SC-900 Describe the capabilities of Microsoft Entra Practice Test 18 — 15 Questions

Question 1

You need to allow users to reset their own passwords without contacting the help desk. Which Microsoft Entra feature should you enable?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature that allows users to reset their own passwords without contacting the help desk. It is designed to reduce help desk costs and improve user productivity by enabling password changes or unlocks through a verified authentication method, such as email, phone, or security questions.

Answer

Microsoft Authenticator

Answer

Identity Governance

Answer

Conditional Access

Question 2

Your organization requires that all external guest users must sign in using Microsoft Authenticator for MFA. What should you configure?

Accepted Answer

Conditional Access policy. A Conditional Access policy is the correct choice because it allows you to enforce MFA requirements for specific users, including external guest users, based on conditions such as sign-in risk, location, or device state. By targeting the 'Guest or external users' directory role in a Conditional Access policy, you can require Microsoft Authenticator as the MFA method, overriding default settings. This provides granular control over authentication behavior for B2B collaboration guests.

Answer

Microsoft Entra B2B collaboration settings

Answer

Access reviews

Answer

ID Protection policies

Question 3

You need to implement a solution that allows users to access cloud applications without entering a password, using Windows Hello for Business. Which Microsoft Entra feature integrates with Windows Hello for Business?

Accepted Answer

Microsoft Entra ID. Windows Hello for Business integrates with Microsoft Entra ID (formerly Azure AD) to enable passwordless authentication. When a user enrolls a device with Windows Hello for Business, the biometric or PIN credential is bound to the device's TPM and linked to the user's identity in Microsoft Entra ID, allowing seamless access to cloud applications without a password.

Answer

Conditional Access

Answer

FIDO2 security keys

Answer

Microsoft Authenticator

Question 4

Which TWO capabilities are provided by Microsoft Entra ID?

Accepted Answer

Multifactor authentication. Options A and D are correct. Microsoft Entra ID provides multifactor authentication and single sign-on capabilities. Option B (Device management) is incorrect because device management is primarily handled by Microsoft Intune, part of Microsoft Endpoint Manager. Option C (Security incident detection) is incorrect because security incident detection is provided by Microsoft Sentinel, a SIEM solution. Option E (Data classification) is incorrect because data classification is a feature of Microsoft Purview (formerly Azure Information Protection).

Answer

Device management

Answer

Security incident detection

Answer

Data classification

Question 5

Which TWO Microsoft Entra features can help protect against credential attacks?

Accepted Answer

Microsoft Entra password protection. Microsoft Entra password protection (C) helps defend against credential attacks by automatically blocking weak passwords and common variations of known compromised passwords, such as those from botnets or public password lists. Smart lockout (E) protects against brute-force attacks by locking an account after a configurable number of failed sign-in attempts, using intelligent heuristics to distinguish between legitimate users and attackers. Both features directly mitigate password-based attacks like password spraying and brute force.

Answer

Microsoft Entra Connect

Answer

Self-service password reset

Answer

Access reviews

Question 6

Refer to the exhibit. You are reviewing a Privileged Identity Management (PIM) configuration for a role in Microsoft Entra ID. The roleDefinitionId corresponds to a specific role. What is the effect of this configuration?

Accepted Answer

The user is eligible for the role indefinitely, but activation requires approval and lasts up to 1 hour.. The configuration shown in the exhibit sets the role assignment to 'Eligible' with an activation duration of 1 hour and requires approval (the approval toggle is on). An 'Eligible' assignment means the user is not permanently active; they must activate the role when needed. The requirement for approval ensures that an authorized approver must approve each activation request. The 1-hour duration limits how long each activation lasts. This matches the description of being eligible indefinitely, with activation requiring approval and lasting up to 1 hour.

Answer

The user is permanently activated for the role for 1 hour.

Answer

The user is permanently assigned the role for 1 hour.

Answer

The user can activate the role without approval for up to 1 hour.

Question 7

A company uses Microsoft Entra ID for identity management. They want to allow employees to sign in using their existing Facebook credentials. Which feature should they configure?

Accepted Answer

Microsoft Entra External Identities. Microsoft Entra External Identities is the feature that allows configuring social identity providers like Facebook as authentication sources. While it is primarily designed for external users (guests/customers), it can also be used for internal employees if the organization chooses to allow federation with social identity providers. The question tests whether you know that External Identities handles social identity provider integration, regardless of the user type.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Question 8

A user reports that they cannot access a critical application, receiving an error that their session has expired. The sign-in logs show the user was prompted for multifactor authentication (MFA) multiple times during the same session. What should an administrator review to reduce these interruptions?

Accepted Answer

Microsoft Entra Conditional Access session controls. Session controls in Conditional Access policies can be configured to reduce repeated MFA prompts within the same session, such as by adjusting the sign-in frequency or persistent browser session settings. Option A is wrong because tenant-wide MFA settings enforce MFA globally but do not control session-specific behavior. Option C is wrong because Identity Protection focuses on risk-based policies, not directly on session lifetime. Option D is wrong because Privileged Identity Management manages role activation and assignment, not session controls.

Answer

Microsoft Entra tenant-wide MFA settings

Answer

Microsoft Entra Identity Protection policies

Answer

Microsoft Entra Privileged Identity Management settings

Question 9

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have multiple on-premises applications that use LDAP for authentication. They want to enable single sign-on (SSO) to these applications from the cloud without modifying the applications. Which approach should they use?

Accepted Answer

Microsoft Entra Domain Services. Microsoft Entra Domain Services provides managed domain services such as LDAP, Kerberos, and NTLM authentication without requiring you to deploy and manage domain controllers. Since the on-premises applications use LDAP for authentication and cannot be modified, Entra Domain Services can be used to lift and shift these applications into Azure while enabling SSO from the cloud, as it presents a compatible LDAP interface that the applications can continue to use.

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Pass-through authentication

Answer

Password hash synchronization with Seamless SSO

Question 10

A company uses Microsoft Entra ID. The security team wants to automatically block sign-ins from IP addresses that exhibit brute-force attack patterns. Which capability should they enable?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct capability because it uses machine learning and heuristic detection to automatically identify and block sign-ins from IP addresses exhibiting brute-force attack patterns, such as repeated failed authentication attempts. It can trigger risk-based policies, including blocking access or requiring multi-factor authentication, without manual intervention. This directly addresses the security team's requirement to automate the response to brute-force patterns.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra External Identities

Answer

Microsoft Entra Conditional Access

Question 11

An administrator needs to grant a vendor temporary access to an Azure subscription for exactly 48 hours. After that time, access must be automatically revoked. Which Microsoft Entra feature should be used?

Accepted Answer

Microsoft Entra Privileged Identity Management. Microsoft Entra Privileged Identity Management (PIM) allows administrators to configure just-in-time (JIT) access with time-bound activation and automatic expiration. By setting a maximum activation duration of 48 hours for a role assignment, PIM ensures the vendor's access is automatically revoked after that period without manual intervention.

Answer

Microsoft Entra External Identities

Answer

Microsoft Entra access reviews

Answer

Microsoft Entra Conditional Access

Question 12

A multinational company uses Microsoft Entra ID. They want to ensure that users from a specific country only access a sensitive application from compliant devices. Additionally, they want to block access if the sign-in risk is medium or high. Which combination of policies should they create?

Accepted Answer

A Conditional Access policy with conditions for location, device compliance, and sign-in risk. A single Conditional Access policy can combine multiple conditions—such as location (country), device compliance (via integration with Intune), and sign-in risk—to enforce granular access controls. This allows the company to require compliant devices and block access when sign-in risk is medium or high, all within one policy.

Answer

A Conditional Access session policy to enforce sign-in frequency

Answer

A device compliance policy in Microsoft Intune

Answer

A Conditional Access policy requiring MFA from that country

Question 13

A company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which feature provides this capability?

Accepted Answer

Microsoft Entra federation with SaaS applications. Microsoft Entra federation with SaaS applications (Option A) enables single sign-on (SSO) by establishing a trust relationship between Microsoft Entra ID and third-party SaaS apps like Salesforce and ServiceNow. This allows users to authenticate using their corporate Entra ID credentials via federation protocols such as SAML 2.0 or OpenID Connect, eliminating the need for separate credentials.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 14

A company is using Microsoft Entra ID to manage identities for a multi-tenant SaaS application. They want to allow users from partner organizations to access the application using their own corporate credentials, without needing to manage separate accounts. Which solution should they implement?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct solution because it enables partner users to access the company's multi-tenant SaaS application using their own corporate credentials, without requiring separate accounts. B2B collaboration supports cross-tenant access by creating lightweight guest user objects in the resource tenant, which can authenticate via their home tenant's identity provider. This aligns with the requirement to allow partner organizations to use their existing credentials while avoiding account management overhead.

Answer

Microsoft Entra B2C

Answer

Microsoft Entra federation with the partner's identity provider

Answer

Microsoft Entra provisioning service

Question 15

You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?

Accepted Answer

Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.. B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.

Answer

Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.

Answer

Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.

Answer

Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.