SC-900 Describe the capabilities of Microsoft Entra Practice Test 23 — 15 Questions

Question 1

Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy with location condition and group exclusion.. D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra entitlement management.

Answer

Microsoft Entra B2B collaboration.

Question 2

A company wants to provide employees with single sign-on access to both Microsoft 365 and a third-party SaaS application. Which feature of Microsoft Entra ID should they use?

Accepted Answer

Federation. Federation (Option C) is correct because it establishes a trust relationship between Microsoft Entra ID and the third-party SaaS application's identity provider using standards like SAML 2.0 or WS-Federation. This allows users to authenticate once with their corporate credentials and gain access to both Microsoft 365 and the third-party app without separate logins, enabling true single sign-on (SSO).

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 3

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for all users accessing sensitive data from outside the corporate network. Which Microsoft Entra capability should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct capability because it allows administrators to define policies that enforce MFA based on specific conditions, such as network location. By configuring a policy that targets all users and applies the 'Require multi-factor authentication' grant control when the location is outside the corporate network, the security team can precisely meet the requirement. This policy evaluates the user's IP address against named locations defined in Entra ID before granting access to sensitive data.

Answer

B2B Collaboration

Answer

Privileged Identity Management

Answer

Identity Protection

Question 4

Refer to the exhibit. A Conditional Access policy is defined as shown. Which client applications will be blocked?

Accepted Answer

Legacy authentication clients such as IMAP, POP, and SMTP.. The policy targets 'Legacy authentication clients' such as IMAP, POP, and SMTP, which do not support modern authentication protocols like OAuth 2.0. These protocols rely on basic authentication and are blocked by Conditional Access policies configured to require modern authentication. Option C is correct because the policy explicitly blocks these legacy protocols.

Answer

Browser-based applications accessing Office 365.

Answer

Exchange ActiveSync clients only.

Answer

Applications using modern authentication (e.g., Outlook for Windows with OAuth).

Question 5

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

Accepted Answer

Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Answer

Identity Protection

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 6

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown. What is the purpose of this command?

Accepted Answer

To display the display name and user principal name of members of the Sales group.. The PowerShell cmdlet `Get-AzureADGroupMember -ObjectId <SalesGroupObjectId>` retrieves the members of a specific Azure AD group. By default, it returns the members' display names and user principal names (UPNs), which are the primary identifiers for users in Microsoft Entra ID. Option D correctly identifies this purpose.

Answer

To show the dynamic membership rules of the Sales group.

Answer

To list all groups in the Sales department.

Answer

To list Azure AD roles assigned to the Sales group.

Question 7

Your organization uses Microsoft Entra ID. You need to ensure that guest users can access resources without requiring invitation redemption. Which feature should you enable?

Accepted Answer

B2B Direct Connect. B2B Direct Connect allows guest users to access resources in your Microsoft Entra ID tenant without requiring them to redeem an invitation or accept a consent prompt. This feature establishes a mutual, two-way trust relationship between your tenant and an external Microsoft Entra ID tenant, enabling seamless resource access for users who already exist in the partner's directory.

Answer

Application Proxy

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 8

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

Accepted Answer

The user did not pass multi-factor authentication.. Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Answer

The user account is disabled.

Answer

The user's password has expired.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 9

Which TWO of the following are capabilities of Microsoft Entra ID?

Accepted Answer

Identity and access management for cloud applications.. Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Answer

Email filtering and anti-malware protection.

Answer

Encryption of data at rest in Azure Storage.

Answer

Network firewall management.

Question 10

Which THREE of the following are features of Microsoft Entra ID Protection?

Accepted Answer

Ability to define risk-based Conditional Access policies.. Microsoft Entra ID Protection provides risk detection signals that can be integrated into Conditional Access policies, enabling administrators to automatically enforce controls such as requiring multi-factor authentication or blocking access based on user or sign-in risk levels. This allows organizations to respond dynamically to detected threats without manual intervention.

Answer

Automatically notify users when their password is about to expire.

Answer

Just-in-time privileged role activation.

Question 11

Which TWO of the following are benefits of using Microsoft Entra ID Governance?

Accepted Answer

Automated access reviews for group memberships.. The correct answers are B and D. Microsoft Entra ID Governance provides automated access reviews to ensure that only the right people have access to resources, and lifecycle workflows automate onboarding and offboarding processes to manage user identities throughout their lifecycle. Option A (network segmentation) is not a feature of Entra ID Governance but rather network security. Option C (synchronizing identities) is done by Microsoft Entra Connect, not ID Governance. Option E (MFA enforcement) is a Conditional Access policy, not ID Governance.

Answer

Network segmentation for on-premises resources.

Answer

Synchronizing identities from on-premises Active Directory.

Answer

Enforcing multi-factor authentication for all users.

Question 12

An organization wants to allow users to reset their own passwords without help desk intervention. Which Microsoft Entra feature should they enable?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature specifically designed to allow users to reset their own passwords without requiring help desk intervention. It enforces security through authentication methods (e.g., phone, email, security questions) and can be configured to meet organizational policies. This directly addresses the scenario of reducing help desk workload for password resets.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 13

A company needs to ensure that only approved devices can access corporate resources. Which Microsoft Entra feature should they combine with Microsoft Intune?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra feature that enforces policies to grant or block access based on conditions such as device compliance. When combined with Microsoft Intune, which manages device compliance policies (e.g., requiring encryption, a specific OS version, or a healthy device health attestation), Conditional Access can block access from non-compliant or unapproved devices. This integration ensures that only devices marked as compliant by Intune can access corporate resources.

Answer

Application Proxy

Answer

Identity Protection

Answer

Privileged Identity Management

Question 14

Refer to the exhibit. An administrator runs the Azure CLI commands shown. What is the purpose of these commands?

Accepted Answer

To authenticate a service principal for automated tasks.. The Azure CLI commands shown are used to authenticate a service principal for automated tasks. Specifically, `az login --service-principal -u -p --tenant ` authenticates using the service principal's credentials without interactive user login, enabling non-interactive automation or scripts.

Answer

To create a new service principal.

Answer

To list all Azure subscriptions.

Answer

To log in to Azure as a user with MFA.

Question 15

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing Facebook accounts without creating a separate Microsoft Entra ID account. What should you configure?

Accepted Answer

Create a Microsoft Entra External ID tenant and add Facebook as an identity provider. Microsoft Entra External ID (formerly Azure AD B2C) is designed to allow external identities, such as social identity providers like Facebook, to authenticate users without requiring a separate Microsoft Entra ID account. By creating an External ID tenant and adding Facebook as an identity provider, you enable users to sign in using their existing Facebook credentials via OAuth 2.0 or OpenID Connect protocols.

Answer

Configure Microsoft Entra ID Protection

Answer

Enable Microsoft Entra ID Domain Services

Answer

Configure Microsoft Entra ID Governance