SC-900 Describe the capabilities of Microsoft Entra Practice Test 17 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID with P2 licenses. You need to delegate the ability to manage role assignments in Entra ID without granting global admin rights. Which feature should you use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 enables just-in-time, time-bound, and approval-based role assignments, allowing you to delegate role management without granting permanent global admin rights. PIM provides role activation workflows and auditing, making it the correct feature for delegating role assignment management.

Answer

Entitlement Management

Answer

Conditional Access

Answer

Administrative Units

Question 2

Your company wants to allow partners to use their own corporate credentials to access a specific SharePoint site. Which Microsoft Entra ID feature supports this?

Accepted Answer

B2B collaboration. Microsoft Entra ID B2B (business-to-business) collaboration allows you to invite external users from partner organizations to access your company's resources, such as SharePoint sites, using their own corporate credentials. This feature supports identity federation with the partner's Azure AD or other identity providers, enabling seamless single sign-on (SSO) without requiring the partner users to create new accounts in your tenant.

Answer

App Registrations

Answer

B2C collaboration

Answer

Device Registration

Question 3

A user is locked out of their account after multiple failed sign-in attempts. You need to reduce false lockouts while maintaining security. What should you do?

Accepted Answer

Enable Smart Lockout. Smart lockout learns user behavior and reduces false lockouts. Option A is wrong because requiring MFA does not prevent account lockouts; it adds another authentication factor but does not affect the lockout policy. Option B is wrong because disabling account lockout reduces security. Option D is wrong because increasing the lockout threshold may increase risk by allowing more brute-force attempts.

Answer

Require MFA for all users

Answer

Disable account lockout

Answer

Increase lockout threshold to 20 attempts

Question 4

Your organization has multiple on-premises directories and wants to synchronize them to Microsoft Entra ID. However, you must avoid duplicate user objects. Which feature should you configure?

Accepted Answer

Source anchor attribute. The source anchor attribute (often the objectGUID in on-premises directories) is used during synchronization to uniquely identify each object and prevent duplicates. By mapping each on-premises object to a single, immutable source anchor, Microsoft Entra Connect ensures that even if multiple directories contain the same user, only one corresponding object is created in Entra ID.

Answer

Password Hash Sync

Answer

Pass-through Authentication

Answer

Active Directory Federation Services

Question 5

Which THREE are features of Microsoft Entra ID? (Choose three.)

Accepted Answer

Multifactor authentication. Microsoft Entra ID provides multifactor authentication (MFA) as a core identity security feature, requiring users to verify their identity using two or more methods such as a password plus a phone call or mobile app notification. This significantly reduces the risk of credential theft and unauthorized access.

Answer

Firewall management

Answer

Anti-malware protection

Question 6

Which TWO are capabilities of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management and Access Reviews are capabilities of Entra ID Governance. Conditional Access is a separate feature, Identity Protection is security, and SSPR is user self-service.

Answer

Self-service password reset

Answer

Identity Protection

Answer

Conditional Access

Question 7

Refer to the exhibit. The JSON snippet shows an app registration in Microsoft Entra ID. The password credential endDateTime is set to 2025-12-31. What will happen when that date is reached?

Accepted Answer

The app will be unable to authenticate using that secret.. When the password credential (client secret) reaches its endDateTime, the secret expires and becomes invalid. Microsoft Entra ID does not automatically renew secrets; the application must use a valid secret to authenticate. Once expired, any authentication attempt using that secret will fail, preventing the app from obtaining tokens.

Answer

The secret will renew automatically.

Answer

The app registration will be automatically deleted.

Answer

The app will be blocked from signing in.

Question 8

Refer to the exhibit. A Microsoft Graph PowerShell script is shown. What is the purpose of this script?

Accepted Answer

Register a phone authentication method for users.. The script uses the `New-MgUserAuthenticationPhoneMethod` cmdlet to register a phone number as an authentication method for a user in Microsoft Entra ID. This cmdlet specifically creates a phone authentication method, which can be used for multifactor authentication or self-service password reset, but its direct purpose is to register the phone method itself.

Answer

Configure self-service password reset settings.

Answer

Reset passwords for all users named John.

Answer

Enable multifactor authentication for the users.

Question 9

Refer to the exhibit. The JSON shows a conditional access policy. What is the effect of this policy?

Accepted Answer

Requires MFA for Office 365 from trusted locations.. The policy assigns the 'Require multifactor authentication' grant to Office 365 cloud apps, and the condition restricts it to 'trusted locations' (typically corporate networks or compliant IP ranges). This means users accessing Office 365 from those trusted locations must complete MFA, while access from untrusted locations is not affected by this policy (it may be handled by other policies). Option A correctly describes this effect.

Answer

Applies only to external guest users.

Answer

Blocks all access to Office 365 from trusted locations.

Answer

Requires a compliant device for Office 365.

Question 10

Your company uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2C) is the correct feature because it is specifically designed to enable external identities, including social identity providers like Google, Facebook, and Microsoft accounts, for customer-facing applications. It supports standards such as OAuth 2.0 and OpenID Connect to allow users to sign in with their existing social media accounts without needing a separate Microsoft Entra ID account.

Answer

Microsoft Entra B2B collaboration

Answer

Conditional Access policies

Answer

Privileged Identity Management

Question 11

A user reports that they cannot access the corporate portal after a password reset. The user can access other cloud apps. You verify that the user account is enabled and not locked. What should you check next?

Accepted Answer

Verify the user's registered authentication methods. The user can access other cloud apps, which rules out a global authentication or network issue. Since the account is enabled and not locked, the most likely cause is that the user's registered authentication methods (e.g., phone, authenticator app, or email) are missing, outdated, or not configured for the password reset flow. Microsoft Entra ID requires verified authentication methods to complete a password reset and subsequent sign-in, especially when the user is prompted for multifactor authentication or self-service password reset (SSPR) verification.

Answer

Disable and re-enable the user account

Answer

Reinstall the corporate portal application

Answer

Check if the user is assigned a Microsoft Entra ID P2 license

Question 12

Your organization plans to migrate from on-premises Active Directory to Microsoft Entra ID. You need to design the identity synchronization strategy to support password hash synchronization and password writeback. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool because it supports both password hash synchronization and password writeback, which are required for the migration scenario. Password hash sync synchronizes a hash of the on-premises AD password to Entra ID, while password writeback enables password changes in the cloud to be written back to on-premises AD. Entra Connect is the primary hybrid identity tool that integrates on-premises directories with Microsoft Entra ID, offering these features natively.

Answer

Microsoft Identity Manager

Answer

Active Directory Federation Services

Answer

Microsoft Entra Cloud Sync

Question 13

You need to provide external partners with access to your organization's SharePoint site. The partners must use their own credentials. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it enables external users (partners) to access your organization's resources using their own identities (e.g., work, social, or other Azure AD accounts). It leverages the existing Azure AD tenant to issue guest user objects and supports SAML/WS-Federation or OIDC for authentication, allowing partners to authenticate with their own credentials without requiring a separate account or password in your tenant.

Answer

Microsoft Entra Identity Governance

Answer

Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 14

A user reports that they are repeatedly prompted for multifactor authentication when accessing Microsoft 365 apps from the same trusted device. What should you do to reduce the number of prompts?

Accepted Answer

Configure 'Remember MFA' settings in Conditional Access. The 'Remember MFA' setting in Conditional Access allows administrators to configure the session lifetime for MFA prompts on trusted devices. By extending the 'MFA reauthentication frequency' or enabling 'Remember Multifactor Authentication' for a longer period (e.g., 30 days), users will not be repeatedly challenged on the same device, reducing friction while maintaining security.

Answer

Disable MFA for the user

Answer

Change the user's MFA method to text message

Answer

Reset the user's MFA registration

Question 15

Your organization uses Microsoft Entra ID P2 licenses. You need to implement a process to automatically remove users from a group if they have not signed in for 90 days. Which feature should you use?

Accepted Answer

Access reviews in Identity Governance. Access reviews in Identity Governance allow you to automate the review and removal of group memberships based on inactivity criteria, such as users who haven't signed in for 90 days. This feature is specifically designed for periodic attestation and lifecycle management of group memberships, leveraging Microsoft Entra ID P2 licenses.

Answer

Conditional Access policy

Answer

Privileged Identity Management

Answer

Microsoft Entra ID Protection