SC-900 Describe the capabilities of Microsoft Entra Practice Test 20 — 15 Questions

Question 1

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The corporate laptops are not marked as compliant devices.. The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Answer

Users are authenticating via device code flow.

Answer

The Conditional Access policy has the 'Persistent browser session' setting enabled.

Answer

The policy is blocking legacy authentication.

Question 2

Your organization uses Microsoft Entra ID. You need to grant external partners limited access to a SharePoint site for 30 days. After 30 days, access should automatically expire. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra entitlement management. Microsoft Entra entitlement management allows you to create access packages that grant external users time-limited access to resources like SharePoint sites. By configuring an access package with a 30-day expiration policy, access is automatically revoked when the policy expires, meeting the requirement exactly.

Answer

Microsoft Entra access reviews

Answer

Microsoft Entra B2B guest user accounts

Answer

Microsoft Entra Conditional Access

Question 3

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

Accepted Answer

Microsoft Authenticator app (passwordless). The Microsoft Authenticator app (passwordless) allows users to sign in to Microsoft Entra ID using biometrics (fingerprint, face, or PIN) on their mobile device without entering a password. This feature uses the device's built-in biometric capabilities to verify the user's identity, making it the correct choice for the described scenario.

Answer

Windows Hello for Business

Answer

SMS-based sign-in

Answer

FIDO2 security keys

Question 4

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs. Which statement is true?

Accepted Answer

asmith's sign-in was likely from an application or service principal.. The sign-in log entry for asmith shows an 'Application' sign-in type, which indicates the authentication was performed by an application or service principal rather than a user. In Microsoft Entra ID, sign-ins from applications or service principals are logged with a distinct sign-in type, and the exhibit displays 'Application' for asmith's entry, confirming this.

Answer

jdoe's sign-in had no risk detected.

Answer

jdoe's sign-in failed Conditional Access.

Answer

asmith's sign-in had a high risk level.

Question 5

Your company uses Microsoft Entra ID. You need to enforce that all users accessing the HR application must have a device that is compliant with company security policies. The device compliance is managed by Microsoft Intune. Which feature should you use to enforce this requirement?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it allows you to create policies that evaluate conditions such as device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can check the device compliance status reported by Intune and block or allow access to the HR application accordingly. This enforces the requirement that only compliant devices can access the app, without requiring users to authenticate differently.

Answer

Microsoft Intune device compliance policies

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra device registration

Question 6

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that when a user's on-premises account is disabled, their cloud account is automatically disabled within 5 minutes. Which configuration should you use?

Accepted Answer

Microsoft Entra Connect with directory sync configured for 5-minute sync interval. Microsoft Entra Connect with directory synchronization configured for a 5-minute sync interval ensures that changes made to on-premises Active Directory (such as disabling a user account) are replicated to Microsoft Entra ID within that interval. This meets the requirement of automatically disabling the cloud account within 5 minutes of the on-premises change.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access with session controls

Answer

Microsoft Entra Connect Health

Question 7

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra entitlement management

Question 8

Which two capabilities are provided by Microsoft Entra ID? (Choose two.)

Accepted Answer

Conditional Access policies. Conditional Access policies (B) are a core capability of Microsoft Entra ID, enabling administrators to enforce access controls based on signals like user location, device state, and application sensitivity. Identity Protection with risk-based conditional access (C) leverages machine learning to detect sign-in and user risks, automatically applying policies to block or require multi-factor authentication. Both are native to Microsoft Entra ID and integral to its identity and access management (IAM) framework.

Answer

Mobile device management (MDM)

Answer

Data loss prevention (DLP) for sensitive information

Answer

Cloud access security broker (CASB)

Question 9

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Accepted Answer

Access reviews. Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Answer

Conditional Access policies

Answer

Self-service password reset (SSPR) with writeback

Question 10

Which two scenarios are examples of using Microsoft Entra business-to-business (B2B) collaboration? (Choose two.)

Accepted Answer

A user from a partner organization is invited to access a SharePoint Online site.. Microsoft Entra B2B collaboration allows you to invite external users from partner organizations to access your company's resources, such as a SharePoint Online site. The invited user authenticates using their own home tenant credentials, and a B2B guest user object is created in your directory to represent them.

Answer

An employee uses their Microsoft Entra ID to sign in to a third-party SaaS application.

Answer

Two internal departments share resources within the same tenant.

Answer

Customers use their Facebook accounts to sign in to a company's web application.

Question 11

Refer to the exhibit. You run the cmdlet and get a list of risk detections. What does this cmdlet retrieve?

Accepted Answer

Risk detections for the unfamiliar sign-in properties risk event type. The cmdlet `Get-MgRiskDetection` retrieves all risk detections in the tenant, but when combined with the `-Filter` parameter for `riskEventType eq 'unfamiliarSigninProperties'`, it specifically returns only those risk detections that match the unfamiliar sign-in properties risk event type. This is because the cmdlet supports filtering by the `riskEventType` property, which corresponds to the type of risk detection as defined by Microsoft Entra ID Protection.

Answer

Users who have been flagged for risky sign-ins

Answer

All risk detections in the tenant

Answer

All sign-in logs with unfamiliar properties

Question 12

Refer to the exhibit. You run this PowerShell cmdlet. What is the outcome?

Accepted Answer

A guest user is created in Microsoft Entra ID and an invitation email is sent.. The `New-MgInvitation` cmdlet creates a guest user in Microsoft Entra ID and sends an invitation email by default. This is the standard behavior for B2B collaboration, where the external user is assigned the 'Guest' user type and receives an email to accept the invitation and redeem their account.

Answer

The external user is added as a member user without an invitation.

Answer

The external user is provisioned as a consumer account in Azure AD B2C.

Answer

The external user is added as a member user and cannot be a guest.

Question 13

Your company uses Microsoft Entra ID. You need to ensure that when a user's account is compromised and used to send spam, the account is automatically blocked from signing in. Which feature should you configure?

Accepted Answer

Microsoft Entra Identity Protection with a user risk policy to block high-risk users. Microsoft Entra Identity Protection uses machine learning to detect user risk, such as when an account is compromised and used to send spam. A user risk policy can be configured to automatically block sign-ins for high-risk users, directly addressing the requirement to block the compromised account from signing in.

Answer

Microsoft Entra Conditional Access policy to block sign-ins from high-risk users

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Self-Service Password Reset

Question 14

Your organization uses Microsoft Entra ID for identity management. You need to enable users to sign in using a QR code from the Microsoft Authenticator app. Which Microsoft Entra feature should you configure?

Accepted Answer

Passwordless sign-in with Microsoft Authenticator. The Microsoft Authenticator app supports passwordless sign-in by allowing users to approve a notification or scan a QR code from the sign-in screen. This feature eliminates the need for a password and relies on the Authenticator app as a primary authentication method, which is configured under the Passwordless sign-in with Microsoft Authenticator option in Entra ID.

Answer

FIDO2 security keys

Answer

Temporary Access Pass

Answer

My Security-info (https://aka.ms/mysecurityinfo)

Question 15

You are configuring Microsoft Entra ID Governance. You need to ensure that when a user leaves the organization, their access to all SaaS applications is automatically revoked. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Access Reviews. Microsoft Entra Access Reviews allows administrators to create recurring reviews of user access to SaaS applications. When a user leaves the organization, an automated access review can be configured to remove their access based on the review results, ensuring revocation of access to all assigned SaaS apps. This directly addresses the requirement for automatic revocation upon departure.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Terms of Use