SC-900 Describe the capabilities of Microsoft Entra Practice Test 6 — 15 Questions

Question 1

A company uses Microsoft Entra ID. They have a financial application that should only be accessible from Windows devices. The security team wants to create a Conditional Access policy to block access from other operating systems such as macOS or Linux. Which assignment condition should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device platforms. The Device platforms condition in a Conditional Access policy allows administrators to target specific operating systems (e.g., Windows, iOS, Android, macOS) or block others. By configuring this condition to only include Windows devices, the policy will block access from macOS, Linux, or any other non-Windows platform. This directly addresses the security team's requirement to restrict the financial application to Windows devices only.

Answer

Locations

Answer

Client apps

Answer

Sign-in risk

Question 2

A company uses Microsoft Entra ID. A new IT support technician is hired and needs to be able to reset passwords for users but must not be allowed to delete user accounts or modify group memberships. Which built-in Microsoft Entra ID role should be assigned to this technician?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific permissions required to reset passwords for all users, including administrators, while explicitly excluding permissions to delete user accounts or modify group memberships. This role is designed for scenarios where a technician needs to perform password-related tasks without broader user management capabilities.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Global Administrator

Question 3

A company has an on-premises Active Directory domain and uses Microsoft Entra ID (Azure AD) for cloud applications. They purchase new Windows 10 laptops that are not yet joined to any domain. The IT admin wants users to be able to sign in with their existing on-premises credentials and automatically have the laptops joined to both the on-premises AD domain and Microsoft Entra ID. Which device identity option should the admin configure?

Accepted Answer

Microsoft Entra hybrid joined. Microsoft Entra hybrid join allows devices to be joined to both an on-premises Active Directory domain and Microsoft Entra ID simultaneously. This enables users to sign in with their existing on-premises credentials and automatically have the laptops registered in both directories, meeting the requirement for a seamless single sign-on experience.

Answer

Microsoft Entra registered

Answer

Microsoft Entra joined

Answer

On-premises domain join only

Question 4

A company uses Microsoft Entra ID. The security team needs to ensure that when users sign in to a critical financial application from an untrusted network, they must first complete multi-factor authentication (MFA). Additionally, the team wants to block the sign-in if the device is not marked as compliant by Microsoft Intune. Which conditional access grant control should they configure to meet both requirements?

Accepted Answer

Require multi-factor authentication AND Require device to be marked as compliant. Conditional Access grant controls allow you to require multiple conditions to be met simultaneously. By selecting 'Require multi-factor authentication' AND 'Require device to be marked as compliant', the policy ensures that both MFA and device compliance are enforced for the sign-in, meeting the security team's requirements.

Answer

Require multi-factor authentication only

Answer

Require one of the selected controls

Answer

Require device to be marked as compliant only

Question 5

A company uses Microsoft Entra ID and Intune for device management. The security team wants to create a Conditional Access policy for a sensitive research application. They require that: 1) The user must use a device that is marked as compliant by Intune, and 2) The user must accept the company's terms of use before accessing the app. Which grant control combination should they configure in the policy?

Accepted Answer

Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require all the selected controls'. The policy requires both conditions—device compliance and terms of use—to be enforced simultaneously. In Microsoft Entra Conditional Access, when multiple grant controls are selected and set to 'Require all the selected controls', the user must satisfy every control to gain access. This matches the security team's requirement that the device must be compliant AND the terms of use must be accepted.

Answer

Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require one of the selected controls'

Answer

Select 'Require multi-factor authentication' and 'Require terms of use' and choose 'Require all the selected controls'

Answer

Select only 'Require terms of use' and configure device compliance as a condition

Question 6

A company wants to automatically detect and alert the security team when a user sign-in appears to originate from a known compromised credential or from an anonymizing VPN service. The company wants to receive a risk score for each sign-in and be able to trigger automated remediation actions. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks, including sign-ins from compromised credentials and anonymizing VPN services (e.g., Tor). It assigns a risk score (low, medium, high) to each sign-in and user, and supports automated remediation actions such as requiring multi-factor authentication (MFA) or blocking sign-in via Conditional Access policies integrated with the risk detection.

Answer

Microsoft Entra Identity Governance

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra External Identities

Question 7

A company uses Microsoft Entra ID. The security team wants to configure automated actions when user sign-ins are detected as high risk due to anonymized IP addresses or leaked credentials. They need to automatically block the sign-in or force a password change based on risk level. Which Microsoft Entra ID feature should they use?

Accepted Answer

Identity Protection. Microsoft Entra ID Protection is the correct feature because it automates the detection and remediation of identity-based risks, including sign-ins from anonymized IP addresses and leaked credentials. It allows administrators to configure conditional access policies that automatically block high-risk sign-ins or force a password change based on the risk level (e.g., low, medium, high). This directly matches the security team's requirement for automated actions tied to risk detection.

Answer

Privileged Identity Management

Answer

Azure AD Connect

Answer

Self-service password reset

Question 8

A company uses Microsoft Entra ID (Azure AD). The IT team has created a security group named 'SalesTeam' that contains all sales department users. They want to ensure that only members of this group can access the company's CRM application, which is registered as an enterprise application in Entra ID. What should the IT team configure?

Accepted Answer

Enterprise application user and group assignment. Enterprise applications in Microsoft Entra ID can be configured to require user or group assignment, which restricts access to only assigned users or groups. By assigning the 'SalesTeam' security group to the CRM enterprise application, the IT team ensures that only members of that group can authenticate and access the application. This is the standard method for controlling access to gallery or custom enterprise applications in Entra ID.

Answer

A Conditional Access policy that requires group membership

Answer

Self-service group management settings

Answer

Application registration settings

Question 9

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-bound administrative access to the Microsoft 365 user management role for IT support staff. The access should require an approval from a senior administrator, and all actions should be audited. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access with time-bound role activation, approval workflows, and full auditing. This directly matches the requirement for temporary, approved administrative access to the Microsoft 365 user management role with audit trails.

Answer

Conditional Access

Answer

Identity Protection

Answer

Identity Governance

Question 10

A company uses Microsoft Entra ID. Their sales team wants to use a third-party customer relationship management (CRM) application that requires the 'Sign in and read user profile' permission and also a high-risk permission to 'Read all users' full profiles'. The security team wants to allow users to request access to this application, but they want to require an administrator to review and approve the high-risk permission request before consent is granted. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Admin consent workflow. The admin consent workflow in Microsoft Entra ID allows end users to request consent for applications that require permissions, while requiring administrator approval for high-risk permissions. In this scenario, the CRM app requests both a low-risk permission ('Sign in and read user profile') and a high-risk permission ('Read all users' full profiles'), and the security team wants admin review for the high-risk one. The admin consent workflow enables this by letting users initiate the request, then routing it to designated administrators for approval or denial, ensuring that high-risk permissions are not granted without oversight.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 11

A company uses Microsoft Entra ID. A junior administrator needs to occasionally reset passwords for the IT department. The security team wants to grant this permission only for a limited time and require an approval from a senior administrator before the permission becomes active. All password reset actions must be audited. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Entra ID Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing the junior administrator to request a time-limited role for password reset that requires approval from a senior administrator. PIM also enables auditing of all role activations and actions, meeting the security team's requirements for limited duration, approval workflow, and auditability.

Answer

Entra ID Identity Protection

Answer

Entra ID Conditional Access

Answer

Entra ID Terms of Use

Question 12

A company uses Microsoft Entra ID. The IT department needs to ensure that membership in the 'Global Administrator' role is regularly reviewed. Every quarter, the designated reviewers (e.g., senior managers) receive an email asking them to confirm whether each user in the role should keep their assignment. After the review deadline, any member not approved is automatically removed. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID are specifically designed for periodic attestation of group memberships, application access, and role assignments. The scenario describes a quarterly review where designated reviewers receive email notifications and unapproved members are automatically removed after the deadline, which is the exact workflow that Access Reviews automate. This feature ensures compliance by requiring explicit confirmation for each user in the Global Administrator role.

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Answer

Conditional Access

Question 13

A company has an on-premises web-based expense report application. The IT team wants to make this application accessible to remote employees over the internet without requiring a VPN. They need to use Microsoft Entra ID for authentication and apply Conditional Access policies such as requiring multi-factor authentication. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Azure AD Application Proxy. Microsoft Entra application proxy allows on-premises web applications to be published for remote access without a VPN. It integrates with Microsoft Entra ID for authentication and supports Conditional Access policies, including multi-factor authentication, by acting as a reverse proxy that forwards authenticated requests to the internal application.

Answer

Self-service password reset (SSPR)

Answer

Azure AD B2B collaboration

Answer

Azure AD Domain Services

Question 14

A company uses Microsoft Entra ID. They have a financial application that should only be accessible from Windows devices. The security team wants to create a Conditional Access policy to block access from other operating systems such as macOS or Linux. Which assignment condition should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it enables external users from a partner organization to access the company's internal SharePoint site using their own corporate credentials from their Microsoft Entra tenant. B2B collaboration creates a guest user object in the resource tenant without requiring separate guest accounts or additional passwords, leveraging cross-tenant trust and SAML/WS-Federation for authentication.

Answer

Microsoft Entra B2C

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Application Proxy

Question 15

A company uses Microsoft Entra ID. The security team wants to enforce a policy that prevents users from choosing commonly used weak passwords like 'Winter2024!' or 'Password@123', and also blocks customized variants based on organizational context (e.g., company name). Users must create passwords that meet standard complexity requirements. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection (B) is the correct feature because it specifically enforces custom banned password lists that block weak passwords like 'Winter2024!' and organizational variants such as the company name. It works alongside standard password complexity requirements to prevent users from choosing passwords that appear on a global banned list or a tenant-specific custom list. This directly addresses the security team's need to block commonly used weak passwords and context-based variants.

Answer

Password hash synchronization

Answer

Self-Service Password Reset

Answer

Conditional Access