SC-900 Describe the capabilities of Microsoft Entra Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. Which TWO capabilities are provided by Microsoft Entra ID Governance?

Accepted Answer

Entitlement management. Entitlement management (A) is a core Microsoft Entra ID Governance capability that lets you package resources, apps, and roles into access packages with policies so users can request, approve, and receive time-bound access. Privileged Identity Management (B) is also part of Entra ID Governance, providing just-in-time role activation, approval workflows, and time-bound assignments for privileged directory and Azure resource roles. Access reviews (D) belong to Entra ID Governance as well, enabling periodic recertification of group memberships, application assignments, and role assignments to ensure access remains appropriate. Identity Protection (C) is a separate Entra ID feature focused on detecting and remediating risky users and sign-ins, and Conditional Access (E) is an access-policy engine for enforcing sign-in controls, so neither is categorized as an Entra ID Governance capability.

Answer

Identity Protection

Answer

Conditional Access

Question 2

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy includes locations condition "AllTrusted". What is the effect of this policy?

Accepted Answer

Users are required to perform MFA when accessing from trusted locations.. In Microsoft Entra ID Conditional Access, the 'AllTrusted' locations condition includes locations marked as trusted (e.g., corporate network IP ranges or MFA-trusted IPs). When a policy is configured with this condition and set to 'Require MFA', it enforces MFA specifically when users access from those trusted locations. This is often used to require step-up authentication even from within the corporate network, for example, when accessing sensitive applications.

Answer

Users are required to perform MFA when accessing from untrusted locations.

Answer

Users are blocked from accessing apps from trusted locations.

Answer

Users are allowed access without MFA from trusted locations.

Question 3

Refer to the exhibit. You are reviewing a Microsoft Entra PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. The request is for an 8-hour activation with a start time. What is the maximum allowed activation duration for Global Administrator in PIM?

Accepted Answer

8 hours. Microsoft Entra PIM does not allow 24-hour activation for the Global Administrator role. The Global Administrator role has a stricter maximum activation duration of 8 hours. Other roles can be configured up to 24 hours, but Global Administrator is capped at 8 hours.

Answer

4 hours

Answer

12 hours

Answer

24 hours

Question 4

You are configuring Microsoft Entra ID Governance for your organization. You need to ensure that when a user's employment status changes to 'Terminated' in the HR system, their access to critical applications is automatically revoked within 24 hours. Additionally, managers must be able to request temporary access for a terminated user if needed. What should you implement?

Accepted Answer

Create an access package with automatic assignment policies based on HR attributes and enable access reviews.. Access packages in Microsoft Entra entitlement management can include automatic assignment policies that evaluate HR attributes (like employment status) to grant or revoke access. When a user's status changes to 'Terminated', the policy automatically removes their membership in the access package, revoking access to critical applications within the configured time frame (e.g., 24 hours). Additionally, the access package request process allows managers to request temporary access for a user (including a terminated user, if policies permit) for a specified duration, fulfilling both requirements. While access reviews are a component of Entitlement Management, they are used for periodically re-certifying existing access, not for requesting new access.

Answer

Configure Microsoft Entra entitlement management with access packages for external users.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) for all user accounts.

Answer

Implement Microsoft Entra ID Governance lifecycle workflows.

Question 5

Refer to the exhibit. You are reviewing Microsoft Entra role assignments for a user. The first assignment has a roleDefinitionId of '62e90394-69f5-4237-9190-012177145e10' at scope '/'. The second assignment has a roleDefinitionId of '194ae4cb-b126-40b2-bd5b-6091b380977d' at a subscription scope. What can you infer?

Accepted Answer

The user has the Global Administrator role at the tenant level.. The roleDefinitionId '62e90394-69f5-4237-9190-012177145e10' corresponds to the Global Administrator role in Microsoft Entra ID. The scope '/' indicates the tenant root scope, meaning the assignment applies to the entire tenant. Therefore, the user is a Global Administrator at the tenant level, granting broad administrative access to Microsoft Entra ID (Entra ID) resources. However, Global Administrator does not automatically provide Azure RBAC roles for managing Azure resources; those require separate assignments.

Answer

The user can only read Azure AD objects.

Answer

The second role is assigned at the subscription scope.

Answer

The user is a Global Administrator with full access to all Azure AD and Azure resources.

Question 6

Which TWO of the following are capabilities of Microsoft Entra ID? (Select TWO.)

Accepted Answer

Self-service password reset.. Option B (Self-service password reset) is correct because Microsoft Entra ID provides SSPR, allowing users to reset or unlock their own passwords via authentication methods such as Microsoft Authenticator, email, or phone, reducing helpdesk load. Option C (Identity and access management for cloud applications) is correct because Entra ID is Microsoft's cloud-based identity provider, delivering authentication, SSO via SAML/OIDC, conditional access, and app provisioning for thousands of SaaS and cloud applications. Option A (Mobile device management) belongs to Microsoft Intune, not Entra ID, which handles identity rather than device configuration and compliance. Option D (Threat protection for endpoints) is a capability of Microsoft Defender for Endpoint, not Entra ID. Option E (Data loss prevention for documents) is provided by Microsoft Purview (or Microsoft 365 DLP), not by Entra ID.

Answer

Mobile device management.

Answer

Threat protection for endpoints.

Answer

Data loss prevention for documents.

Question 7

Which TWO of the following are authentication methods supported by Microsoft Entra ID? (Select TWO.)

Accepted Answer

Password. Option B (Password) is correct because Microsoft Entra ID natively supports cloud-managed username/password authentication, including password hash synchronization and pass-through authentication for hybrid identities. Option E (FIDO2 security keys) is correct because Entra ID supports phishing-resistant, passwordless sign-in with FIDO2-compliant hardware keys (e.g., via Windows Hello or external keys) as an authentication method. Option A (OTP tokens) is not a standalone supported method in Entra ID; OTP is delivered as part of MFA or SSPR rather than as a primary authentication method. Option C (Smart card with PIN) is not natively supported by Entra ID for cloud authentication; certificate-based authentication exists but smart card/PIN is not a listed method. Option D (Biometric fingerprint/face) is not a directly supported Entra ID authentication method; biometrics are handled locally by Windows Hello, which then uses a supported method such as FIDO2 or certificate-based authentication.

Answer

One-time password (OTP) tokens

Answer

Smart card with PIN

Answer

Biometric (fingerprint/face)

Question 8

Your organization uses Microsoft Entra ID to manage identities. You need to ensure that users receive a notification when their password is about to expire. Which feature should you configure?

Accepted Answer

Password expiration notifications. Password expiration notifications are an automatic feature of Microsoft Entra ID's password policy for cloud-only users. When a password is set to expire (e.g., after 90 days by default), Entra ID automatically sends email notifications to users, typically starting 14 days before expiration, to prompt them to change their password. This built-in mechanism ensures users are alerted before their password expires and does not require additional licensing or complex configuration beyond setting the password policy itself.

Answer

Self-service password reset (SSPR)

Answer

Identity Protection

Answer

Privileged Identity Management

Question 9

A company wants to automatically remove a user's access to all applications when the user leaves the organization. Which Microsoft Entra feature can help achieve this?

Accepted Answer

Access Reviews. None of the options listed correctly describe the Microsoft Entra feature that automatically removes a user's access to all applications upon departure. The correct feature is Microsoft Entra Lifecycle Workflows, which automates event-driven offboarding tasks such as disabling accounts and removing group memberships. Access Reviews are recurring recertification processes that require manual approval and do not automatically trigger on user departure. Privileged Identity Management (PIM) manages just-in-time privileged role activation, not general application access removal. Conditional Access enforces access policies based on conditions like location or device health, not offboarding. Identity Protection detects and remediates identity risks but does not handle removal of access upon termination.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Identity Protection

Question 10

Your organization uses Microsoft Entra ID. You need to ensure that guest users can access resources without requiring invitation redemption. Which feature should you enable?

Accepted Answer

B2B Direct Connect. B2B Direct Connect allows guest users to access resources in your Microsoft Entra ID tenant without requiring them to redeem an invitation or accept a consent prompt. This feature establishes a mutual, two-way trust relationship between your tenant and an external Microsoft Entra ID tenant, enabling seamless resource access for users who already exist in the partner's directory.

Answer

Application Proxy

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 11

Which THREE of the following are features of Microsoft Entra ID Protection?

Accepted Answer

Ability to define risk-based Conditional Access policies.. Microsoft Entra ID Protection provides risk detection signals that can be integrated into Conditional Access policies, enabling administrators to automatically enforce controls such as requiring multi-factor authentication or blocking access based on user or sign-in risk levels. This allows organizations to respond dynamically to detected threats without manual intervention.

Answer

Automatically notify users when their password is about to expire.

Answer

Just-in-time privileged role activation.

Question 12

Your organization uses Microsoft Entra ID. Which TWO capabilities are provided by Microsoft Entra ID Governance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that requires a compliant device and create an app protection policy for Outlook. The most efficient approach is to require a compliant device via Conditional Access and also apply an app protection policy for Outlook. Conditional Access enforces that only managed, compliant devices can access Exchange Online, while the app protection policy ensures data protection within the Outlook app. Together they meet the requirement.

Answer

Create an app protection policy in Microsoft Intune for Outlook and assign it to all users

Answer

Enforce device compliance policies in Intune and create a Conditional Access policy that requires compliant device

Answer

Create a Conditional Access policy that requires MFA for the Outlook app

Question 13

Your organization implements a Microsoft Entra ID tenant with a custom domain (contoso.com). You need to ensure that all users are assigned a unique user principal name (UPN) based on their email address. What should you do?

Accepted Answer

Configure the user naming attribute to use the email address as the UPN. To ensure users are assigned a UPN based on their email address in Microsoft Entra ID, administrators must manually set the UPN during user creation or modification. For new users, this involves entering the desired email address (or its prefix) as the 'User name' and selecting the appropriate custom domain suffix. For existing users, their UPNs can be updated in bulk using PowerShell or the Microsoft Entra admin center's bulk operations feature to match their email addresses. While there isn't a single 'user naming attribute' setting that automates this process globally, the action of configuring the UPN for each user to match their email address is the necessary step.

Answer

Verify the custom domain in Microsoft Entra ID

Answer

Enable Microsoft Entra ID Domain Services

Answer

Use Microsoft Entra ID Connect to sync UPNs from on-premises

Question 14

Which THREE capabilities are part of Microsoft Entra ID Governance? (Choose three.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) (A) is a core Entra ID Governance capability that provides just-in-time privileged access, approval workflows, and time-bound role assignments for Microsoft Entra ID and Azure resources. Entitlement management (C) is also part of Entra ID Governance, enabling access packages, catalogs, and policies to manage the request-and-approval lifecycle of resource access for internal and external users. Access reviews (E) are included in Entra ID Governance and let organizations periodically recertify group memberships, application assignments, and privileged role assignments to enforce least privilege. Passwordless authentication (B) is an authentication method capability of Entra ID, not a governance feature, and identity lifecycle management (D) is a related but distinct workload/term that is not one of the three governance capabilities tested here.

Answer

Passwordless authentication

Answer

Identity lifecycle management

Question 15

A conditional access policy in Microsoft Entra ID is configured as follows:
- Conditions: Include all trusted locations; client apps: Browser.
- Grant controls: Require multi-factor authentication and require terms of use acceptance.
- Session controls: Sign-in frequency every 1 hour; use Cloud App Security for monitoring.

A user signs in from a trusted location using a browser. Which controls will be enforced?

Accepted Answer

MFA, terms of use acceptance, sign-in frequency every 1 hour, and Cloud App Security monitoring.. The conditional access policy applies when the user is at a trusted location and the client app is a browser. The grant controls require multi-factor authentication and terms of use acceptance. The session controls apply sign-in frequency every 1 hour and Cloud App Security monitoring. Because the user meets the conditions, the policy will require the grant controls and apply the session controls. Therefore, MFA, terms of use acceptance, sign-in frequency every 1 hour, and Cloud App Security monitoring will all be enforced/applied.

Answer

MFA, terms of use acceptance, and application enforced restrictions.

Answer

Only MFA and terms of use acceptance.

Answer

Only sign-in frequency and Cloud App Security monitoring.