SC-900 Describe the capabilities of Microsoft Entra Practice Test 6 — 15 Questions

Question 1

A company has a Microsoft Entra ID tenant and an on-premises Active Directory Domain Services (AD DS) forest. They need to synchronize user accounts, groups, and passwords from AD DS to Microsoft Entra ID. Due to network restrictions, they prefer a lightweight agent that can be deployed on-premises and supports staging mode for testing. Which identity synchronization tool should they use?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync is the correct choice because it is the full-featured synchronization tool that supports staging mode for testing and can be deployed as a lightweight agent on-premises. It synchronizes user accounts, groups, and passwords from AD DS to Microsoft Entra ID, including password hash synchronization, pass-through authentication, and federation integration, making it ideal for complex on-premises environments with network restrictions.

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Identity Manager (MIM)

Question 2

A company needs to provide a developer with temporary, time-bound administrative access to Azure resources to debug a production issue. The access must require approval from the manager and automatically expire after 4 hours. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. This directly matches the requirement for temporary, manager-approved administrative access that expires after 4 hours.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entitlement Management

Question 3

A company wants to offer a secure sign-in experience for external customers who may use personal accounts from Facebook, Google, or any OpenID Connect provider. They also need to customize the sign-in pages with their company logo and colors. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra External ID (formerly Microsoft Entra ID B2C). Microsoft Entra External ID (formerly Azure AD B2C) is the correct choice because it is specifically designed for customer-facing identity scenarios, supporting social identity providers (Facebook, Google) and any OpenID Connect provider. It also provides full customization of sign-in pages, including company branding like logos and colors, which is not available in the free edition of Microsoft Entra ID.

Answer

Microsoft Entra ID (formerly Microsoft Entra ID) — free edition

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 4

A company uses Microsoft Entra ID and Intune for mobile device management. They want to grant access to a confidential project management site only from devices that are encrypted and have the latest anti-malware updates. Which Conditional Access assignment should they configure to enforce this requirement?

Accepted Answer

Device state. Option B (Device state) is correct because Conditional Access policies can use the 'Device state' condition to require that devices are marked as compliant or are hybrid Azure AD joined. Compliance is determined by Intune compliance policies, which can enforce requirements like encryption and up-to-date anti-malware. By setting the 'Device state' condition to 'Compliant device' or 'Hybrid Azure AD joined device', access to the confidential site is granted only to devices meeting those security baselines.

Answer

Sign-in risk

Answer

User risk

Answer

Application

Question 5

A company uses Microsoft Entra ID. The security manager wants to provide temporary, time-bound elevated access to the Global Administrator role only when needed, and require approval from a designated approver. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate the Global Administrator role for a limited, time-bound duration only when needed, and it enforces approval workflows from designated approvers. This directly matches the security manager's requirement for temporary, approval-based elevation.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Identity Governance (Access Reviews)

Question 6

A company needs to allow external business partners to securely access internal SharePoint Online sites and Teams channels. The partners use various identity providers, including Microsoft Entra ID and Google. The company wants to manage these external users in their directory and assign access policies. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra External ID (B2B Collaboration). Microsoft Entra External ID (B2B Collaboration) is the correct capability because it allows the company to invite external business partners (B2B users) from any identity provider, including Microsoft Entra ID and Google, into their own Microsoft Entra directory. This enables the company to manage these external users in their directory, assign conditional access policies, and grant them secure access to internal SharePoint Online sites and Teams channels without requiring a separate application or customer-facing identity system.

Answer

Microsoft Entra B2C (Business to Customer)

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Identity Protection

Question 7

A multinational organization uses Microsoft Entra ID for identity management. External contractors need temporary elevated access to Azure resources for a critical project. The access must be time-bound (expires after 8 hours), require manager approval, and enforce multifactor authentication (MFA) when contractors activate the role. Which Microsoft Entra capability should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation (e.g., 8-hour expiry), requires approval workflows (manager approval), and enforces multifactor authentication (MFA) during role activation. PIM is specifically designed to manage, control, and monitor access to critical resources through time-limited, approved, and MFA-protected role assignments.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 8

A company uses Microsoft Entra ID and wants to automatically detect and remediate over-privileged roles in their Azure subscriptions and AWS accounts. They need to get a unified view of permissions across multiple clouds. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions across multi-cloud environments, including Azure and AWS. It automatically detects over-privileged roles and can remediate them by enforcing least-privilege access policies, making it the correct choice for the described requirement.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Verified ID

Answer

Microsoft Entra ID Governance

Question 9

A company wants to securely grant external business partners access to internal SharePoint sites and Teams channels. The partners use various identity providers, including Google and Microsoft personal accounts. The company needs to manage these external identities in their Microsoft Entra ID directory and enforce access policies. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is designed to securely share applications and resources with external guest users from any identity provider, including Google and Microsoft personal accounts. It allows the company to manage these external identities in their Entra ID directory and enforce conditional access policies, meeting the requirement to grant partners access to SharePoint and Teams.

Answer

Microsoft Entra B2C (Business-to-Consumer)

Answer

Microsoft Entra Connect

Answer

Microsoft Entra Identity Protection

Question 10

A company wants to prevent users from using common passwords like 'Password123' and custom banned passwords such as 'Contoso2024' during sign-up or password change. They also need to apply a common list of banned passwords across tenant-wide. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection allows administrators to enforce both a global banned password list (Microsoft-managed) and a custom banned password list (tenant-specific). This feature blocks weak passwords like 'Password123' and custom entries like 'Contoso2024' during sign-up or password change operations, making it the correct choice for tenant-wide password policy enforcement.

Answer

Conditional Access

Answer

Identity Protection

Answer

Multifactor Authentication (MFA)

Question 11

A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?

Accepted Answer

Use app control with Microsoft Defender for Cloud Apps session policy. Option C is correct because Microsoft Defender for Cloud Apps (MDCA) session policies enable granular control over user actions within a SaaS app, such as blocking downloads while allowing read-only access. This is achieved through reverse proxy architecture that intercepts and enforces policies on HTTP/HTTPS traffic in real time, regardless of device compliance or identity provider status. Conditional Access with MDCA session control is the only option that provides app-level data protection without requiring device management or blocking access entirely.

Answer

Require multifactor authentication (MFA)

Answer

Require compliant device (Intune compliance policy)

Answer

Block access

Question 12

A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?

Accepted Answer

Grant - Require MFA and Require terms of use. The Grant control in Conditional Access allows you to require multiple conditions to be satisfied before granting access. By selecting both 'Require MFA' and 'Require terms of use' under Grant, the policy enforces that the user must complete both MFA and accept the terms of use when accessing the HR portal from an unmanaged device. This directly meets the requirement for both authentication and consent.

Answer

Session control - Use app enforced restrictions

Answer

Grant - Require approved client app

Answer

Session control - Sign-in frequency

Question 13

A multinational organization uses Microsoft Entra ID and wants to allow employees to sign in to a custom customer-facing application using their existing social identities (e.g., LinkedIn, Google). They also need to enforce a specific terms of use agreement and be able to revoke a user's access if their social account is compromised. Which Microsoft Entra capability should they configure?

Accepted Answer

Microsoft Entra External ID (B2C). Microsoft Entra External ID (B2C) is the correct choice because it is specifically designed for customer-facing applications that need to support social identity providers (like LinkedIn and Google) via OAuth 2.0 and OpenID Connect. It allows you to enforce a custom terms of use agreement during sign-up and provides the ability to revoke a user's access by disabling their account in the B2C directory or removing the social identity mapping, which directly addresses the requirement to respond to a compromised social account.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 14

A company uses Microsoft Entra ID. Employees often forget their passwords and contact the IT helpdesk to reset them. The company wants to reduce helpdesk costs by allowing users to reset their own passwords using a verified mobile phone number or email address. Which Microsoft Entra ID feature should the administrator enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without helpdesk intervention, using a verified mobile phone number or email address as authentication methods. This directly reduces helpdesk costs by shifting password reset responsibility to the user, while maintaining security through verification of registered contact methods.

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 15

A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Microsoft Entra Verified ID