SC-900 Describe the capabilities of Microsoft Entra Practice Test 2 — 15 Questions

Question 1

Which THREE are valid authentication methods in Microsoft Entra ID?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (A) are a valid phishing-resistant, passwordless authentication method in Microsoft Entra ID, registered as an authentication method and used for sign-in via WebAuthn. Password (B) is the baseline authentication method in Entra ID, since users authenticate with their cloud or synchronized on-premises credentials. Microsoft Authenticator app (E) is a supported Entra ID authentication method, used for push notifications, passwordless phone sign-in, and time-based one-time passcodes (TOTP). Smart card (physical) (C) is not a native Entra ID authentication method; smart-card sign-in is handled by on-premises AD/AD FS or certificate-based authentication (CBA), not as a standalone Entra method. SMS-based verification (D) is a verification/authentication contact method for MFA and SSPR, but it is not listed as a distinct Entra ID authentication method in the same sense as FIDO2, password, or Authenticator.

Answer

Smart card (physical)

Answer

SMS-based verification

Question 2

Your organization uses Microsoft Entra ID with P2 licenses. You need to review and approve role activations for the Global Administrator role on a weekly basis. Which feature should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged role activation with approval workflows, and it supports recurring access reviews for role assignments. To review and approve Global Administrator activations weekly, you configure PIM's approval settings and access reviews on the role. PIM is specifically designed for managing, auditing, and reviewing privileged role usage.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Access Reviews

Question 3

A company wants to allow employees to sign in using their Microsoft credentials (e.g., personal Outlook.com) to access internal applications. Which Microsoft Entra feature should be configured?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) allows organizations to enable external users—including consumers with personal Microsoft accounts (e.g., Outlook.com)—to sign in to internal applications using their own credentials. This feature supports identity providers like Microsoft Accounts (MSA), Google, Facebook, and SAML/WS-Fed IdPs, making it the correct choice for allowing employees to use personal Outlook.com credentials for access.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra device enrollment

Answer

Microsoft Entra hybrid identity

Question 4

Which TWO scenarios are supported by Microsoft Entra B2B collaboration? (Choose two.)

Accepted Answer

Invite external users via email to access resources. Option B is correct because Microsoft Entra B2B collaboration's core capability is inviting external users (guest users) via email so they can access shared resources such as Microsoft 365 apps, Teams, and Azure resources using their own credentials. Option D is correct because B2B collaboration supports external users signing in with their own work or school account (Microsoft Entra ID/Azure AD) or a Microsoft account, which are the default supported identity types for guest users. Option A is not correct because configuring federation with social identity providers is a feature of Azure AD B2C (business-to-consumer), not B2B collaboration, which relies on the invited user's existing identity rather than setting up new federation. Option C is not correct because Google and Facebook federation for external users is also a B2C capability; B2B supports Microsoft accounts and Entra ID accounts by default, with Google federation available only as an optional add-on but not a primary B2B scenario as described. Option E is not correct because B2B guest users authenticate with their own external identities and are not provisioned with on-premises Active Directory accounts, which would instead relate to directory synchronization or B2C local accounts.

Answer

Set up federation with social identity providers

Answer

External users authenticate using Google or Facebook accounts

Answer

External users are provisioned with on-premises Active Directory accounts

Question 5

Which THREE features are included in Microsoft Entra ID Free? (Choose three.)

Accepted Answer

Security reports and alerts. Microsoft Entra ID Free includes security reports and alerts (option A), which provide baseline identity risk visibility such as risky sign-ins and audit logs at no cost, and single sign-on for up to 10 apps per user (option D), the documented Free-tier SSO limit for enterprise applications. Option B is incorrect because self-service password reset with on-premises writeback requires Microsoft Entra ID P1 (or P2), as the Free tier only supports cloud-only SSPR for administrators. Option C is incorrect because Conditional Access is a P1/P2 feature and is not available in the Free edition. Option E is incorrect because inbound user provisioning from cloud HR apps (e.g., Workday, SuccessFactors) requires Microsoft Entra ID P1 or P2, not the Free tier.

Answer

Self-service password reset with on-premises writeback

Answer

Conditional Access

Answer

User provisioning from cloud HR apps

Question 6

Your organization uses Microsoft Entra ID Governance. You need to ensure that when a user leaves the company, all their access to critical applications is automatically removed. Which feature should you use?

Accepted Answer

Entitlement Management. Entitlement Management is the most appropriate feature. It allows organizations to manage access to resources through access packages. A key feature of Entitlement Management is its lifecycle settings, which include the ability to automatically remove a user's access to an access package when their account is disabled or deleted in Microsoft Entra ID. This directly addresses the requirement for automatic access removal when a user leaves the company, as their Entra ID account would typically be disabled or deleted upon departure. While Access Reviews can be used for periodic cleanup and can include automatic removal, Entitlement Management provides a more direct, policy-driven automation tied to the user's account lifecycle event.

Answer

Access Reviews with automatic removal

Answer

Privileged Identity Management

Answer

Identity Protection

Question 7

Refer to the following JSON exhibit.

You are reviewing a Conditional Access policy in JSON format.

```json
{
  "displayName": "Require MFA and terms of use from trusted locations",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"],
      "excludeUsers": []
    },
    "locations": {
      "includeLocations": ["AllTrusted"],
      "excludeLocations": []
    },
    "applications": {
      "includeApplications": ["All"],
      "excludeApplications": []
    },
    "clientAppTypes": ["All"]
  },
  "grantControls": {
    "operator": "AND",
    "builtInControls": ["mfa"],
    "termsOfUse": ["a3f3bf6a-4f4e-4f1e-9f1e-2c3b3c1c3c3c"]
  }
}
```

What is the effect of this policy?

Accepted Answer

All users must use MFA and accept terms of use when accessing from trusted locations.. The policy grants access only when the conditions of 'trusted locations' AND 'multifactor authentication' AND 'accept terms of use' are all met. Since the policy is configured to 'Grant access' with these three controls required, any user (including guests) attempting to access from a trusted location must satisfy all three requirements. Option B correctly captures this combination.

Answer

All users are blocked from accessing resources from untrusted locations.

Answer

All users must use MFA from all locations.

Answer

Guests must accept terms of use and use MFA from all locations.

Question 8

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution to allow external partners to access a specific SharePoint Online site. The partners must use their own email addresses to sign in. You want to enforce multifactor authentication for all external users. Additionally, you need to ensure that external users are automatically removed from the site after 90 days. You have the following requirements:

1. Use built-in Microsoft Entra features.
2. Minimize administrative effort.
3. The solution must support automatic expiration of access.

What should you do?

Accepted Answer

Configure Microsoft Entra B2B collaboration to invite partners, create a Conditional Access policy requiring MFA for guests, and set up an access review to remove inactive guests after 90 days.. Microsoft Entra B2B collaboration allows external partners to sign in with their own email addresses, and a Conditional Access policy can enforce MFA for guest users. An access review policy can automatically remove external users after 90 days of inactivity, meeting the requirement for automatic expiration with minimal administrative effort using built-in features.

Answer

Configure Microsoft Entra Cloud Sync to sync partner accounts from their on-premises AD.

Answer

Enable self-service sign-up for external users and configure an access review policy.

Answer

Create guest accounts manually and use Azure AD Domain Services to enforce MFA.

Question 9

A company uses Microsoft Entra ID for identity management. They want to allow employees to sign in using their existing Facebook credentials. Which feature should they configure?

Accepted Answer

Microsoft Entra External Identities. Microsoft Entra External Identities is the feature that allows configuring social identity providers like Facebook as authentication sources. While it is primarily designed for external users (guests/customers), it can also be used for internal employees if the organization chooses to allow federation with social identity providers. The question tests whether you know that External Identities handles social identity provider integration, regardless of the user type.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Question 10

You are a security administrator for a company using Microsoft Entra ID P2. The company has a critical application that should only be accessible by a specific group of users (the 'Finance' group). You need to ensure that any access to this application is automatically logged and that an administrator is notified when a user outside the Finance group attempts to access it. Additionally, the CEO wants a quarterly review of all users who have access to this application. Which combination of features should you use?

Accepted Answer

Create a Conditional Access policy that restricts access to the Finance group, configure audit logging for the application, and set up an access review for the Finance group.. The requirements are: restrict access to the Finance group, log all access, notify admins on unauthorized attempts, and enable quarterly access reviews. A Conditional Access policy restricts access to the Finance group, audit logging captures access events, and access reviews provide the quarterly review. This combination directly addresses all four needs using native Entra ID P2 features.

Answer

Grant access to the application via B2B collaboration and configure auditing.

Answer

Use Identity Protection to detect access attempts from non-Finance users and send alerts.

Answer

Assign the application to the Finance group using Privileged Identity Management, and enable sign-in logs.

Question 11

Your organization wants to allow employees to use their personal mobile devices to access corporate resources, but you need to ensure that corporate data is protected if the device is lost or stolen. You also need to enforce a PIN policy on the device. Which combination of Microsoft Entra and Microsoft Intune features should you use?

Accepted Answer

Enroll devices in Microsoft Intune MDM, create a device compliance policy requiring PIN, and configure a Conditional Access policy to allow only compliant devices.. To protect corporate data on personal devices while enforcing a PIN, you need MDM enrollment in Intune to push device-level compliance policies (like PIN requirements), and Conditional Access to block access from non-compliant devices. This combination ensures only devices meeting the PIN and other compliance criteria can access corporate resources, and allows remote wipe of corporate data if lost.

Answer

Use Windows Autopilot to configure devices and then apply a device restriction policy.

Answer

Implement a Conditional Access policy requiring multi-factor authentication and trusted locations.

Answer

Use Microsoft Intune app protection policies (MAM) without device enrollment, requiring PIN for managed apps.

Question 12

You are configuring Microsoft Entra ID for a new user. The user will need to access resources in multiple Microsoft cloud services (Office 365, Azure, Dynamics 365). Which Microsoft Entra edition is minimally required to provide single sign-on (SSO) across these services?

Accepted Answer

Microsoft Entra ID Free (included with Office 365). Microsoft Entra ID Free, included with Office 365, provides SSO across Microsoft cloud services such as Office 365, Azure, and Dynamics 365. Since the question asks for the minimally required edition and Free supports SSO in this scenario, option A is correct. No premium edition like P1 or P2 is required.

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free (Azure only)

Answer

Microsoft Entra ID P1

Question 13

Which TWO of the following are methods for implementing passwordless authentication in Microsoft Entra ID?

Accepted Answer

Windows Hello for Business. Windows Hello for Business (A) is correct because it replaces passwords with a strong two-factor credential bound to the user's device, using a PIN or biometric tied to a TPM-protected asymmetric key pair for authentication to Microsoft Entra ID. FIDO2 security keys (E) are correct because they are phishing-resistant, standards-based external authenticators that satisfy passwordless sign-in to Microsoft Entra ID via WebAuthn, requiring no password. App passwords (B) are not passwordless; they are legacy static credentials used for older clients that don't support modern authentication, and they actually add a password-like secret. Email one-time passcode (C) and SMS-based OTP (D) are passwordless sign-in options for guest/B2B users, but they are not considered passwordless authentication methods for regular member accounts in the sense of the passwordless authentication methods policy (they are one-time passcode methods, not the FIDO2/WHfB passwordless credential types).

Answer

App passwords

Answer

Email one-time passcode

Answer

SMS-based one-time passcode (OTP)

Question 14

Refer to the exhibit. You are evaluating a Conditional Access policy in JSON format. The policy is assigned to a test user group. A user in that group tries to access Outlook Web App (OWA) from a browser. What is the effect of this policy?

Accepted Answer

Access is allowed because the policy only blocks legacy authentication protocols.. The policy in the exhibit targets 'Office 365 Exchange Online' and includes a condition for 'Client apps: Exchange ActiveSync, Other clients'. However, the user is accessing Outlook Web App (OWA) from a browser, which uses modern authentication (HTTPS). The policy explicitly blocks legacy authentication protocols (Exchange ActiveSync and other clients that do not support modern auth). Since OWA uses modern authentication, it is not affected by this policy, so access is allowed. Option D correctly identifies that the policy only blocks legacy authentication protocols, not modern browser-based access.

Answer

Access is blocked because Exchange ActiveSync is included.

Answer

Access is blocked because the policy targets Office 365.

Answer

Access is allowed but MFA is required.

Question 15

Your organization uses Microsoft Entra ID. You need to ensure that when a user's account is disabled on-premises, their access to cloud apps is blocked within 5 minutes. Which hybrid identity configuration should you use?

Accepted Answer

Microsoft Entra Connect Sync with directory synchronization. Microsoft Entra Connect Sync with directory synchronization is the correct choice because it enables the synchronization of account state changes (such as disabled accounts) from on-premises Active Directory to Microsoft Entra ID. When a user account is disabled on-premises, the next synchronization cycle (which runs every 30 minutes by default) updates the cloud account's status. To meet the 5-minute requirement, the synchronization interval can be reduced using the 'Set-ADSyncScheduler' cmdlet. This ensures that the disabled state is reflected in Microsoft Entra ID promptly, blocking access to cloud apps.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Password Hash Synchronization