SC-900 Describe the capabilities of Microsoft Entra Practice Test 8 — 15 Questions

Question 1

A company uses Microsoft Entra ID. The security team wants to automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel between geographically distant locations within an unrealistic time frame. They need a solution that can automatically trigger actions like forcing a password reset or blocking sign-in for users identified as high risk. Which Microsoft Entra ID capability should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Governance

Question 2

A company uses Microsoft Entra ID. The compliance team requires that membership in highly privileged roles, such as Global Administrator, is reviewed quarterly. The review must be automated: role owners are sent an email notification with a list of current members to approve or deny. If a member does not respond within 30 days, their access should be automatically revoked. Which Microsoft Entra ID feature should the team use to set up this periodic review and automatic removal?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID is the correct feature because it is specifically designed for periodic, automated attestation of group or role memberships. It sends email notifications to designated reviewers, tracks responses, and can automatically remove users who do not respond within a defined period (e.g., 30 days). This directly meets the compliance requirement for quarterly reviews of Global Administrator membership with automatic revocation.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Answer

Identity Protection

Question 3

A company has several custom-developed web applications hosted on-premises. The company wants to provide employees with secure remote access to these applications without deploying a traditional VPN. Employees should be able to sign in using their existing Microsoft Entra ID credentials, and the solution should pass through multi-factor authentication policies. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It allows employees to sign in with their existing Microsoft Entra ID credentials and enforces conditional access policies, including multi-factor authentication, without requiring a traditional VPN.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 4

A company wants to reduce help desk calls by allowing users to reset their own passwords. The security team requires that users verify their identity using a registered mobile phone or alternative email before resetting. Additionally, the company policy states that passwords cannot be reused until at least five new passwords have been used. Which Microsoft Entra ID features should they configure to meet these requirements?

Accepted Answer

Self-Service Password Reset (SSPR) and password protection policies (password history enforcement). Self-Service Password Reset (SSPR) allows users to reset their own passwords, reducing help desk calls. The security requirement for identity verification via registered mobile phone or alternative email is met by SSPR's authentication methods. The password history enforcement (preventing reuse until at least five new passwords have been used) is configured through password protection policies, specifically the 'password history' setting that enforces a minimum of 5 unique passwords before reuse.

Answer

Self-Service Password Reset (SSPR) and Conditional Access policies

Answer

Multi-Factor Authentication (MFA) and password protection policies

Answer

Identity Protection and Authentication Strengths

Question 5

A company uses Microsoft Entra ID and Intune for mobile device management. They want to enforce different access requirements for their finance application: when users access from an unmanaged personal device, they must perform multi-factor authentication (MFA). When they access from a corporate-managed device that is marked as compliant (e.g., joined to Azure AD, antivirus up-to-date, encryption enabled), MFA should not be required. Device compliance is reported by Intune. Which Microsoft Entra ID feature should they use to define these rules?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID allow administrators to define granular access rules based on signals such as user, device, location, and application. In this scenario, the policy can be configured to require MFA when the device is not marked as compliant (e.g., unmanaged personal device) and to allow access without MFA when the device is reported as compliant by Intune. This is the correct feature because it directly evaluates device compliance status from Intune and enforces the specified access requirements.

Answer

Identity Protection risk policies

Answer

Privileged Identity Management (PIM)

Answer

Intune device compliance policies

Question 6

A company uses Microsoft Entra ID. They want to configure a Conditional Access policy that requires multi-factor authentication (MFA) when a sign-in is assessed as medium or high risk by Microsoft's identity protection signals. For sign-ins with no detected risk, MFA should not be required. Which feature or service provides the risk assessment signals that can be consumed by Conditional Access policies?

Accepted Answer

Identity Protection. Identity Protection is the Microsoft Entra service that analyzes billions of sign-in signals using machine learning to assign a risk level (low, medium, high) for each authentication attempt. Conditional Access policies can then consume these risk assessments directly as a condition, enabling granular MFA enforcement only when the sign-in risk is medium or high, while allowing low-risk sign-ins to proceed without MFA.

Answer

Privileged Identity Management (PIM)

Answer

Entitlement Management

Answer

Identity Governance

Question 7

A company's security team discovers that most recent account compromises resulted from attackers exploiting legacy authentication protocols (POP3, IMAP, SMTP Auth) that do not support multi-factor authentication. The team wants to immediately block all sign-in attempts using these legacy protocols while still allowing modern authentication methods (e.g., OAuth 2.0). Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID can be configured to block authentication attempts from legacy protocols (POP3, IMAP, SMTP Auth) by targeting client apps that do not support modern authentication. This allows the security team to immediately enforce a block on all sign-ins using these protocols while still permitting modern OAuth 2.0-based methods, directly addressing the requirement without disabling MFA for users who can use modern clients.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Multi-factor Authentication

Question 8

A company wants to improve password security across its Microsoft Entra ID tenant. The security team wants to prevent users from setting passwords that appear on Microsoft's global banned password list, which includes commonly compromised passwords. Additionally, they need to add a custom banned password containing the company name so that users cannot use variations of it. Which Microsoft Entra ID feature should they configure to enforce these password policies?

Accepted Answer

Password Protection. Password Protection in Microsoft Entra ID is the feature specifically designed to enforce both global and custom banned password lists. It prevents users from using commonly compromised passwords from Microsoft's global list and allows administrators to add custom terms, such as the company name, to block variations. This directly addresses the requirement to improve password security by blocking weak and organization-specific passwords.

Answer

Conditional Access

Answer

Identity Protection

Answer

Multi-factor authentication (MFA)

Question 9

A company uses Microsoft Entra ID and wants to provide external business partners with access to a specific internal application. The partners already use Microsoft Entra ID in their own organization. The company wants the partners to use their existing corporate credentials to sign in, without creating new user accounts in the company's tenant. The company also wants to manage the access lifecycle, including automatically removing access after a project ends. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows external users from partner organizations who already have their own Microsoft Entra ID accounts to sign in using their existing corporate credentials, without requiring new user accounts in the company's tenant. It also supports access lifecycle management through features like entitlement management and access reviews, enabling automatic removal of access when a project ends.

Answer

Microsoft Entra B2C

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 10

A university wants to provide its students with a verifiable digital transcript that the students can share with potential employers. The university uses Microsoft Entra Verified ID to issue credentials. When an employer wants to verify a student's transcript, they scan a QR code or receive a link. Which Microsoft Entra ID feature allows the university to issue these tamper-proof credentials and allows employers to verify them without contacting the university directly?

Accepted Answer

Microsoft Entra Verified ID. Microsoft Entra Verified ID (option C) is the correct answer because it is the decentralized identity solution built on open standards (W3C Decentralized Identifiers and Verifiable Credentials) that allows the university to issue tamper-proof digital credentials. Employers can verify these credentials independently by scanning a QR code or following a link, without needing to contact the university, because the verification is done cryptographically against the issuer's public DID on a distributed ledger.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 11

A company uses Microsoft Entra ID to manage identities. They want to enforce access policies based on user location, device compliance, and application sensitivity. Which Microsoft Entra ID capability should they use?

Accepted Answer

Conditional Access. Conditional Access is the correct capability because it allows administrators to create policies that enforce access controls based on conditions such as user location, device compliance, and application sensitivity. These policies evaluate signals at sign-in time and can require multi-factor authentication, block access, or grant limited access based on the defined conditions.

Answer

Microsoft Entra ID Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra Connect Sync

Question 12

A security administrator uses Microsoft Entra ID Protection to identify and respond to identity-based risks. Which two types of risk detections can be reviewed in Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Sign-in risk. Microsoft Entra ID Protection evaluates identity-based risks by analyzing two primary detection types: sign-in risk and user risk. Sign-in risk assesses the probability that a specific authentication attempt is unauthorized, while user risk evaluates the likelihood that a user account has been compromised based on aggregated suspicious activities.

Answer

Application permission risk

Answer

Device compliance risk

Question 13

A healthcare organization uses Microsoft Entra ID and needs to enforce that only users from the United States and Canada can access patient records. Access attempts from all other locations must be blocked. Which Microsoft Entra ID Conditional Access condition should be configured to meet this requirement?

Accepted Answer

Locations. The Locations condition in Microsoft Entra ID Conditional Access allows administrators to define named locations (e.g., countries or IP ranges) and then grant or block access based on those locations. By configuring a policy that blocks access from all countries except the United States and Canada, the organization can enforce geographic restrictions on patient record access.

Answer

Device state

Answer

Sign-in risk

Answer

Client apps

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to configure self-service password reset (SSPR) for all users. The security team requires that users must verify their identity with at least two methods before resetting a password. Which SSPR setting should be configured?

Accepted Answer

Number of methods required to reset: 2. Self-Service Password Reset (SSPR) in Microsoft Entra ID allows administrators to set the number of authentication methods required to reset a password. By setting 'Number of methods required to reset' to 2, users must provide two verification methods (e.g., email and phone) to confirm their identity.

Answer

Require re-registration on every authentication

Answer

Enable combined registration for SSPR and MFA

Answer

Set password expiration to 0 days

Question 15

An organization uses Microsoft Entra ID and wants to require users to re-authenticate every 4 hours when accessing a critical financial application, even if the user already has an active sign-in session. Which Conditional Access control should be configured?

Accepted Answer

Session control 'Sign-in frequency'. The 'Sign-in frequency' session control in Conditional Access allows administrators to specify the time interval after which a user must re-authenticate, even if they have an active session. By setting this to 4 hours, the organization ensures that users re-authenticate before accessing the critical financial application, overriding any existing session tokens.

Answer

Grant control 'Require multi-factor authentication'

Answer

Session control 'Persistent browser session'

Answer

Grant control 'Require device to be marked as compliant'