SC-900 Describe the capabilities of Microsoft Entra Practice Test 2 — 15 Questions

Question 1

A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sign-in logs. Sign-in logs provide detailed information about every sign-in attempt, including whether Conditional Access policies were applied, which policies were triggered, and the outcome (success or failure). When a user reports they cannot access an app and a Conditional Access policy is suspected, reviewing the sign-in logs for that user's attempts will directly show if a policy blocked access and why, making it the primary diagnostic tool for an existing issue.

Answer

My Apps portal

Answer

Conditional Access 'What If' tool

Answer

Audit logs

Question 2

An administrator notices that some users are being prompted for MFA even though they are inside the corporate network. The Conditional Access policy includes a condition for 'All locations' except trusted IPs. What is the most likely cause?

Accepted Answer

The corporate network's public IP address is not added to the trusted IPs list. If the corporate network's public IP is not added to the trusted IPs list, users inside the network will be prompted for MFA because the location is not recognized as trusted. Option A is correct. Option B is wrong because whether users have registered for MFA or not doesn't explain *why* the Conditional Access policy is triggering MFA for them when they are inside the corporate network and the policy is configured to exclude trusted IPs. The issue is about the policy's location condition, not the user's MFA registration status. Option C is wrong because if users are not assigned to the policy (even via a nested group), the policy would not apply to them at all, and they wouldn't be prompted for MFA by this policy. If they *are* assigned, this option doesn't explain why the 'except trusted IPs' condition isn't working as expected. Option D is wrong because session controls are typically applied after authentication or during the session and do not directly cause MFA prompts based on location conditions.

Answer

The users have not registered for MFA

Answer

The users are not assigned to the policy but are in a nested group

Answer

The Conditional Access policy has session controls enabled

Question 3

Which THREE are valid authentication methods in Microsoft Entra ID?

Accepted Answer

FIDO2 security keys. FIDO2 security keys provide passwordless, phishing-resistant authentication using public-key cryptography, making them a strong primary method. Password authentication remains a fundamental and widely used method for signing into Microsoft Entra ID. The Microsoft Authenticator app supports various primary authentication methods, including passwordless phone sign-in and number matching, offering a secure and convenient way to sign in. SMS-based verification is typically used as a secondary factor for multi-factor authentication or password reset, not as a standalone primary sign-in method. Physical smart cards, while usable in hybrid environments, generally require federation services (like AD FS) and are not considered native, cloud-only primary authentication methods directly within Microsoft Entra ID.

Answer

Smart card (physical)

Answer

SMS-based verification

Question 4

You are reviewing a Conditional Access policy JSON:

{
  "displayName": "Require MFA or compliant device for Office 365 from untrusted locations",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["Office365"]
    },
    "locations": {
      "includeLocations": ["All"],
      "excludeLocations": ["AllTrusted"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa", "compliantDevice"]
  }
}

What is the result of this policy?

Accepted Answer

Users from untrusted locations must complete MFA or use a compliant device to access Office 365. The policy JSON grants access to Office 365 if the user is from an untrusted location and either completes MFA or uses a compliant device. This matches option B exactly. The 'OR' condition between MFA and compliant device is key, and the scope is limited to Office 365, not all cloud apps.

Answer

All users must complete MFA to access all cloud apps

Answer

Users must complete MFA and use a compliant device from all locations

Answer

Users from trusted locations must complete MFA and use a compliant device

Question 5

You are analyzing a PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. What is the duration of the activation?

Accepted Answer

4 hours. By default, the activation duration for a PIM role is 4 hours. While the maximum allowed activation duration for any role, including Global Administrator, is 8 hours, the system's default setting is 4 hours if no custom configuration is applied. Highly privileged roles like Global Administrator are often configured with an 8-hour maximum by organizations, but the system default is 4 hours.

Answer

8 hours

Answer

8 minutes

Answer

8 days

Question 6

A company wants to allow employees to sign in using their Microsoft credentials (e.g., personal Outlook.com) to access internal applications. Which Microsoft Entra feature should be configured?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) allows organizations to enable external users—including consumers with personal Microsoft accounts (e.g., Outlook.com)—to sign in to internal applications using their own credentials. This feature supports identity providers like Microsoft Accounts (MSA), Google, Facebook, and SAML/WS-Fed IdPs, making it the correct choice for allowing employees to use personal Outlook.com credentials for access.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra device enrollment

Answer

Microsoft Entra hybrid identity

Question 7

Refer to the exhibit. A user accesses a web app from a device that is Microsoft Entra joined but not Intune compliant. Which condition will be satisfied?

Accepted Answer

Neither condition. The exhibit shows a Conditional Access policy that requires both 'Domain joined' and 'Compliant device' conditions. The device is Microsoft Entra joined. In Conditional Access, the 'Domain joined' condition specifically refers to devices that are *Hybrid Azure AD joined* (joined to an on-premises Active Directory and registered with Microsoft Entra ID). A device that is *only* Microsoft Entra joined does not satisfy the 'Domain joined' condition. Additionally, the device is stated as 'not Intune compliant', so it fails the 'Compliant device' condition. Therefore, neither the 'Domain joined' nor the 'Compliant device' condition is satisfied, making option B correct.

Answer

Domain joined

Answer

Compliant device

Answer

Both conditions

Question 8

Your organization uses Microsoft Entra ID. You want to provide external partners with access to a SharePoint site using their own identity providers (e.g., Google, Facebook). Which feature should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration allows you to invite external users (guests) to your Microsoft Entra ID tenant and grant them access to your organization's resources, such as SharePoint sites. B2B supports various identity providers for guest users, including other Microsoft Entra ID tenants, Microsoft accounts, email one-time passcodes, and crucially, social identity providers like Google and Facebook. By configuring federation with these social providers, external partners can use their existing Google or Facebook accounts to sign in as guests and access the SharePoint site. Microsoft Entra External ID (B2C) is primarily designed for customer-facing applications and managing consumer identities in a separate tenant, not for directly granting partners access to internal resources like SharePoint within the main Entra ID tenant.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra External ID (B2C)

Answer

Conditional Access policies

Question 9

Which TWO scenarios are supported by Microsoft Entra B2B collaboration? (Choose two.)

Accepted Answer

Invite external users via email to access resources. The explanation correctly identifies that inviting external users via email (B) is a core B2B function. However, it fails to justify why options A and C are marked incorrect. Microsoft Entra B2B collaboration explicitly supports setting up federation with social identity providers (A) and allows external users to authenticate using accounts like Google or Facebook (C). Therefore, options A, B, C, and D are all valid scenarios for B2B collaboration, which contradicts the 'Choose two' instruction.

Answer

Set up federation with social identity providers

Answer

External users authenticate using Google or Facebook accounts

Answer

External users are provisioned with on-premises Active Directory accounts

Question 10

Which THREE components are part of Microsoft Entra ID's identity governance? (Choose three.)

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is a core component of Microsoft Entra ID's identity governance because it provides just-in-time privileged access to Azure AD and Azure resources, with time-bound approvals and activation workflows. It enables organizations to manage, control, and monitor access to critical resources, reducing the risk of standing admin privileges.

Entitlement Management is also a key component, allowing organizations to manage identity and access lifecycle at scale by automating access request workflows, access assignments, reviews, and expiration for users, including external collaborators.

Access Reviews are another crucial part of identity governance, enabling organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. They help ensure that only authorized users have continued access to resources, reducing 'access sprawl' and meeting compliance requirements.

Answer

Self-Service Password Reset

Answer

Conditional Access

Question 11

Which THREE features are included in Microsoft Entra ID Free? (Choose three.)

Accepted Answer

Security reports and alerts. The provided explanation only justifies option A. It needs to be expanded to justify all correct options. Option E, 'User provisioning from cloud HR apps,' is a feature of Microsoft Entra ID P1 or P2, not the Free tier. Microsoft Entra ID Free includes basic security reports and alerts (A) and single sign-on for up to 10 apps per user (D).

Answer

Self-service password reset with on-premises writeback

Answer

Conditional Access

Answer

User provisioning from cloud HR apps

Question 12

Which THREE capabilities are provided by Microsoft Entra Identity Protection? (Choose three.)

Accepted Answer

Detect leaked credentials. Microsoft Entra Identity Protection continuously monitors user authentication patterns and compares password hashes against a database of known leaked credentials from public breach sources. When a match is detected, it flags the user or sign-in as risky, enabling automated remediation or blocking through risk-based Conditional Access policies. It also provides administrators with detailed reports on risky users, sign-ins, and detections for investigation and manual remediation.

Answer

Allow users to reset their own passwords

Answer

Provide just-in-time privileged access

Question 13

Your organization uses Microsoft Entra ID Governance. You need to ensure that when a user leaves the company, all their access to critical applications is automatically removed. Which feature should you use?

Accepted Answer

Entitlement Management. Entitlement Management is the most appropriate feature. It allows organizations to manage access to resources through access packages. A key feature of Entitlement Management is its lifecycle settings, which include the ability to automatically remove a user's access to an access package when their account is disabled or deleted in Microsoft Entra ID. This directly addresses the requirement for automatic access removal when a user leaves the company, as their Entra ID account would typically be disabled or deleted upon departure. While Access Reviews can be used for periodic cleanup and can include automatic removal, Entitlement Management provides a more direct, policy-driven automation tied to the user's account lifecycle event.

Answer

Access Reviews with automatic removal

Answer

Privileged Identity Management

Answer

Identity Protection

Question 14

Which TWO of the following are capabilities of Microsoft Entra ID? (Choose two.)

Accepted Answer

Identity Protection. Microsoft Entra ID includes **Identity Protection**, which uses machine learning to detect and respond to identity-based risks such as compromised credentials and anomalous sign-in behavior. It provides automated risk remediation and conditional access policies to protect user accounts. Additionally, Entra ID offers **Privileged Identity Management (PIM)**, a service that enables organizations to manage, control, and monitor access to important resources by providing just-in-time (JIT) access, approval workflows, and access reviews for privileged roles.

Answer

Device Management

Answer

Endpoint Detection and Response

Answer

Information Protection

Question 15

Which THREE features are part of Microsoft Entra Identity Governance?

Accepted Answer

Privileged Identity Management. Microsoft Entra Identity Governance helps organizations manage identity and access lifecycles, govern privileged access, and ensure appropriate access to resources. Its core features include:
*   **Privileged Identity Management (PIM)**: Provides just-in-time privileged access to Azure AD and Azure resources, with time-bound activation and approval workflows. It directly supports the governance principle of least privilege.
*   **Access reviews**: Enables organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. It helps ensure that users only have the access they need and that unnecessary access is removed.
*   **Entitlement management**: Allows organizations to manage identity and access lifecycle at scale by automating access requests, approvals, and provisioning for various resources, including groups, applications, and SharePoint sites.

Answer

Microsoft Entra Connect

Answer

ID Protection