SC-900 Describe the capabilities of Microsoft Entra Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are valid components of Microsoft Entra Conditional Access? (Select THREE.)

Accepted Answer

Users and groups. Microsoft Entra Conditional Access policies are built from Assignments and Access controls. The Assignments define the 'If' criteria and include Users and groups, Cloud apps or actions, and Conditions. Grant and Session are also valid Conditional Access components, but they are Access controls (the 'Then' part), not Assignments. This question asks for the three assignment components, so Grant and Session are not selected.

Answer

Session

Answer

Grant

Question 2

Which TWO of the following are authentication methods supported by Microsoft Entra ID? (Select TWO.)

Accepted Answer

Password. Password is a fundamental authentication method supported by Microsoft Entra ID. It is the most common primary authentication factor used for user sign-in, where the user provides a username and password that is verified against the directory. Entra ID supports password-based authentication for cloud-only accounts, synchronized on-premises passwords via Password Hash Sync, and pass-through authentication. FIDO2 security keys are also a natively supported, strong, passwordless authentication method in Microsoft Entra ID, allowing users to sign in with a hardware security key instead of a password, often combined with a PIN or biometric unlock.

Answer

One-time password (OTP) tokens

Answer

Smart card with PIN

Answer

Biometric (fingerprint/face)

Question 3

Your organization uses Microsoft Entra ID to manage identities. You need to ensure that users receive a notification when their password is about to expire. Which feature should you configure?

Accepted Answer

Password expiration notifications. Password expiration notifications are an automatic feature of Microsoft Entra ID's password policy for cloud-only users. When a password is set to expire (e.g., after 90 days by default), Entra ID automatically sends email notifications to users, typically starting 14 days before expiration, to prompt them to change their password. This built-in mechanism ensures users are alerted before their password expires and does not require additional licensing or complex configuration beyond setting the password policy itself.

Answer

Self-service password reset (SSPR)

Answer

Identity Protection

Answer

Privileged Identity Management

Question 4

A company wants to automatically remove a user's access to all applications when the user leaves the organization. Which Microsoft Entra feature can help achieve this?

Accepted Answer

Access Reviews. None of the options listed correctly describe the Microsoft Entra feature that automatically removes a user's access to all applications upon departure. The correct feature is Microsoft Entra Lifecycle Workflows, which automates event-driven offboarding tasks such as disabling accounts and removing group memberships. Access Reviews are recurring recertification processes that require manual approval and do not automatically trigger on user departure. Privileged Identity Management (PIM) manages just-in-time privileged role activation, not general application access removal. Conditional Access enforces access policies based on conditions like location or device health, not offboarding. Identity Protection detects and remediates identity risks but does not handle removal of access upon termination.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Identity Protection

Question 5

Which TWO Microsoft Entra ID features can be used to protect against credential theft? (Choose two.)

Accepted Answer

Passwordless authentication. Passwordless authentication (Option A) eliminates the use of passwords entirely, removing the primary vector for credential theft such as phishing or password spraying. By relying on biometrics, FIDO2 security keys, or Microsoft Authenticator, there is no password to steal, directly mitigating credential theft attacks. Conditional Access policies that require MFA (Option E) protect against credential theft by enforcing a second verification factor. Even if an attacker manages to steal a user's password, they would still need to provide the second factor (e.g., a code from an authenticator app, a biometric scan) to gain access, making the stolen password useless on its own.

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Connect

Question 6

Which THREE capabilities are part of Microsoft Entra ID Governance? (Choose three.)

Accepted Answer

Privileged Identity Management (PIM). Microsoft Entra ID Governance focuses on managing and governing identities and access. Its core, distinct capabilities include: 
*   **Privileged Identity Management (PIM)**: Manages, controls, and monitors access to important resources in Microsoft Entra ID, Azure, and other Microsoft Online Services, providing just-in-time access and approval workflows for privileged roles.
*   **Entitlement management**: Automates access request workflows, assignments, reviews, and expiration for access to applications, groups, and SharePoint sites.
*   **Access reviews**: Enables organizations to efficiently manage group memberships, access to enterprise applications, and role assignments by regularly reviewing who has access.

'Identity lifecycle management' is an overarching goal or category that these capabilities contribute to, and while sometimes listed as a capability, PIM, Entitlement Management, and Access Reviews are the three most distinct and primary features often highlighted as core capabilities. 'Passwordless authentication' is an authentication method, not a governance capability.

Answer

Passwordless authentication

Answer

Identity lifecycle management

Question 7

A conditional access policy in Microsoft Entra ID is configured as follows:
- Conditions: Include all trusted locations; client apps: Browser.
- Grant controls: Require multi-factor authentication and require terms of use acceptance.
- Session controls: Sign-in frequency every 1 hour; use Cloud App Security for monitoring.

A user signs in from a trusted location using a browser. Which controls will be enforced?

Accepted Answer

MFA, terms of use acceptance, sign-in frequency every 1 hour, and Cloud App Security monitoring.. The conditional access policy applies when the user is at a trusted location and the client app is a browser. The grant controls require multi-factor authentication and terms of use acceptance. The session controls apply sign-in frequency every 1 hour and Cloud App Security monitoring. Because the user meets the conditions, the policy will require the grant controls and apply the session controls. Therefore, MFA, terms of use acceptance, sign-in frequency every 1 hour, and Cloud App Security monitoring will all be enforced/applied.

Answer

MFA, terms of use acceptance, and application enforced restrictions.

Answer

Only MFA and terms of use acceptance.

Answer

Only sign-in frequency and Cloud App Security monitoring.

Question 8

Which FOUR of the following are authentication methods supported by Microsoft Entra ID?

Accepted Answer

Passwordless phone sign-in with Microsoft Authenticator. Microsoft Entra ID supports all of the following as authentication methods: passwordless phone sign-in with Microsoft Authenticator, SMS sign-in, FIDO2 security keys, and certificate-based authentication. Biometric only (fingerprint/face) without a device is not a supported standalone method because biometric authentication in Microsoft Entra ID is bound to a registered device or authenticator app.

Answer

Biometric only (fingerprint/face) without device

Question 9

Which THREE of the following are capabilities of Microsoft Entra ID Governance?

Accepted Answer

Access reviews. Microsoft Entra ID Governance encompasses several key capabilities designed to manage and govern identity and access lifecycles. Access reviews are a core capability, enabling organizations to periodically review and certify user access to resources, groups, and applications, ensuring compliance and removing stale or excessive permissions. Privileged Identity Management (PIM) is another crucial component, allowing for just-in-time and just-enough access to sensitive resources, reducing the attack surface. Entitlement management provides a comprehensive solution for managing identity and access lifecycles at scale, automating access requests, approvals, and provisioning for internal and external users. These three capabilities collectively ensure that the right people have the right access to the right resources at the right time.

Answer

Self-service password reset

Answer

Conditional access

Question 10

Which THREE of the following are identity protection features in Microsoft Entra ID Protection?

Accepted Answer

Risk detections such as leaked credentials and anonymous IP address. Microsoft Entra ID Protection uses risk detections, such as leaked credentials and anonymous IP addresses, to identify potential identity compromises. Leaked credentials are detected by comparing user credentials against known breach databases, while anonymous IP addresses (e.g., Tor exit nodes) are flagged as risky sign-in attributes. These detections are foundational to the service's ability to assess sign-in and user risk levels. Furthermore, Entra ID Protection provides tools for security administrators to investigate these detected risks and remediate incidents, for example, by confirming compromise or dismissing risk. It also allows for the configuration of automated risk policies (user risk policy and sign-in risk policy) that define actions to be taken when a certain risk level is detected, such as requiring a secure password reset or blocking access.

Answer

Self-service password reset

Answer

Conditional access policies

Question 11

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to implement a solution that ensures only compliant devices can access corporate applications. Devices must be enrolled in Intune and meet compliance policies (e.g., disk encryption enabled, antivirus running). Additionally, you require that users must authenticate with multi-factor authentication (MFA) when accessing sensitive applications from non-compliant devices, even if the user is compliant. The solution must use a single policy where possible. What should you configure?

Accepted Answer

Configure Intune compliance policies and enforce them via conditional access by requiring compliant device. For sensitive apps, add MFA requirement in the same conditional access policy.. A single Conditional Access policy applies a uniform set of grant controls (e.g., 'Require compliant device' AND/OR 'Require multi-factor authentication') if its conditions are met. It cannot dynamically apply different grant controls based on varying conditions (like app sensitivity combined with device compliance state) within the same policy object. To achieve the stated requirements (general block for non-compliant devices, but an exception for sensitive apps with MFA), at least two policies are generally needed: one to block non-compliant devices from general corporate apps (with an exclusion for sensitive apps), and another to require MFA for non-compliant devices accessing sensitive apps.

Answer

Create two conditional access policies: one to require device compliance for all users, and another to require MFA for sensitive applications.

Answer

Create a conditional access policy that blocks access from non-compliant devices, and configure MFA for all users.

Answer

Use Microsoft Entra ID Protection to enforce MFA based on risk, and Intune for device compliance.

Question 12

Which FOUR are features of Microsoft Entra ID Governance? (Choose four.)

Accepted Answer

Privileged Identity Management (PIM). Microsoft Entra ID Governance encompasses several key capabilities for managing identity and access lifecycles. These include: Privileged Identity Management (PIM), which manages, controls, and monitors access to important resources in Microsoft Entra ID, Azure, and other Microsoft online services; Entitlement management, which enables managing access at scale through access packages; Lifecycle workflows, which automate identity-related tasks for users joining, moving, and leaving the organization; and Access reviews, which allow organizations to manage group memberships, access to enterprise applications, and role assignments to ensure users have appropriate access. All four options (A, C, D, E) are distinct and core features of Microsoft Entra ID Governance.

Answer

Conditional Access

Question 13

Your organization, Fabrikam Inc., is migrating from on-premises Active Directory to Microsoft Entra ID. You have a custom line-of-business (LOB) application that uses Windows Integrated Authentication (WIA) and requires Kerberos delegation. The application will be hosted on Azure VMs. You need to enable users to sign in to the LOB application using their Microsoft Entra ID credentials without exposing the application to the internet. Which approach should you use?

Accepted Answer

Use Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD). Publish the app through Application Proxy and configure pre-authentication with Entra ID.. Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD) allows you to publish an on-premises or Azure VM-hosted application that uses Windows Integrated Authentication (WIA) without exposing it to the internet. The Application Proxy service handles pre-authentication with Microsoft Entra ID, then uses KCD to obtain a Kerberos ticket on behalf of the user, enabling seamless sign-in with Entra ID credentials while keeping the application internal.

Answer

Deploy Microsoft Entra Domain Services and join the VMs to the managed domain. Configure the app to use Windows Integrated Authentication.

Answer

Set up a site-to-site VPN and join the Azure VMs to the on-premises domain. Configure the app to use Windows Integrated Authentication.

Answer

Install Azure AD Connect and sync users to Entra ID. Configure the app to use OAuth 2.0.

Question 14

Your company, Wingtip Toys, uses Microsoft Entra ID with a Premium P1 license. You have a third-party SaaS application that supports Security Assertion Markup Language (SAML) 2.0. You need to enable single sign-on (SSO) for users to access this application. The app requires attributes like department and employee ID in the SAML token. You also need to ensure that only users from a specific security group can access the app. What should you do?

Accepted Answer

Add the app from the gallery as a SAML application, configure claims mapping to include department and employee ID, and assign the app to the security group.. With Microsoft Entra ID Premium P1, you can add the SaaS application from the gallery as a SAML application, configure custom claims to include department and employee ID in the SAML token, and assign the application to the security group. OpenID Connect is not SAML SSO. Password-based SSO cannot provide SAML attributes. Application Proxy is used for on-premises applications, not SaaS apps.

Answer

Register the app using OpenID Connect and assign users to the app.

Answer

Add the app from the gallery using password-based SSO and configure group assignment.

Answer

Use Microsoft Entra Application Proxy to publish the app and configure pre-authentication.

Question 15

A company wants to require multi-factor authentication (MFA) for all users accessing a financial application, but only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should be used?

Accepted Answer

Conditional Access. Conditional Access is the correct choice because it allows administrators to define policies that enforce multi-factor authentication (MFA) based on specific conditions, such as network location. In this scenario, a Conditional Access policy can be configured to require MFA only when users access the financial application from outside the corporate network, using the 'Locations' condition to distinguish trusted IP ranges from external sign-ins. This granular control directly addresses the requirement without affecting internal access.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Self-Service Password Reset (SSPR)