SC-900 Describe the capabilities of Microsoft Entra Practice Test 3 — 15 Questions

Question 1

Refer to the following JSON exhibit.

You are reviewing a Conditional Access policy in JSON format.

```json
{
  "displayName": "Require MFA and terms of use from trusted locations",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"],
      "excludeUsers": []
    },
    "locations": {
      "includeLocations": ["AllTrusted"],
      "excludeLocations": []
    },
    "applications": {
      "includeApplications": ["All"],
      "excludeApplications": []
    },
    "clientAppTypes": ["All"]
  },
  "grantControls": {
    "operator": "AND",
    "builtInControls": ["mfa"],
    "termsOfUse": ["a3f3bf6a-4f4e-4f1e-9f1e-2c3b3c1c3c3c"]
  }
}
```

What is the effect of this policy?

Accepted Answer

All users must use MFA and accept terms of use when accessing from trusted locations.. The policy grants access only when the conditions of 'trusted locations' AND 'multifactor authentication' AND 'accept terms of use' are all met. Since the policy is configured to 'Grant access' with these three controls required, any user (including guests) attempting to access from a trusted location must satisfy all three requirements. Option B correctly captures this combination.

Answer

All users are blocked from accessing resources from untrusted locations.

Answer

All users must use MFA from all locations.

Answer

Guests must accept terms of use and use MFA from all locations.

Question 2

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution to allow external partners to access a specific SharePoint Online site. The partners must use their own email addresses to sign in. You want to enforce multifactor authentication for all external users. Additionally, you need to ensure that external users are automatically removed from the site after 90 days. You have the following requirements:

1. Use built-in Microsoft Entra features.
2. Minimize administrative effort.
3. The solution must support automatic expiration of access.

What should you do?

Accepted Answer

Configure Microsoft Entra B2B collaboration to invite partners, create a Conditional Access policy requiring MFA for guests, and set up an access review to remove inactive guests after 90 days.. Microsoft Entra B2B collaboration allows external partners to sign in with their own email addresses, and a Conditional Access policy can enforce MFA for guest users. An access review policy can automatically remove external users after 90 days of inactivity, meeting the requirement for automatic expiration with minimal administrative effort using built-in features.

Answer

Configure Microsoft Entra Cloud Sync to sync partner accounts from their on-premises AD.

Answer

Enable self-service sign-up for external users and configure an access review policy.

Answer

Create guest accounts manually and use Azure AD Domain Services to enforce MFA.

Question 3

Which TWO capabilities are provided by Microsoft Entra Identity Protection?

Accepted Answer

Detecting sign-in risks such as anonymous IP addresses. Microsoft Entra Identity Protection provides advanced risk detection capabilities, including the ability to detect sign-in risks such as sign-ins from anonymous IP addresses (e.g., Tor browser). This is a core feature that allows organizations to identify potentially compromised credentials or malicious sign-in attempts based on real-time signals. Furthermore, Identity Protection allows for the configuration of automated remediation policies. These policies can automatically respond to detected risks by taking actions such as blocking sign-ins, requiring multi-factor authentication, or forcing a password change, thereby protecting user accounts and organizational resources.

Answer

Enforcing session timeouts for applications

Answer

Self-service password reset

Answer

Managing privileged role assignments

Question 4

Which THREE components are part of the Microsoft Entra External Identities suite?

Accepted Answer

B2B direct connect. Microsoft Entra External Identities includes three core components: B2B collaboration, which manages guest users from other organizations; B2B direct connect, which establishes mutual trust with another Microsoft Entra organization; and B2C, which provides customer identity and access management for consumer-facing apps. Conditional Access and Identity Protection are Microsoft Entra security features, not components of the External Identities suite.

Answer

Conditional Access

Answer

Identity Protection

Question 5

Which TWO features are included in Microsoft Entra ID P2 licensing?

Accepted Answer

Microsoft Entra Privileged Identity Management. Microsoft Entra ID P2 licensing includes Microsoft Entra Privileged Identity Management (PIM), which provides just-in-time privileged access, time-bound role assignments, and approval workflows to manage, control, and monitor access to Azure AD and Azure resources. PIM is a P2-only feature that helps reduce standing administrative privileges and enhances security posture. Additionally, Microsoft Entra Identity Protection is a P2-exclusive feature that offers risk detection, risk-based Conditional Access policies, and vulnerability assessments to protect identities from compromise. Options A, B, and C are available in lower Microsoft Entra ID tiers (Free or P1).

Answer

Passwordless authentication

Answer

Multifactor authentication (MFA)

Answer

Single sign-on (SSO) to SaaS apps

Question 6

Which TWO of the following are capabilities of Microsoft Entra ID Governance?

Accepted Answer

Access Reviews. Access Reviews (B), Entitlement Management (C), and Privileged Identity Management (A) are all core capabilities of Microsoft Entra ID Governance. The explanation incorrectly states that PIM is not considered one of the two core governance capabilities, which contradicts Microsoft's official documentation for Entra ID Governance.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Identity Protection

Question 7

Which THREE of the following are features of Microsoft Entra ID Protection?

Accepted Answer

User risk detection (e.g., leaked credentials). Microsoft Entra ID Protection includes user risk detection, which identifies accounts that may have been compromised based on signals such as leaked credentials, unusual activity, or password spray attacks. It also provides sign-in risk detection, which evaluates the risk associated with a sign-in attempt based on factors like anonymous IP addresses, unfamiliar locations, or impossible travel. Furthermore, Entra ID Protection integrates with Conditional Access to enable risk-based policies, allowing administrators to automatically enforce actions like multi-factor authentication, password changes, or blocking access when user or sign-in risk levels are elevated.

Answer

Access reviews

Answer

Entitlement management

Question 8

Which TWO of the following are methods for implementing passwordless authentication in Microsoft Entra ID?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is a passwordless authentication method in Microsoft Entra ID that uses biometric or PIN-based credentials tied to a user's device. It leverages asymmetric key pairs (public/private key cryptography) to authenticate users without transmitting passwords over the network, meeting the passwordless requirement. FIDO2 security keys also provide passwordless authentication by using public-key cryptography, requiring a user presence (e.g., touch) and often a PIN or biometric on the key itself, eliminating the need for a password.

Answer

App passwords

Answer

Email one-time passcode

Answer

SMS-based one-time passcode (OTP)

Question 9

Refer to the exhibit. You are evaluating a Conditional Access policy in JSON format. The policy is assigned to a test user group. A user in that group tries to access Outlook Web App (OWA) from a browser. What is the effect of this policy?

Accepted Answer

Access is allowed because the policy only blocks legacy authentication protocols.. The policy in the exhibit targets 'Office 365 Exchange Online' and includes a condition for 'Client apps: Exchange ActiveSync, Other clients'. However, the user is accessing Outlook Web App (OWA) from a browser, which uses modern authentication (HTTPS). The policy explicitly blocks legacy authentication protocols (Exchange ActiveSync and other clients that do not support modern auth). Since OWA uses modern authentication, it is not affected by this policy, so access is allowed. Option D correctly identifies that the policy only blocks legacy authentication protocols, not modern browser-based access.

Answer

Access is blocked because Exchange ActiveSync is included.

Answer

Access is blocked because the policy targets Office 365.

Answer

Access is allowed but MFA is required.

Question 10

Your organization uses Microsoft Entra ID. You need to ensure that when a user's account is disabled on-premises, their access to cloud apps is blocked within 5 minutes. Which hybrid identity configuration should you use?

Accepted Answer

Microsoft Entra Connect Sync with directory synchronization. Microsoft Entra Connect Sync with directory synchronization is the correct choice because it enables the synchronization of account state changes (such as disabled accounts) from on-premises Active Directory to Microsoft Entra ID. When a user account is disabled on-premises, the next synchronization cycle (which runs every 30 minutes by default) updates the cloud account's status. To meet the 5-minute requirement, the synchronization interval can be reduced using the 'Set-ADSyncScheduler' cmdlet. This ensures that the disabled state is reflected in Microsoft Entra ID promptly, blocking access to cloud apps.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Password Hash Synchronization

Question 11

Your organization uses Microsoft Entra ID. Which TWO capabilities are provided by Microsoft Entra ID Governance?

Accepted Answer

Entitlement management. Entitlement management is a core capability of Microsoft Entra ID Governance that enables organizations to manage the identity and access lifecycle at scale. It allows administrators to create and manage access packages, automate access requests, and enforce policies for internal and external users, ensuring the right people have the right access to the right resources. Access reviews are another key capability of Microsoft Entra ID Governance, enabling organizations to periodically review users' access rights to resources to ensure only necessary access is maintained and to remove stale or inappropriate access.

Answer

Identity Protection

Answer

Conditional Access

Question 12

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy includes locations condition "AllTrusted". What is the effect of this policy?

Accepted Answer

Users are required to perform MFA when accessing from trusted locations.. In Microsoft Entra ID Conditional Access, the 'AllTrusted' locations condition includes locations marked as trusted (e.g., corporate network IP ranges or MFA-trusted IPs). When a policy is configured with this condition and set to 'Require MFA', it enforces MFA specifically when users access from those trusted locations. This is often used to require step-up authentication even from within the corporate network, for example, when accessing sensitive applications.

Answer

Users are required to perform MFA when accessing from untrusted locations.

Answer

Users are blocked from accessing apps from trusted locations.

Answer

Users are allowed access without MFA from trusted locations.

Question 13

Refer to the exhibit. You are reviewing a Microsoft Entra PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. The request is for an 8-hour activation with a start time. What is the maximum allowed activation duration for Global Administrator in PIM?

Accepted Answer

8 hours. Microsoft Entra PIM does not allow 24-hour activation for the Global Administrator role. The Global Administrator role has a stricter maximum activation duration of 8 hours. Other roles can be configured up to 24 hours, but Global Administrator is capped at 8 hours.

Answer

4 hours

Answer

12 hours

Answer

24 hours

Question 14

You are configuring Microsoft Entra ID Governance for your organization. You need to ensure that when a user's employment status changes to 'Terminated' in the HR system, their access to critical applications is automatically revoked within 24 hours. Additionally, managers must be able to request temporary access for a terminated user if needed. What should you implement?

Accepted Answer

Create an access package with automatic assignment policies based on HR attributes and enable access reviews.. Access packages in Microsoft Entra entitlement management can include automatic assignment policies that evaluate HR attributes (like employment status) to grant or revoke access. When a user's status changes to 'Terminated', the policy automatically removes their membership in the access package, revoking access to critical applications within the configured time frame (e.g., 24 hours). Additionally, the access package request process allows managers to request temporary access for a user (including a terminated user, if policies permit) for a specified duration, fulfilling both requirements. While access reviews are a component of Entitlement Management, they are used for periodically re-certifying existing access, not for requesting new access.

Answer

Configure Microsoft Entra entitlement management with access packages for external users.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) for all user accounts.

Answer

Implement Microsoft Entra ID Governance lifecycle workflows.

Question 15

Which TWO of the following are capabilities of Microsoft Entra ID? (Select TWO.)

Accepted Answer

Self-service password reset.. Microsoft Entra ID is a cloud-based identity and access management service. Self-service password reset (SSPR) is a built-in feature that allows users to reset their own passwords without administrator intervention, provided they meet configured authentication requirements. This capability is a core part of Entra ID's identity governance and security features. Additionally, Entra ID is fundamental for providing identity and access management for cloud applications, enabling single sign-on (SSO), user provisioning, and conditional access policies to secure access to SaaS apps and custom line-of-business applications.

Answer

Mobile device management.

Answer

Threat protection for endpoints.

Answer

Data loss prevention for documents.