SC-900 Describe the capabilities of Microsoft Entra Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. You are configuring a Conditional Access policy that requires compliant device for access to Microsoft 365. The device shown in the exhibit is Azure AD joined, compliant, and managed. However, a user signing in from this device is still blocked. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Conditional Access policy requires Hybrid Azure AD joined device.. The exhibit shows the device is Microsoft Entra ID joined, compliant, and managed, yet the user is still blocked. This indicates the Conditional Access policy is configured to require a Hybrid Microsoft Entra ID joined device, which is a stricter requirement than just being Microsoft Entra ID joined. A Hybrid Microsoft Entra ID joined device must be both domain-joined to on-premises Active Directory and registered with Microsoft Entra ID, whereas an Microsoft Entra ID joined device is only cloud-joined. Since the device in the exhibit is only Microsoft Entra ID joined, it does not satisfy the Hybrid Microsoft Entra ID joined condition, causing the block.

Answer

The device profile type is 'Workplace', which is not allowed.

Answer

The device is not compliant.

Answer

The device is not managed.

Question 2

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

Accepted Answer

Include all locations, exclude trusted locations.. Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Answer

Include all users, include trusted locations.

Answer

Include all trusted locations.

Answer

Include Azure portal app, exclude trusted locations.

Question 3

Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?

Accepted Answer

Conditional Access policy with location condition and group exclusion.. D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra entitlement management.

Answer

Microsoft Entra B2B collaboration.

Question 4

A company wants to provide employees with single sign-on access to both Microsoft 365 and a third-party SaaS application. Which feature of Microsoft Entra ID should they use?

Accepted Answer

Federation. Federation (Option C) is correct because it establishes a trust relationship between Microsoft Entra ID and the third-party SaaS application's identity provider using standards like SAML 2.0 or WS-Federation. This allows users to authenticate once with their corporate credentials and gain access to both Microsoft 365 and the third-party app without separate logins, enabling true single sign-on (SSO).

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 5

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for all users accessing sensitive data from outside the corporate network. Which Microsoft Entra capability should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct capability because it allows administrators to define policies that enforce MFA based on specific conditions, such as network location. By configuring a policy that targets all users and applies the 'Require multi-factor authentication' grant control when the location is outside the corporate network, the security team can precisely meet the requirement. This policy evaluates the user's IP address against named locations defined in Entra ID before granting access to sensitive data.

Answer

B2B Collaboration

Answer

Privileged Identity Management

Answer

Identity Protection

Question 6

Refer to the exhibit. A Conditional Access policy is defined as shown. Which client applications will be blocked?

Accepted Answer

Legacy authentication clients such as IMAP, POP, and SMTP.. The policy targets 'Legacy authentication clients' such as IMAP, POP, and SMTP, which do not support modern authentication protocols like OAuth 2.0. These protocols rely on basic authentication and are blocked by Conditional Access policies configured to require modern authentication. Option C is correct because the policy explicitly blocks these legacy protocols.

Answer

Browser-based applications accessing Office 365.

Answer

Exchange ActiveSync clients only.

Answer

Applications using modern authentication (e.g., Outlook for Windows with OAuth).

Question 7

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

Accepted Answer

Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Answer

Identity Protection

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 8

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown. What is the purpose of this command?

Accepted Answer

To display the display name and user principal name of members of the Sales group.. The PowerShell cmdlet `Get-AzureADGroupMember -ObjectId <SalesGroupObjectId>` retrieves the members of a specific Microsoft Entra ID group. By default, it returns the members' display names and user principal names (UPNs), which are the primary identifiers for users in Microsoft Entra ID. Option D correctly identifies this purpose.

Answer

To show the dynamic membership rules of the Sales group.

Answer

To list all groups in the Sales department.

Answer

To list Azure AD roles assigned to the Sales group.

Question 9

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

Accepted Answer

The user did not pass multi-factor authentication.. Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Answer

The user account is disabled.

Answer

The user's password has expired.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 10

Which TWO of the following are capabilities of Microsoft Entra ID?

Accepted Answer

Identity and access management for cloud applications.. Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Answer

Email filtering and anti-malware protection.

Answer

Encryption of data at rest in Azure Storage.

Answer

Network firewall management.

Question 11

Which TWO of the following are benefits of using Microsoft Entra ID Governance?

Accepted Answer

Automated access reviews for group memberships.. Option B is correct because Microsoft Entra ID Governance includes Access Reviews, which automate the periodic recertification of group memberships, application assignments, and privileged role assignments so that stale or inappropriate access is removed without manual tracking. Option D is correct because Lifecycle Workflows in Entra ID Governance automate joiner-mover-leaver processes, such as triggering onboarding tasks (for example, adding a user to groups or generating a Temporary Access Pass) and offboarding tasks (for example, disabling the account and removing licenses) based on employee attributes. Option A is not a governance benefit; network segmentation is a security architecture control typically delivered by firewalls, VLANs, or microsegmentation, not by Entra ID Governance. Option C is not a governance benefit; identity synchronization from on-premises Active Directory is provided by Microsoft Entra Connect (or Cloud Sync), which is a hybrid identity capability rather than a governance feature. Option E is not a governance benefit; enforcing MFA for all users is done through Conditional Access or security defaults in Microsoft Entra ID, not through Entra ID Governance.

Answer

Network segmentation for on-premises resources.

Answer

Synchronizing identities from on-premises Active Directory.

Answer

Enforcing multi-factor authentication for all users.

Question 12

An organization wants to allow users to reset their own passwords without help desk intervention. Which Microsoft Entra feature should they enable?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature specifically designed to allow users to reset their own passwords without requiring help desk intervention. It enforces security through authentication methods (e.g., phone, email, security questions) and can be configured to meet organizational policies. This directly addresses the scenario of reducing help desk workload for password resets.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 13

A company needs to ensure that only approved devices can access corporate resources. Which Microsoft Entra feature should they combine with Microsoft Intune?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra feature that enforces policies to grant or block access based on conditions such as device compliance. When combined with Microsoft Intune, which manages device compliance policies (e.g., requiring encryption, a specific OS version, or a healthy device health attestation), Conditional Access can block access from non-compliant or unapproved devices. This integration ensures that only devices marked as compliant by Intune can access corporate resources.

Answer

Application Proxy

Answer

Identity Protection

Answer

Privileged Identity Management

Question 14

Refer to the exhibit. An administrator runs the Azure CLI commands shown. What is the purpose of these commands?

Accepted Answer

To authenticate a service principal for automated tasks.. The Azure CLI commands shown are used to authenticate a service principal for automated tasks. Specifically, `az login --service-principal -u -p --tenant ` authenticates using the service principal's credentials without interactive user login, enabling non-interactive automation or scripts.

Answer

To create a new service principal.

Answer

To list all Azure subscriptions.

Answer

To log in to Azure as a user with MFA.

Question 15

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing Facebook accounts without creating a separate Microsoft Entra ID account. What should you configure?

Accepted Answer

Create a Microsoft Entra External ID tenant and add Facebook as an identity provider. Microsoft Entra External ID (formerly Azure AD B2C) is designed to allow external identities, such as social identity providers like Facebook, to authenticate users without requiring a separate Microsoft Entra ID account. By creating an External ID tenant and adding Facebook as an identity provider, you enable users to sign in using their existing Facebook credentials via OAuth 2.0 or OpenID Connect protocols.

Answer

Configure Microsoft Entra ID Protection

Answer

Enable Microsoft Entra ID Domain Services

Answer

Configure Microsoft Entra ID Governance