SC-900 Describe the capabilities of Microsoft Entra Practice Test 19 — 15 Questions

Question 1

Which THREE components are part of the Microsoft Entra External Identities suite?

Accepted Answer

B2B direct connect. Microsoft Entra External Identities is the suite of capabilities for managing external users, and it comprises three components: B2B collaboration (D), B2B direct connect (A), and B2C (business-to-consumer) (C). B2B collaboration (D) lets you invite partner users as guests into your tenant, where they authenticate with their own credentials and appear as guest objects in your directory. B2B direct connect (A) enables a mutual, two-way trust with another Microsoft Entra tenant so users can seamlessly access shared resources such as Teams shared channels without being represented as guests in your directory. B2C (C) provides identity and access management for consumer-facing applications, letting customers sign in with local or social identities. Conditional Access (B) and Identity Protection (E) are Microsoft Entra ID security features that govern and protect sign-ins, but they are not components of the External Identities suite.

Answer

Conditional Access

Answer

Identity Protection

Question 2

Which TWO features are included in Microsoft Entra ID P2 licensing?

Accepted Answer

Microsoft Entra Privileged Identity Management. Microsoft Entra ID P2 includes Microsoft Entra Privileged Identity Management (D), which provides just-in-time privileged role activation, access reviews, and approval workflows for administrative roles, and Microsoft Entra Identity Protection (E), which delivers risk-based Conditional Access policies, user and sign-in risk detection, and automated remediation of risky identities. These two capabilities are the distinguishing features that separate Entra ID P2 from P1, since P1 already covers the baseline identity features. Passwordless authentication (A), multifactor authentication (B), and single sign-on to SaaS apps (C) are all included in Entra ID P1 (and in large part in the free tier), so they are not exclusive to or introduced by P2 licensing.

Answer

Passwordless authentication

Answer

Multifactor authentication (MFA)

Answer

Single sign-on (SSO) to SaaS apps

Question 3

You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?

Accepted Answer

Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.. B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.

Answer

Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.

Answer

Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.

Answer

Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.

Question 4

You are an identity consultant for a mid-sized company with 5,000 employees. They use Microsoft Entra ID P1 and Microsoft Intune for device management. The company wants to implement passwordless authentication for all employees to improve security and user experience. Currently, users sign in with username and password plus MFA via the Microsoft Authenticator app. The company has a mix of Windows 10/11 devices (both domain-joined and Microsoft Entra joined) and iOS/Android mobile devices. They want to support passwordless sign-in on all platforms. The CTO is concerned about cost and wants to minimize additional licensing. Which passwordless method should you recommend?

Accepted Answer

Use the Microsoft Authenticator app for passwordless sign-in. The Microsoft Authenticator app supports passwordless sign-in using phone-based authentication, which works on both iOS and Android devices and can be used to sign into Windows 10/11 devices via the 'Sign in with phone' feature. This method leverages existing Microsoft Entra ID P1 licensing without requiring additional costs, as it is included with the current P1 license. It provides a seamless user experience by eliminating the need for hardware tokens or additional infrastructure, aligning with the CTO's cost-minimization goal.

Answer

Enable Windows Hello for Business for all devices

Answer

Deploy FIDO2 security keys to all employees

Answer

Implement SMS-based one-time passcodes

Question 5

You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?

Accepted Answer

Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration. Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra access reviews

Question 6

Your organization is planning to implement Microsoft Entra ID for identity and access management. Which TWO capabilities are provided by Microsoft Entra ID?

Accepted Answer

Identity governance (e.g., access reviews). Microsoft Entra ID provides identity governance capabilities such as access reviews, which allow administrators to automate the process of reviewing and certifying user access to applications and groups. This ensures compliance and security by regularly validating that users have appropriate access rights. Single sign-on (SSO) is a core feature of Entra ID, enabling users to authenticate once and access multiple cloud applications without re-entering credentials, leveraging protocols like OAuth 2.0 and SAML 2.0.

Answer

External identity management for customer-facing apps

Answer

Security event log analysis

Answer

Mobile device management (MDM)

Question 7

You are a security architect for a large enterprise using Microsoft Entra ID. You need to implement a solution that enforces least-privilege access and reduces lateral movement. Which THREE Microsoft Entra capabilities should you include in your design?

Accepted Answer

Identity Protection. Identity Protection is correct because it uses machine learning to detect and automatically respond to identity-based risks, such as leaked credentials or anomalous sign-in patterns, which directly reduces the attack surface and limits lateral movement by blocking or challenging risky authentications before an attacker can pivot.

Answer

Password hash synchronization

Answer

Microsoft Defender for Cloud Apps

Question 8

Your company, Contoso, uses Microsoft Entra ID for employee identity management. You need to ensure that when an employee leaves the company, their access to all SaaS applications is automatically revoked within 24 hours. The HR department updates the employee status in a cloud HR system (Workday). What should you do?

Accepted Answer

Configure Microsoft Entra ID provisioning from Workday to automatically disable users when their employment status changes.. Microsoft Entra ID supports automated user provisioning from Workday via the built-in Workday to Entra ID provisioning connector. When an employee's status changes to 'terminated' in Workday, the provisioning service automatically disables the corresponding user account in Entra ID, typically within 40 minutes (well under the 24-hour requirement). This eliminates manual intervention and ensures timely revocation of access to all SaaS applications integrated with Entra ID.

Answer

Ask HR to manually disable each user in Microsoft Entra ID after termination.

Answer

Use Microsoft Graph API to write a custom application that polls Workday and disables users.

Answer

Create an Azure Automation runbook that runs daily and checks Workday for terminated employees, then disables them in Entra ID.

Question 9

Your organization is using Microsoft Entra ID with P2 licenses. You need to enforce a policy that requires administrators to request approval before activating their privileged roles, and approvals must expire after 8 hours. Additionally, you need to ensure that all privileged role activations are logged for auditing. Which combination of Microsoft Entra capabilities should you use?

Accepted Answer

Configure Privileged Identity Management (PIM) for role activation with approval and expiration, and use PIM audit logs.. Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time role activation with configurable approval workflows and expiration durations, meeting the requirement for administrators to request approval and for approvals to expire after 8 hours. PIM audit logs capture all activation events, including who approved, when, and for which role, fulfilling the auditing requirement. This combination directly addresses the policy needs without relying on unrelated capabilities like user risk policies or access reviews.

Answer

Implement Identity Protection user risk policy to block high-risk admins, and use sign-in logs.

Answer

Create a Conditional Access policy requiring multi-factor authentication for admins, and use activity logs.

Answer

Set up Azure AD Access Reviews to require monthly review of privileged roles, and enable diagnostic settings.

Question 10

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that users can use the same password on-premises and in the cloud without having to sync password hashes. Additionally, you want to prevent accounts from being locked out after a few bad password attempts in the cloud. Which Microsoft Entra feature should you implement?

Accepted Answer

Deploy password writeback and enable Microsoft Entra smart lockout.. Password writeback enables password changes made in the cloud to be written back to on-premises Active Directory, ensuring the same password is used without syncing password hashes. Microsoft Entra smart lockout prevents accounts from being locked out after a few bad password attempts in the cloud by intelligently recognizing and blocking malicious sign-in attempts while allowing legitimate users to continue, without locking the on-premises account.

Answer

Use password hash synchronization and set up custom lockout policies.

Answer

Implement federation with Active Directory Federation Services (AD FS).

Answer

Implement pass-through authentication and configure on-premises lockout thresholds.

Question 11

Your organization uses Microsoft Entra ID and has deployed Microsoft Entra ID Governance for entitlement management. You need to allow external partners to request access to a specific application, but only if they have a valid email address from an approved domain. Once approved, their access should automatically expire after 30 days. You also need to ensure that the partner's access is reviewed quarterly by the application owner. What should you configure?

Accepted Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, set expiration to 30 days, and add a quarterly access review.. It combines all required components: a connected organization restricts access to approved partner domains, the access package includes the application as a resource, approval ensures authorization, a 30-day expiration enforces automatic access removal, and a quarterly access review satisfies ongoing compliance. Microsoft Entra ID Governance entitlement management uses access packages to bundle resources, policies, and reviews for external collaboration.

Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, and set expiration to 30 days.

Answer

Create a dynamic group based on partner email domain and assign the application to the group with a 30-day expiration policy.

Answer

Add the partner as a guest user manually and assign the application directly with an expiration date.

Question 12

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. Option D is correct because it combines the two features that directly address both requirements: a Conditional Access policy with the 'Require device to be marked as compliant' grant control ensures only Intune-compliant devices can access Exchange Online from Outlook mobile, while an Intune app protection policy (MAM) applied to Outlook enforces data-sharing restrictions such as blocking copy/paste to unmanaged personal apps. These work together via app-based Conditional Access, where the compliant-device requirement gates access and the MAM policy governs how corporate data can be used within the app. Option A is wrong because hybrid Microsoft Entra ID join and Windows Autopilot target Windows device provisioning, not iOS/Android Outlook access or app-level data controls. Option B is wrong because MFA and Windows Hello for Business address authentication strength on Windows, not device compliance or data leakage prevention. Option C is wrong because Microsoft Entra application proxy publishes on-premises web apps and does not prevent copy/paste of corporate data in mobile apps.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 13

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

Accepted Answer

Deploy Microsoft Authenticator with phone sign-in enabled for all users.. Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Answer

Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

Answer

Implement certificate-based authentication using smart cards.

Answer

Enable Windows Hello for Business on all Windows devices.

Question 14

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution that automatically detects and remediates users with leaked credentials. Additionally, you need to require users to change their password when a high risk is detected. Which Microsoft Entra features should you configure?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.. Microsoft Entra Identity Protection detects leaked credentials by monitoring for credential exposures on the dark web and other sources. Configuring a user risk policy to require a password change when risk is medium or high automatically remediates the detected risk by forcing the user to update their password, directly addressing the requirement for automatic detection and remediation.

Answer

Create an Access Review for all users and require them to confirm their access quarterly.

Answer

Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

Answer

Configure a Conditional Access policy to require password change when sign-in risk is high.

Question 15

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management (PIM)