2 and are not available in P1 or free tiers.

Answer

Conditional Access

Answer

Basic Mobility and Security

Answer

Microsoft Entra Self-Service Password Reset

Question 8

Which THREE components are part of Microsoft Entra ID's identity governance? (Choose three.)

Accepted Answer

Privileged Identity Management. Privileged Identity Management (B) is a core identity governance component in Microsoft Entra ID, providing just-in-time role activation, approval workflows, and time-bound privileged access to Microsoft Entra ID and Azure resources. Entitlement Management (C) is also part of identity governance, delivering access packages, catalogs, and automated access request/assignment workflows for internal and external users. Access Reviews (D) belongs to identity governance as well, enabling periodic recertification of group memberships, application assignments, and privileged role assignments to ensure least privilege. Self-Service Password Reset (A) is an authentication/credential management feature, not an identity governance component, and Conditional Access (E) is a policy-based access control engine for enforcing sign-in conditions, not part of identity governance.

Answer

Self-Service Password Reset

Answer

Conditional Access

Question 9

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Accepted Answer

Device platform. Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Answer

MFA registration status

Answer

Password complexity

Answer

Login frequency

Question 10

Which THREE capabilities are provided by Microsoft Entra Identity Protection? (Choose three.)

Accepted Answer

Detect leaked credentials. Microsoft Entra Identity Protection includes leaked credential detection (A), which scans for compromised credentials exposed in breaches or dark web dumps and surfaces them as user risk detections. It also enables risk-based Conditional Access policies (B), allowing sign-in and user risk levels to drive access decisions such as requiring MFA or password change. Its risk investigation reports (E) give administrators visibility into risky users, risky sign-ins, and detections for triage and remediation. Self-service password reset (C) is a separate Microsoft Entra ID feature, and just-in-time privileged access (D) is provided by Privileged Identity Management, not Identity Protection.

Answer

Allow users to reset their own passwords

Answer

Provide just-in-time privileged access

Question 11

Your company is implementing Microsoft Entra ID and wants to ensure that users can sign in using their existing social media accounts. Which feature should you configure?

Accepted Answer

External Identities. External Identities in Microsoft Entra ID allows you to configure identity providers for social media accounts (e.g., Google, Facebook) so users can sign in with their existing credentials. This is done by enabling federation with social identity providers via the External Identities blade, which uses OAuth 2.0 and OpenID Connect protocols to authenticate users without creating a separate Microsoft account.

Answer

B2B collaboration

Answer

Conditional Access

Answer

Identity Protection

Question 12

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

Accepted Answer

A conditional access policy is blocking access to that specific app.. The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Answer

The user's account is disabled.

Answer

The tenant is blocked for all sign-ins.

Answer

The user's password expired.

Question 13

Your company wants to provide a single sign-on experience for all cloud applications. Which Microsoft Entra ID feature should you implement?

Accepted Answer

App registration and SSO configuration. App registration and SSO configuration in Microsoft Entra ID enables single sign-on (SSO) by registering each cloud application as an enterprise application and configuring federation protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0. This allows users to authenticate once with their Entra ID credentials and access all configured cloud applications without repeated logins.

Answer

B2B collaboration

Answer

Identity Protection

Answer

Conditional Access

Question 14

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

Accepted Answer

Identity Protection risk detections. Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Answer

Audit logs

Answer

Conditional Access policies

Answer

Multifactor authentication

Question 15

Your organization uses Microsoft Entra ID with P2 licenses. You need to delegate the ability to manage role assignments in Entra ID without granting global admin rights. Which feature should you use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 enables just-in-time, time-bound, and approval-based role assignments, allowing you to delegate role management without granting permanent global admin rights. PIM provides role activation workflows and auditing, making it the correct feature for delegating role assignment management.

Answer

Entitlement Management

Answer

Conditional Access

Answer

Administrative Units