SC-900 Describe the capabilities of Microsoft Entra Practice Test 18 — 15 Questions

Question 1

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. Option A is correct because Conditional Access can require compliant devices, and app protection policies (MAM) can prevent data transfer to unprotected apps. Option B is wrong because Autopilot is for device provisioning. Option C is wrong because Windows Hello for Business is for passwordless sign-in. Option D is wrong because Azure AD Application Proxy is for on-premises app access.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 2

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

Accepted Answer

Deploy Microsoft Authenticator with phone sign-in enabled for all users.. Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Answer

Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

Answer

Implement certificate-based authentication using smart cards.

Answer

Enable Windows Hello for Business on all Windows devices.

Question 3

Your organization wants to allow employees to use their personal mobile devices to access corporate resources, but you need to ensure that corporate data is protected if the device is lost or stolen. You also need to enforce a PIN policy on the device. Which combination of Microsoft Entra and Microsoft Intune features should you use?

Accepted Answer

Enroll devices in Microsoft Intune MDM, create a device compliance policy requiring PIN, and configure a Conditional Access policy to allow only compliant devices.. Option A is correct because MDM enrollment with compliance policies enforces PIN and allows selective wipe of corporate data. Option B is wrong because MAM without enrollment can enforce PIN but selective wipe is limited. Option C is wrong because Conditional Access alone does not enforce device policies. Option D is wrong because Autopilot is for provisioning, not protection.

Answer

Use Windows Autopilot to configure devices and then apply a device restriction policy.

Answer

Implement a Conditional Access policy requiring multi-factor authentication and trusted locations.

Answer

Use Microsoft Intune app protection policies (MAM) without device enrollment, requiring PIN for managed apps.

Question 4

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution that automatically detects and remediates users with leaked credentials. Additionally, you need to require users to change their password when a high risk is detected. Which Microsoft Entra features should you configure?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.. Option A is correct because Microsoft Entra Identity Protection detects leaked credentials by monitoring for credential exposures on the dark web and other sources. Configuring a user risk policy to require a password change when risk is medium or high automatically remediates the detected risk by forcing the user to update their password, directly addressing the requirement for automatic detection and remediation.

Answer

Create an Access Review for all users and require them to confirm their access quarterly.

Answer

Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

Answer

Configure a Conditional Access policy to require password change when sign-in risk is high.

Question 5

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 6

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

Accepted Answer

The corporate laptops are not marked as compliant devices.. The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Answer

Users are authenticating via device code flow.

Answer

The Conditional Access policy has the 'Persistent browser session' setting enabled.

Answer

The policy is blocking legacy authentication.

Question 7

Your organization uses Microsoft Entra ID. You need to grant external partners limited access to a SharePoint site for 30 days. After 30 days, access should automatically expire. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra entitlement management. Microsoft Entra entitlement management allows you to create access packages that grant external users time-limited access to resources like SharePoint sites. By configuring an access package with a 30-day expiration policy, access is automatically revoked when the policy expires, meeting the requirement exactly.

Answer

Microsoft Entra access reviews

Answer

Microsoft Entra B2B guest user accounts

Answer

Microsoft Entra Conditional Access

Question 8

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

Accepted Answer

Microsoft Authenticator app (passwordless). The Microsoft Authenticator app (passwordless) allows users to sign in to Microsoft Entra ID using biometrics (fingerprint, face, or PIN) on their mobile device without entering a password. This feature uses the device's built-in biometric capabilities to verify the user's identity, making it the correct choice for the described scenario.

Answer

Windows Hello for Business

Answer

SMS-based sign-in

Answer

FIDO2 security keys

Question 9

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs. Which statement is true?

Accepted Answer

asmith's sign-in was likely from an application or service principal.. Option C is correct because the sign-in log entry for asmith shows an 'Application' sign-in type, which indicates the authentication was performed by an application or service principal rather than a user. In Microsoft Entra ID, sign-ins from applications or service principals are logged with a distinct sign-in type, and the exhibit displays 'Application' for asmith's entry, confirming this.

Answer

jdoe's sign-in had no risk detected.

Answer

jdoe's sign-in failed Conditional Access.

Answer

asmith's sign-in had a high risk level.

Question 10

Your company uses Microsoft Entra ID. You need to enforce that all users accessing the HR application must have a device that is compliant with company security policies. The device compliance is managed by Microsoft Intune. Which feature should you use to enforce this requirement?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it allows you to create policies that evaluate conditions such as device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can check the device compliance status reported by Intune and block or allow access to the HR application accordingly. This enforces the requirement that only compliant devices can access the app, without requiring users to authenticate differently.

Answer

Microsoft Intune device compliance policies

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra device registration

Question 11

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that when a user's on-premises account is disabled, their cloud account is automatically disabled within 5 minutes. Which configuration should you use?

Accepted Answer

Microsoft Entra Connect with directory sync configured for 5-minute sync interval. Option C is correct because Microsoft Entra Connect with directory synchronization configured for a 5-minute sync interval ensures that changes made to on-premises Active Directory (such as disabling a user account) are replicated to Microsoft Entra ID within that interval. This meets the requirement of automatically disabling the cloud account within 5 minutes of the on-premises change.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access with session controls

Answer

Microsoft Entra Connect Health

Question 12

You are configuring Microsoft Entra ID for a new user. The user will need to access resources in multiple Microsoft cloud services (Office 365, Azure, Dynamics 365). Which Microsoft Entra edition is minimally required to provide single sign-on (SSO) across these services?

Accepted Answer

Microsoft Entra ID Free. Microsoft Entra ID Free (included with Office 365) provides SSO across Microsoft cloud services like Office 365, Azure, and Dynamics 365 because it supports federated identity and the same user identity is used across all these services. SSO is a core capability of the Free edition, requiring no additional licensing for this specific scenario. The question asks for the minimally required edition, and since Free supports SSO across these services, it is the correct choice.

Answer

Microsoft Entra ID Free (included with Office 365)

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID P1

Question 13

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra entitlement management

Question 14

Which two capabilities are provided by Microsoft Entra ID? (Choose two.)

Accepted Answer

Conditional Access policies. Conditional Access policies (B) are a core capability of Microsoft Entra ID, enabling administrators to enforce access controls based on signals like user location, device state, and application sensitivity. Identity Protection with risk-based conditional access (C) leverages machine learning to detect sign-in and user risks, automatically applying policies to block or require multi-factor authentication. Both are native to Microsoft Entra ID and integral to its identity and access management (IAM) framework.

Answer

Mobile device management (MDM)

Answer

Data loss prevention (DLP) for sensitive information

Answer

Cloud access security broker (CASB)

Question 15

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Accepted Answer

Access reviews. Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Answer

Conditional Access policies

Answer

Self-service password reset (SSPR) with writeback