SC-900 Describe the capabilities of Microsoft Entra Practice Test 24 — 15 Questions

Question 1

A company is implementing a Microsoft Entra ID tenant for a new subsidiary. They require that all users authenticate using passwordless methods, specifically the Microsoft Authenticator app. What is the minimum configuration required to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy targeting all users that requires 'Require authentication strength' and select the 'Passwordless MFA' authentication strength. A Conditional Access policy with the 'Require authentication strength' setting allows you to select the 'Passwordless MFA' authentication strength, which enforces passwordless methods like the Microsoft Authenticator app. This is the minimum configuration that directly targets all users and mandates passwordless authentication, as opposed to broader or less specific settings.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy

Answer

Turn on Security defaults

Answer

Configure Microsoft Entra Hybrid Join for all devices

Question 2

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID capability helps verify the identity of users before granting access to resources?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (D) is the correct answer because it directly addresses the Zero Trust principle of 'verify explicitly' by using real-time risk detection and conditional access policies to verify user identity before granting access. It evaluates sign-in risk, user risk, and enforces policies like multi-factor authentication (MFA) or blocking access when suspicious activity is detected, ensuring that only legitimate users can access resources.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Governance

Question 3

A company uses Microsoft Entra ID and requires that all guest users from a partner organization must sign in using Microsoft Authenticator for MFA. The partner organization manages their own identities. What should you configure?

Accepted Answer

Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA claims from an external partner's tenant. Since the partner manages their own identities, trusting their MFA ensures that guest users from that partner organization can satisfy MFA requirements using their own Microsoft Authenticator without needing to register again in your tenant.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy for guests

Answer

Use Microsoft Entra ID Governance to require access reviews for guests

Answer

Create a Conditional Access policy that requires MFA for guest users

Question 4

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only managed compliant devices can access corporate email via Outlook mobile app. What is the most efficient approach?

Accepted Answer

Create a Conditional Access policy that requires a compliant device and create an app protection policy for Outlook. A Conditional Access policy requiring a compliant device ensures only managed devices can access corporate email, while an app protection policy (APP) adds data protection for the Outlook app, preventing data leakage. Option A is wrong because an app protection policy alone does not enforce device compliance; it only protects data within the app. Option B is wrong because device compliance plus Conditional Access without an app protection policy may allow data leakage from the app. Option C is wrong because MFA only provides authentication, not device management or data protection.

Answer

Create an app protection policy in Microsoft Intune for Outlook and assign it to all users

Answer

Enforce device compliance policies in Intune and create a Conditional Access policy that requires compliant device

Answer

Create a Conditional Access policy that requires MFA for the Outlook app

Question 5

A user reports that they cannot sign in to Microsoft Entra ID because they forgot their password. Which Microsoft Entra ID feature allows them to reset their password without contacting IT support?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own forgotten passwords without needing to contact IT support. It works by verifying the user's identity through pre-configured authentication methods (e.g., phone, email, security questions) before permitting the password change. This directly addresses the user's inability to sign in due to a forgotten password.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Domain Services

Question 6

Your company wants to use Microsoft Entra ID to provide single sign-on (SSO) to a SaaS application that supports SAML 2.0. What should you configure in Microsoft Entra ID?

Accepted Answer

Add the application from the Microsoft Entra ID Gallery in Enterprise applications. Adding the SaaS application from the Microsoft Entra ID Gallery in Enterprise applications is the standard method to configure SAML 2.0-based single sign-on (SSO). The gallery provides pre-integrated templates that include the necessary SAML endpoints, certificates, and attribute mappings, enabling seamless federation between Entra ID and the external application.

Answer

Enable Microsoft Entra ID Domain Services

Answer

Configure Microsoft Entra ID Governance

Answer

Register the application in App registrations

Question 7

Your organization implements a Microsoft Entra ID tenant with a custom domain (contoso.com). You need to ensure that all users are assigned a unique user principal name (UPN) based on their email address. What should you do?

Accepted Answer

Configure the user naming attribute to use the email address as the UPN. To ensure users are assigned a UPN based on their email address in Microsoft Entra ID, administrators must manually set the UPN during user creation or modification. For new users, this involves entering the desired email address (or its prefix) as the 'User name' and selecting the appropriate custom domain suffix. For existing users, their UPNs can be updated in bulk using PowerShell or the Microsoft Entra admin center's bulk operations feature to match their email addresses. While there isn't a single 'user naming attribute' setting that automates this process globally, the action of configuring the UPN for each user to match their email address is the necessary step.

Answer

Verify the custom domain in Microsoft Entra ID

Answer

Enable Microsoft Entra ID Domain Services

Answer

Use Microsoft Entra ID Connect to sync UPNs from on-premises

Question 8

A user is locked out of their account due to multiple failed sign-in attempts. Which Microsoft Entra ID feature can automatically block suspicious sign-in attempts based on risk?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect and automatically block suspicious sign-in attempts based on risk signals such as anonymous IP addresses, atypical travel, or leaked credentials. When a user is locked out due to multiple failed attempts, Entra ID Protection can evaluate the sign-in risk and enforce a block or require multi-factor authentication before allowing access.

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra ID Governance

Answer

Conditional Access

Question 9

Which TWO scenarios are addressed by Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Detecting leaked credentials on the dark web. Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect leaked credentials by monitoring known credential dumps on the dark web. When a user's credentials appear in a breach, ID Protection can automatically force a password reset or block sign-ins. Additionally, ID Protection can block sign-ins from anonymous IP addresses (e.g., Tor or anonymous VPNs) as part of its risk-based conditional access policies. These two capabilities—detecting leaked credentials and blocking sign-ins from anonymous IP addresses—are core risk detection and remediation features of Identity Protection.

Answer

Reviewing group membership assignments

Answer

Enforcing device compliance policies

Answer

Resetting forgotten passwords

Question 10

You are the identity administrator for a multinational company using Microsoft Entra ID. The company has a Microsoft 365 E5 subscription. The security team wants to enforce the following requirements:

1. All users must use multi-factor authentication (MFA) when accessing sensitive applications (e.g., finance app).
2. Users from the IT department must use passwordless authentication methods (e.g., Windows Hello for Business) when accessing any resource.
3. All access to sensitive applications must be logged and monitored for anomalous activity.
4. Guest users from partner organizations must be automatically reviewed quarterly to ensure they still need access.
5. The company wants to minimize administrative overhead by automating as much as possible.

You need to design a solution that meets these requirements using Microsoft Entra ID capabilities. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.. It uses Conditional Access policies to enforce MFA for the finance app and passwordless authentication strength for IT, meeting requirements 1 and 2. Microsoft Entra ID Protection logs and monitors sign-in risks for sensitive apps (requirement 3), and an access review for guest users automates quarterly reviews (requirement 4). This minimizes administrative overhead by leveraging automation, aligning with requirement 5.

Answer

Configure Self-Service Password Reset (SSPR) for all users. Enable Microsoft Entra ID Protection. Create an access review for guests.

Answer

Use Microsoft Entra ID Protection to enforce MFA based on risk. Implement Privileged Identity Management (PIM) for IT. Configure access reviews for guests.

Answer

Enable security defaults to enforce MFA for all users. Configure Microsoft Entra ID Protection to monitor anomalies. Use Microsoft Entra ID Governance to automate guest access reviews.

Question 11

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook, while maintaining security and compliance with conditional access policies. What should you configure?

Accepted Answer

Configure Microsoft Entra External ID with social identity providers.. Microsoft Entra External ID (formerly Azure AD External Identities) allows you to configure social identity providers such as Google and Facebook as external identity sources. This enables users to sign in with their existing social media accounts while still being subject to your tenant's conditional access policies, ensuring security and compliance.

Answer

Enable Microsoft Entra Permissions Management.

Answer

Deploy Microsoft Entra Verified ID.

Answer

Configure Microsoft Entra B2B collaboration for guest users.

Question 12

Your company is implementing a passwordless authentication strategy. You want users to be able to sign in using the Microsoft Authenticator app on their mobile devices. Which Microsoft Entra feature should you enable?

Accepted Answer

Passwordless phone sign-in with Microsoft Authenticator. Passwordless phone sign-in with Microsoft Authenticator allows users to sign in without entering a password by approving a notification or entering a number displayed on the screen. This directly aligns with the requirement to use the Microsoft Authenticator app on mobile devices for a passwordless authentication strategy.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Temporary Access Pass

Question 13

Your organization uses Microsoft Entra ID. You need to ensure that only users from the finance department can access a sensitive application, and they must be granted access dynamically based on their department attribute. What should you configure?

Accepted Answer

Create a dynamic group with rule: user.department -eq "Finance".. A dynamic group in Microsoft Entra ID automatically adds or removes members based on a rule, such as `user.department -eq "Finance"`. This ensures that only users whose department attribute equals "Finance" are granted access to the sensitive application, and membership updates dynamically as the attribute changes, without manual intervention.

Answer

Create an administrative unit for the finance department.

Answer

Enable self-service group management.

Answer

Configure entitlement management with an access package for the finance application.

Question 14

Your organization is using Microsoft Entra ID. You want to provide a single sign-on (SSO) experience for users accessing multiple SaaS applications. Which feature should you implement?

Accepted Answer

Microsoft Entra ID as an identity provider. Microsoft Entra ID acts as an identity provider (IdP) to enable single sign-on (SSO) for SaaS applications. When configured as the IdP, Entra ID authenticates the user once and issues a security token (e.g., SAML 2.0 assertion or OpenID Connect token) that is accepted by the SaaS application, eliminating the need for repeated logins. This is the core mechanism for federated SSO across multiple cloud applications.

Answer

Microsoft Entra application proxy

Answer

Microsoft Entra myapps portal

Answer

Microsoft Entra Privileged Identity Management

Question 15

Your organization has implemented Microsoft Entra ID Governance. You need to review and attest to the access rights of users in a specific group every quarter. The group contains both direct members and members from nested groups. Which Microsoft Entra feature should you use to automate this review?

Accepted Answer

Access reviews. Access Reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group membership, including both direct members and transitive members from nested groups. This feature automates the attestation process by sending reviewers notifications and tracking their decisions, ensuring compliance with quarterly review requirements.

Answer

Lifecycle workflows

Answer

Privileged Identity Management

Answer

Entitlement management