SC-900 Describe the capabilities of Microsoft Entra Practice Test 19 — 15 Questions

Question 1

You are an identity consultant for a mid-sized company with 5,000 employees. They use Microsoft Entra ID P1 and Microsoft Intune for device management. The company wants to implement passwordless authentication for all employees to improve security and user experience. Currently, users sign in with username and password plus MFA via the Microsoft Authenticator app. The company has a mix of Windows 10/11 devices (both domain-joined and Microsoft Entra joined) and iOS/Android mobile devices. They want to support passwordless sign-in on all platforms. The CTO is concerned about cost and wants to minimize additional licensing. Which passwordless method should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Authenticator app for passwordless sign-in. The Microsoft Authenticator app supports passwordless sign-in using phone-based authentication, which works on both iOS and Android devices and can be used to sign into Windows 10/11 devices via the 'Sign in with phone' feature. This method leverages existing Microsoft Entra ID P1 licensing without requiring additional costs, as it is included with the current P1 license. It provides a seamless user experience by eliminating the need for hardware tokens or additional infrastructure, aligning with the CTO's cost-minimization goal.

Answer

Enable Windows Hello for Business for all devices

Answer

Deploy FIDO2 security keys to all employees

Answer

Implement SMS-based one-time passcodes

Question 2

You are a security administrator for a company using Microsoft Entra ID P2. The company has a critical application that should only be accessible by a specific group of users (the 'Finance' group). You need to ensure that any access to this application is automatically logged and that an administrator is notified when a user outside the Finance group attempts to access it. Additionally, the CEO wants a quarterly review of all users who have access to this application. Which combination of features should you use?

Accepted Answer

Create a Conditional Access policy that restricts access to the Finance group, configure audit logging for the application, and set up an access review for the Finance group.. It combines Conditional Access to restrict access to the Finance group, audit logging to log access attempts (and trigger alerts), and access reviews for quarterly recertification. Option A is wrong because B2B collaboration is for external users, not for internal group-based access control. Option B is wrong because Identity Protection is for risk detection, not for group-based access restrictions. Option C is wrong because Privileged Identity Management (PIM) is for managing privileged roles, not for assigning application access to standard user groups.

Answer

Grant access to the application via B2B collaboration and configure auditing.

Answer

Use Identity Protection to detect access attempts from non-Finance users and send alerts.

Answer

Assign the application to the Finance group using Privileged Identity Management, and enable sign-in logs.

Question 3

You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?

Accepted Answer

Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration. Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra access reviews

Question 4

Your organization is planning to implement Microsoft Entra ID for identity and access management. Which TWO capabilities are provided by Microsoft Entra ID?

Accepted Answer

Identity governance (e.g., access reviews). Microsoft Entra ID provides identity governance capabilities such as access reviews, which allow administrators to automate the process of reviewing and certifying user access to applications and groups. This ensures compliance and security by regularly validating that users have appropriate access rights. Single sign-on (SSO) is a core feature of Entra ID, enabling users to authenticate once and access multiple cloud applications without re-entering credentials, leveraging protocols like OAuth 2.0 and SAML 2.0.

Answer

External identity management for customer-facing apps

Answer

Security event log analysis

Answer

Mobile device management (MDM)

Question 5

You are a security architect for a large enterprise using Microsoft Entra ID. You need to implement a solution that enforces least-privilege access and reduces lateral movement. Which THREE Microsoft Entra capabilities should you include in your design?

Accepted Answer

Identity Protection. Identity Protection is correct because it uses machine learning to detect and automatically respond to identity-based risks, such as leaked credentials or anomalous sign-in patterns, which directly reduces the attack surface and limits lateral movement by blocking or challenging risky authentications before an attacker can pivot.

Answer

Password hash synchronization

Answer

Microsoft Defender for Cloud Apps

Question 6

Your company, Contoso, uses Microsoft Entra ID for employee identity management. You need to ensure that when an employee leaves the company, their access to all SaaS applications is automatically revoked within 24 hours. The HR department updates the employee status in a cloud HR system (Workday). What should you do?

Accepted Answer

Configure Microsoft Entra ID provisioning from Workday to automatically disable users when their employment status changes.. Microsoft Entra ID supports automated user provisioning from Workday via the built-in Workday to Entra ID provisioning connector. When an employee's status changes to 'terminated' in Workday, the provisioning service automatically disables the corresponding user account in Entra ID, typically within 40 minutes (well under the 24-hour requirement). This eliminates manual intervention and ensures timely revocation of access to all SaaS applications integrated with Entra ID.

Answer

Ask HR to manually disable each user in Microsoft Entra ID after termination.

Answer

Use Microsoft Graph API to write a custom application that polls Workday and disables users.

Answer

Create an Azure Automation runbook that runs daily and checks Workday for terminated employees, then disables them in Entra ID.

Question 7

Your organization is using Microsoft Entra ID with P2 licenses. You need to enforce a policy that requires administrators to request approval before activating their privileged roles, and approvals must expire after 8 hours. Additionally, you need to ensure that all privileged role activations are logged for auditing. Which combination of Microsoft Entra capabilities should you use?

Accepted Answer

Configure Privileged Identity Management (PIM) for role activation with approval and expiration, and use PIM audit logs.. Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time role activation with configurable approval workflows and expiration durations, meeting the requirement for administrators to request approval and for approvals to expire after 8 hours. PIM audit logs capture all activation events, including who approved, when, and for which role, fulfilling the auditing requirement. This combination directly addresses the policy needs without relying on unrelated capabilities like user risk policies or access reviews.

Answer

Implement Identity Protection user risk policy to block high-risk admins, and use sign-in logs.

Answer

Create a Conditional Access policy requiring multi-factor authentication for admins, and use activity logs.

Answer

Set up Azure AD Access Reviews to require monthly review of privileged roles, and enable diagnostic settings.

Question 8

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that users can use the same password on-premises and in the cloud without having to sync password hashes. Additionally, you want to prevent accounts from being locked out after a few bad password attempts in the cloud. Which Microsoft Entra feature should you implement?

Accepted Answer

Deploy password writeback and enable Microsoft Entra smart lockout.. Password writeback enables password changes made in the cloud to be written back to on-premises Active Directory, ensuring the same password is used without syncing password hashes. Microsoft Entra smart lockout prevents accounts from being locked out after a few bad password attempts in the cloud by intelligently recognizing and blocking malicious sign-in attempts while allowing legitimate users to continue, without locking the on-premises account.

Answer

Use password hash synchronization and set up custom lockout policies.

Answer

Implement federation with Active Directory Federation Services (AD FS).

Answer

Implement pass-through authentication and configure on-premises lockout thresholds.

Question 9

Your organization uses Microsoft Entra ID and has deployed Microsoft Entra ID Governance for entitlement management. You need to allow external partners to request access to a specific application, but only if they have a valid email address from an approved domain. Once approved, their access should automatically expire after 30 days. You also need to ensure that the partner's access is reviewed quarterly by the application owner. What should you configure?

Accepted Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, set expiration to 30 days, and add a quarterly access review.. It combines all required components: a connected organization restricts access to approved partner domains, the access package includes the application as a resource, approval ensures authorization, a 30-day expiration enforces automatic access removal, and a quarterly access review satisfies ongoing compliance. Microsoft Entra ID Governance entitlement management uses access packages to bundle resources, policies, and reviews for external collaboration.

Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, and set expiration to 30 days.

Answer

Create a dynamic group based on partner email domain and assign the application to the group with a 30-day expiration policy.

Answer

Add the partner as a guest user manually and assign the application directly with an expiration date.

Question 10

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. It combines a Conditional Access policy that requires a compliant device (enforced by Intune) with an Intune app protection policy (MAM) that prevents copying corporate data to unmanaged apps. This meets both requirements. Option A is incorrect because Windows Autopilot is for provisioning, not compliance enforcement. Option B is incorrect because MFA and Windows Hello for Business do not control device compliance or data leakage. Option C is incorrect because requiring an approved client app alone does not enforce device compliance, and Azure AD Application Proxy is for remote access to on-premises apps, not data protection.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 11

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

Accepted Answer

Deploy Microsoft Authenticator with phone sign-in enabled for all users.. Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Answer

Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

Answer

Implement certificate-based authentication using smart cards.

Answer

Enable Windows Hello for Business on all Windows devices.

Question 12

Your organization wants to allow employees to use their personal mobile devices to access corporate resources, but you need to ensure that corporate data is protected if the device is lost or stolen. You also need to enforce a PIN policy on the device. Which combination of Microsoft Entra and Microsoft Intune features should you use?

Accepted Answer

Enroll devices in Microsoft Intune MDM, create a device compliance policy requiring PIN, and configure a Conditional Access policy to allow only compliant devices.. Enrolling devices in Microsoft Intune MDM allows the organization to apply device compliance policies (such as requiring a PIN) and then use Conditional Access to grant access only to compliant devices. If a device is lost or stolen, the organization can perform a selective wipe to remove corporate data while leaving personal data intact. Option A (Windows Autopilot) is a device provisioning tool, not a security or protection solution. Option B (Conditional Access with MFA and trusted locations) does not enforce device-level policies like PIN. Option D (MAM without enrollment) can enforce a PIN for managed apps but cannot manage the device itself or perform selective wipe of all corporate data; it is less comprehensive than MDM.

Answer

Use Windows Autopilot to configure devices and then apply a device restriction policy.

Answer

Implement a Conditional Access policy requiring multi-factor authentication and trusted locations.

Answer

Use Microsoft Intune app protection policies (MAM) without device enrollment, requiring PIN for managed apps.

Question 13

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution that automatically detects and remediates users with leaked credentials. Additionally, you need to require users to change their password when a high risk is detected. Which Microsoft Entra features should you configure?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.. Microsoft Entra Identity Protection detects leaked credentials by monitoring for credential exposures on the dark web and other sources. Configuring a user risk policy to require a password change when risk is medium or high automatically remediates the detected risk by forcing the user to update their password, directly addressing the requirement for automatic detection and remediation.

Answer

Create an Access Review for all users and require them to confirm their access quarterly.

Answer

Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

Answer

Configure a Conditional Access policy to require password change when sign-in risk is high.

Question 14

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 15

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

Accepted Answer

The corporate laptops are not marked as compliant devices.. The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Answer

Users are authenticating via device code flow.

Answer

The Conditional Access policy has the 'Persistent browser session' setting enabled.

Answer

The policy is blocking legacy authentication.