SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure AD Application Proxy

  Why this is correct

  Azure AD Application Proxy securely publishes on-premises web applications, making them accessible to remote users without requiring a VPN or inbound firewall rules. It leverages a lightweight connector installed within the corporate network, which establishes an outbound-only connection to the Azure AD Application Proxy service. This allows users to pre-authenticate with Entra ID, apply Conditional Access policies, and then access the internal application via a secure proxy URL, providing single sign-on capabilities.

• ✗

  Self-service password reset (SSPR)

  Why it's wrong here

  Self-service password reset (SSPR) is an Azure AD feature that empowers users to reset their own forgotten or locked passwords without requiring assistance from IT staff. While crucial for identity management and reducing help desk workload, SSPR specifically addresses user credential management. It does not provide any mechanism to publish or expose an on-premises application to external networks or users.

• ✗

  Azure AD B2B collaboration

  Why it's wrong here

  Azure AD B2B collaboration enables organizations to securely invite external users, such as partners or vendors, to access their applications and resources protected by Azure AD. It focuses on managing external identities and granting them access to specific cloud or on-premises applications that are already published. However, B2B collaboration itself does not publish an on-premises application; it assumes the application is already accessible and then manages external user access to it.

  When this WOULD be correct

  A company needs to grant external partners access to a cloud-based application while using their own identities for authentication. The question would specify that the users are from partner organizations, not the company's own employees.

• ✗

  Azure AD Domain Services

  Why it's wrong here

  Azure AD Domain Services provides managed domain controller functionality, including traditional services like LDAP, Kerberos, and NTLM, primarily for cloud-based virtual machines and applications that require domain-joined capabilities. Its purpose is to support legacy applications or IaaS workloads in Azure that need Active Directory authentication. This service does not facilitate the external publishing of an existing on-premises web application; instead, it offers domain infrastructure in the cloud.

  When this WOULD be correct

  A company needs to lift-and-shift legacy on-premises applications that require domain-joined servers and use Kerberos/NTLM authentication to Azure VMs, without managing domain controllers. They want to use Microsoft Entra ID for authentication but the apps require AD domain services.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question