SC-900 Describe the capabilities of Microsoft Entra Practice Test 25 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Accepted Answer

Configure Microsoft Entra lifecycle workflows to disable the user and remove group memberships upon termination.. Microsoft Entra lifecycle workflows automate the user offboarding process by disabling the user account and removing group memberships upon termination. This ensures that the user loses access to all SaaS applications that rely on Entra ID for authentication, as group membership removal revokes access tokens and disables sign-in.

Answer

Configure a conditional access policy to block access for disabled users.

Answer

Use Privileged Identity Management to remove role assignments.

Answer

Schedule an access review for quarterly review of access.

Question 2

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct integration because it provides Cloud Access Security Broker (CASB) functionality, enabling session policies via reverse proxy to control user actions like blocking downloads from unmanaged devices. These policies are enforced in real-time by inspecting and modifying traffic to cloud apps based on device compliance signals from Microsoft Entra ID.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 3

Which THREE of the following are capabilities of Microsoft Entra ID Governance?

Accepted Answer

Access reviews. Entitlement management (D) is a core Entra ID Governance capability that lets organizations manage the lifecycle of access through access packages, catalogs, and policies, automating granting, revoking, and expiration of access for internal and external users. Access reviews (B) are also part of Entra ID Governance, enabling periodic recertification of group memberships, application assignments, and privileged role assignments to ensure users retain only the access they need. Privileged Identity Management (C) is included in Entra ID Governance, providing just-in-time privileged access, approval workflows, access reviews, and audit history for Microsoft Entra roles, Azure resources, and other workloads. Self-service password reset (A) is an Entra ID authentication feature, not a governance capability, and Conditional Access (E) is an Entra ID access-control policy engine, so neither belongs to the Entra ID Governance feature set.

Answer

Self-service password reset

Answer

Conditional access

Question 4

Which THREE of the following are identity protection features in Microsoft Entra ID Protection?

Accepted Answer

Risk detections such as leaked credentials and anonymous IP address. Option B is correct because Microsoft Entra ID Protection natively generates risk detections such as leaked credentials, anonymous IP address, atypical travel, and unfamiliar sign-in properties, which are the core signals the service evaluates. Option D is correct because ID Protection provides investigation and remediation capabilities, including the Risky users, Risky sign-ins, and Risk detections reports, plus remediation actions like password reset, blocking sign-in, or dismissing risk. Option E is correct because ID Protection lets administrators configure risk policies for user risk and sign-in risk that automatically enforce remediation (for example, require password change or MFA) when a configured risk level is reached. Option A is not correct because self-service password reset is an authentication/credential-management feature of Microsoft Entra ID, not an ID Protection risk feature, even though it can be used as a remediation action. Option C is not correct because Conditional Access is a separate policy engine that can consume ID Protection risk signals as conditions, but the policies themselves are not an ID Protection feature.

Answer

Self-service password reset

Answer

Conditional access policies

Question 5

Your organization, Contoso, uses Microsoft Entra ID for identity management. The security team has recently identified that several users have had their credentials compromised. You need to implement a solution that automatically enforces a password change for high-risk users and blocks sign-ins from risky locations. Additionally, you want to allow users to self-remediate by changing their password when they are at medium risk. You have the following requirements:
- Users detected as high risk must be blocked from signing in until an administrator resets their password.
- Users detected as medium risk must be prompted to change their password via self-service password reset before they can access resources.
- All risk detections must be logged and reported to the security team.
- The solution must use built-in Microsoft Entra capabilities without third-party tools.

Which of the following actions should you take to meet the requirements?

Accepted Answer

Configure Microsoft Entra ID Protection user risk policies: set a policy to block access for high user risk and a policy to require password change for medium user risk. Enable risk reporting.. Microsoft Entra ID Protection provides built-in user risk policies that automatically block sign-ins for high-risk users and require a password change for medium-risk users, meeting the requirements for automated enforcement and self-remediation. Additionally, ID Protection includes risk reporting capabilities that log all risk detections for the security team, all without third-party tools.

Answer

Create conditional access policies that block sign-ins based on location and require MFA for all users.

Answer

Administratively assign users to administrative units and require administrators to review risk manually.

Answer

Use Microsoft Entra ID Governance to create an access package and require approval for access.

Question 6

Your organization, Fabrikam, has recently merged with another company. You need to provide seamless access to resources for users from both companies while maintaining separate identity directories. The users from the acquired company have their own Microsoft Entra ID tenant. You need to enable them to access applications in your tenant using their existing corporate credentials, without creating new accounts. Additionally, you want to enforce conditional access policies from your tenant for these users. Which approach should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration to invite users from the other tenant as guest users, and apply conditional access policies to guest users.. Microsoft Entra B2B collaboration allows you to invite external users from another Microsoft Entra tenant to access your applications using their own corporate identities. This approach meets the requirement of not creating new accounts, and because guest users are represented as user objects in your tenant, you can enforce your own conditional access policies on them. Option D is correct because it directly addresses the need for seamless access with separate directories and policy control.

Answer

Create new user accounts in your tenant for the acquired company's users and assign them access.

Answer

Set up a federation trust between your tenant and the other company's on-premises Active Directory.

Answer

Use Microsoft Entra B2C to create a custom identity provider for the other company.

Question 7

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on conditions such as user group, location, device, and application. You can create a policy that requires MFA for all users but excludes trusted corporate network locations.

Answer

Self-service password reset (SSPR) policy

Answer

Identity Protection risk policy

Answer

Privileged Identity Management (PIM) activation policy

Question 8

Which TWO capabilities are part of Microsoft Entra ID? (Choose two.)

Accepted Answer

Application management. Application management (A) is a core Microsoft Entra ID capability, allowing administrators to register, configure, and assign enterprise applications and manage app roles, permissions, and provisioning. Single sign-on (B) is also a native Entra ID feature, enabling users to authenticate once and access integrated SaaS and on-premises applications via protocols such as SAML, OAuth 2.0, and OpenID Connect. Cloud security posture management (C) belongs to Microsoft Defender for Cloud, not Entra ID. Mobile device management (D) is provided by Microsoft Intune, and security information and event management (E) is delivered by Microsoft Sentinel, so neither is an Entra ID capability.

Answer

Cloud security posture management

Answer

Mobile device management (MDM)

Answer

Security information and event management (SIEM)

Question 9

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

Accepted Answer

The location condition is configured to include trusted locations. In Microsoft Entra Conditional Access, the 'Locations' condition has two mutually exclusive states: 'Include' or 'Exclude.' If trusted locations are placed in the Include list, the policy applies ONLY when the user signs in from those trusted IPs — the opposite of the intended 'skip MFA from trusted locations' behavior. To exempt trusted locations, they must be listed under Exclude, not Include.

Answer

The policy targets high sign-in risk

Answer

The policy does not apply to Exchange Online

Answer

The policy requires device compliance

Question 10

You are the identity administrator for Contoso Ltd., a global company with over 10,000 employees. The company uses Microsoft Entra ID P2 and Microsoft Intune. Employees use both company-owned and personal devices. The security team requires that all access to corporate applications be protected with multifactor authentication (MFA). However, to minimize user friction, they want to exempt MFA for users who are on the corporate network and using compliant devices. Additionally, for users with privileged roles (e.g., Global Administrator), MFA must always be required regardless of location or device. You need to configure a Conditional Access policy to meet these requirements. Which of the following approaches should you take?

Accepted Answer

Create two Conditional Access policies: Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions.. It uses two separate Conditional Access policies to handle the two distinct user groups. Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices, which satisfies the requirement to minimize friction for users on the corporate network with compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions, ensuring that Global Administrators and other privileged role members always must perform MFA regardless of location or device compliance.

Answer

Create one Conditional Access policy that targets all users and requires MFA. Create a second policy that targets privileged roles and excludes trusted locations.

Answer

Create one Conditional Access policy that targets all users, requires MFA, and excludes trusted locations and compliant devices. Do not create any additional policies.

Answer

Create one Conditional Access policy that targets all users and requires MFA. Use Microsoft Intune compliance policies to exempt compliant devices from MFA.

Question 11

Your company, Wingtip Toys, uses Microsoft Entra ID with a Premium P1 license. You have a third-party SaaS application that supports Security Assertion Markup Language (SAML) 2.0. You need to enable single sign-on (SSO) for users to access this application. The app requires attributes like department and employee ID in the SAML token. You also need to ensure that only users from a specific security group can access the app. What should you do?

Accepted Answer

Add the app from the gallery as a SAML application, configure claims mapping to include department and employee ID, and assign the app to the security group.. With Microsoft Entra ID Premium P1, you can add the SaaS application from the gallery as a SAML application, configure custom claims to include department and employee ID in the SAML token, and assign the application to the security group. OpenID Connect is not SAML SSO. Password-based SSO cannot provide SAML attributes. Application Proxy is used for on-premises applications, not SaaS apps.

Answer

Register the app using OpenID Connect and assign users to the app.

Answer

Add the app from the gallery using password-based SSO and configure group assignment.

Answer

Use Microsoft Entra Application Proxy to publish the app and configure pre-authentication.

Question 12

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable self-service password reset (SSPR) and configure the number of methods required to reset to 2.. Self-service password reset (SSPR) in Microsoft Entra ID P1 allows users to reset their own passwords without administrator intervention. By configuring SSPR and setting the number of methods required to reset to 2, you enforce the policy that users must verify their identity with two authentication methods before resetting their password.

Answer

Configure Privileged Identity Management (PIM) to require approval for password reset.

Answer

Create an Identity Protection user risk policy to force password reset.

Answer

Configure a Conditional Access policy to require MFA for password changes.

Question 13

Your company, Proseware, uses Microsoft Entra ID P2. You have a custom application that integrates with Microsoft Graph API to read user profiles. The application uses client credentials flow (application permissions). You need to ensure that the application can only read user profiles and not perform any other operations. Additionally, you want to review and approve the permissions periodically. What should you do?

Accepted Answer

In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.. The application uses client credentials flow (application permissions), which requires granting an application permission like User.Read.All to read all user profiles. Configuring an access review for the application permissions in Microsoft Entra ID allows periodic review and approval of those permissions, meeting the requirement to ensure the app can only read user profiles and that permissions are reviewed periodically.

Answer

Create a Conditional Access policy to restrict the app to read-only operations.

Answer

Enable Privileged Identity Management for the app and require approval for each API call.

Answer

Use delegated permissions for the application and assign users to the app role.

Question 14

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install Microsoft Entra Connect and enable password hash synchronization.. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory user accounts to Microsoft Entra ID (formerly Azure AD) and enabling password hash synchronization. Password hash synchronization allows users to use the same password for both on-premises and cloud resources by syncing a hash of the on-premises password to Entra ID, which is supported in the free tier of Entra ID.

Answer

Configure Microsoft Entra Domain Services to sync from on-premises.

Answer

Use Microsoft Graph API to create users and set passwords.

Answer

Deploy Active Directory Federation Services (AD FS) to enable single sign-on.

Question 15

Your organization, Contoso, uses Microsoft Entra ID P2. You have a Microsoft Entra tenant with several privileged roles including Global Administrator, Exchange Administrator, and SharePoint Administrator. The security team wants to enforce just-in-time (JIT) access for these roles, requiring users to request activation and get approval before they can use the role. Additionally, all activations must be logged and reviewed monthly. What should you configure?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by requiring users to activate their role assignments with approval from designated approvers. It also includes access reviews that can be scheduled to audit and confirm active role assignments, meeting the logging and monthly review requirements. This directly addresses the need for activation approval and periodic review of privileged role usage.

Answer

Configure Conditional Access policies to require MFA for privileged roles.

Answer

Use Microsoft Entra Entitlement Management to create access packages for roles.

Answer

Create an Identity Protection risk policy to block risky sign-ins for privileged users.