SC-900 Describe the capabilities of Microsoft Entra Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention. Option B, the Password reset admin portal, is intended for administrators to reset passwords for users, not for self-service. Option C, Identity Protection, is a feature that detects and responds to identity-based risks, not for password resets. Option D, Privileged Identity Management, manages and monitors privileged roles and access, not password recovery.

Answer

Password reset admin portal

Answer

Identity Protection

Answer

Privileged Identity Management

Question 2

Your company uses Microsoft Entra ID and wants to automatically assign licenses to new employees based on their department. Which feature should you use?

Accepted Answer

Dynamic groups and group-based licensing. Dynamic groups in Microsoft Entra ID allow you to automatically add or remove users based on attributes like department. Combined with group-based licensing, you can assign licenses (e.g., Microsoft 365 E5) to all members of that group, so when a new employee is added with the matching department attribute, they automatically receive the correct license without manual intervention.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 3

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 4

Your organization uses Microsoft Entra ID. Which TWO features help protect against identity-based attacks by detecting and responding to risks?

Accepted Answer

Conditional Access. Conditional Access is correct because it enforces policy-based access controls that evaluate real-time signals (e.g., user location, device compliance, sign-in risk) to block or challenge suspicious sign-in attempts, directly mitigating identity-based attacks. Identity Protection is correct because it uses machine learning to detect risk signals such as leaked credentials, anonymous IP addresses, and atypical travel, then automatically triggers remediation actions like requiring password reset or blocking access.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 5

Refer to the exhibit. You are reviewing a risk detection report in Microsoft Entra Identity Protection. The report shows a user with high risk level and two risk events. What does the status 'remediated' indicate?

Accepted Answer

The risk has been resolved by a remediation action such as password reset.. In Microsoft Entra Identity Protection, the 'remediated' status indicates that the risk associated with the user has been resolved through an automated or manual remediation action, such as a password reset or completion of a multi-factor authentication (MFA) challenge. This means the detected risk event is no longer considered active, and the user's account has been brought back to a secure state. Option B correctly identifies that the risk was resolved by a remediation action.

Answer

The risk is still active and requires investigation.

Answer

The user's account has been confirmed as compromised.

Answer

The risk was dismissed by an administrator as false positive.

Question 6

Your company is implementing a hybrid identity solution with Microsoft Entra ID. Users report that they can sign in to Microsoft 365 but cannot access on-premises applications that are configured for integrated Windows authentication. You need to ensure seamless single sign-on (SSO) for both cloud and on-premises resources. What should you implement?

Accepted Answer

Enable Microsoft Entra seamless SSO.. Microsoft Entra seamless SSO (Seamless SSO) is the correct choice because it automatically signs users in when they are on corporate devices connected to the corporate network, using Kerberos delegation to provide single sign-on for both cloud resources (like Microsoft 365) and on-premises applications configured for Integrated Windows Authentication (IWA). This eliminates the need for users to re-enter credentials when accessing on-premises apps after authenticating to the cloud.

Answer

Implement Passthrough Authentication.

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure password hash synchronization.

Question 7

A multinational organization uses Microsoft Entra ID for identity management. The security team wants to implement a Conditional Access policy that blocks access from untrusted locations unless the user's device is marked as compliant by Microsoft Intune. However, users traveling to trusted partner locations should be allowed access even if their device is non-compliant. Which two conditions should be configured in the policy?

Accepted Answer

Locations: All locations, exclude trusted locations; Grant: Require compliant device.. The policy must block access from untrusted locations unless the device is compliant, while allowing access from trusted partner locations even if the device is non-compliant. By setting 'Locations: All locations' and excluding trusted locations, the policy applies only to untrusted locations. Then, 'Grant: Require compliant device' ensures that only compliant devices can access from those untrusted locations, meeting both requirements.

Answer

Locations: All trusted locations; Grant: Require compliant device.

Answer

Locations: All trusted locations; Grant: Block access.

Answer

Locations: All locations; Grant: Require compliant device.

Question 8

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra self-service password reset (SSPR).. Microsoft Entra self-service password reset (SSPR) is the feature specifically designed to allow users to reset their own passwords without help desk intervention. When combined with Microsoft Entra Multi-Factor Authentication (MFA) as a registration and reset requirement, SSPR enforces MFA during the reset process, meeting both the self-service and security requirements.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra Multi-Factor Authentication.

Answer

Conditional Access policies.

Question 9

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs for a user. The user successfully signed in from a mobile device running iOS, located in the US, with medium risk level. The sign-in did not require MFA. You have a Conditional Access policy that requires MFA for all users when sign-in risk is medium or higher. Why was MFA not triggered?

Accepted Answer

The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.. The Conditional Access policy can be configured to exclude specific client apps, such as 'Mobile Apps and Desktop clients'. If the policy excludes these client apps, the sign-in from an iOS mobile device would not be subject to the MFA requirement, even though the sign-in risk is medium. The sign-in logs confirm MFA was not required, indicating the policy did not apply to this client app type.

Answer

The device is not compliant, so MFA was not required.

Answer

The sign-in risk level is medium, which is below the threshold.

Answer

The user is not assigned to the Conditional Access policy.

Question 10

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra entitlement management.. Microsoft Entra entitlement management allows you to create access packages that govern external partner access to specific applications, groups, and sites, with built-in time-limited access that automatically expires after a defined period (e.g., 60 days). This feature directly addresses the requirement to scope access to only specific applications and enforce automatic expiration, which is not natively handled by other Entra ID features.

Answer

Microsoft Entra B2B collaboration.

Answer

Conditional Access policies.

Answer

Microsoft Entra Identity Protection.

Question 11

Refer to the exhibit. You are reviewing Microsoft Entra role assignments for a user. The first assignment has a roleDefinitionId of '62e90394-69f5-4237-9190-012177145e10' at scope '/'. The second assignment has a roleDefinitionId of '194ae4cb-b126-40b2-bd5b-6091b380977d' at a subscription scope. What can you infer?

Accepted Answer

The user has the Global Administrator role at the tenant level.. The roleDefinitionId '62e90394-69f5-4237-9190-012177145e10' corresponds to the Global Administrator role in Microsoft Entra ID. The scope '/' indicates the tenant root scope, meaning the assignment applies to the entire tenant. Therefore, the user is a Global Administrator at the tenant level, granting broad administrative access to Azure AD (Entra ID) resources. However, Global Administrator does not automatically provide Azure RBAC roles for managing Azure resources; those require separate assignments.

Answer

The user can only read Azure AD objects.

Answer

The second role is assigned at the subscription scope.

Answer

The user is a Global Administrator with full access to all Azure AD and Azure resources.

Question 12

Your company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which Microsoft Entra feature should you configure?

Accepted Answer

Enterprise applications with pre-integrated gallery apps.. Configuring a third-party SaaS application like Salesforce or ServiceNow as an Enterprise Application in Microsoft Entra ID allows you to set up federation using SAML 2.0 or OpenID Connect, enabling users to sign in with their corporate Entra ID credentials. The pre-integrated gallery apps provide pre-configured templates that simplify the setup of single sign-on (SSO) and user provisioning, making it the appropriate feature for this requirement.

Answer

Conditional Access policies.

Answer

Microsoft Entra B2B collaboration.

Answer

Microsoft Entra Identity Protection.

Question 13

A large enterprise uses Microsoft Entra ID with P2 licenses. The security team wants to implement just-in-time (JIT) access for privileged roles and require approval for role activation. Additionally, they want to receive alerts when a role is activated outside business hours. Which feature should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM).. Microsoft Entra Privileged Identity Management (PIM) is the correct feature because it provides just-in-time (JIT) activation of privileged roles, supports approval workflows for role activation, and can send alerts when roles are activated outside business hours. PIM is specifically designed for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID, including time-bound activation and notification settings.

Answer

Microsoft Entra Identity Protection.

Answer

Conditional Access policies.

Answer

Microsoft Entra entitlement management.

Question 14

Refer to the exhibit. You are configuring a Conditional Access policy that requires compliant device for access to Microsoft 365. The device shown in the exhibit is Azure AD joined, compliant, and managed. However, a user signing in from this device is still blocked. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires Hybrid Azure AD joined device.. The exhibit shows the device is Azure AD joined, compliant, and managed, yet the user is still blocked. This indicates the Conditional Access policy is configured to require a Hybrid Azure AD joined device, which is a stricter requirement than just being Azure AD joined. A Hybrid Azure AD joined device must be both domain-joined to on-premises Active Directory and registered with Azure AD, whereas an Azure AD joined device is only cloud-joined. Since the device in the exhibit is only Azure AD joined, it does not satisfy the Hybrid Azure AD joined condition, causing the block.

Answer

The device profile type is 'Workplace', which is not allowed.

Answer

The device is not compliant.

Answer

The device is not managed.

Question 15

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

Accepted Answer

Include all locations, exclude trusted locations.. Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Answer

Include all users, include trusted locations.

Answer

Include all trusted locations.

Answer

Include Azure portal app, exclude trusted locations.