CCNA Entra Capabilities Questions — Page 5 of 5

301

MCQmedium

A user reports that they cannot access the corporate portal after a password reset. The user can access other cloud apps. You verify that the user account is enabled and not locked. What should you check next?

A.Disable and re-enable the user account

B.Verify the user's registered authentication methods

C.Reinstall the corporate portal application

D.Check if the user is assigned a Microsoft Entra ID P2 license

AnswerB

A common reason for portal access issues, especially after a password reset or if the user has new devices, is an outdated or missing multi-factor authentication (MFA) registration. If conditional access policies require MFA for portal access, and the user's registered methods (e.g., Microsoft Authenticator, phone number) are incorrect or not configured, they will be blocked from signing in. Verifying and potentially resetting these methods in Microsoft Entra ID is a critical troubleshooting step to restore access.

Why this answer

The user can access other cloud apps, which rules out a global authentication or network issue. Since the account is enabled and not locked, the most likely cause is that the user's registered authentication methods (e.g., phone, authenticator app, or email) are missing, outdated, or not configured for the password reset flow. Microsoft Entra ID requires verified authentication methods to complete a password reset and subsequent sign-in, especially when the user is prompted for multifactor authentication or self-service password reset (SSPR) verification.

Exam trap

The trap here is that candidates often assume a password reset always works seamlessly, but the SC-900 exam tests the understanding that authentication methods must be registered and up-to-date for the reset to succeed, especially when the user is prompted for additional verification.

How to eliminate wrong answers

Option A is wrong because disabling and re-enabling the account would not resolve a missing or misconfigured authentication method; it only toggles the account status, which is already enabled. Option C is wrong because reinstalling the corporate portal application addresses client-side corruption, not an identity or authentication method issue that prevents access after a password reset. Option D is wrong because a Microsoft Entra ID P2 license is not required for basic password reset or authentication method registration; P2 adds advanced features like Identity Protection and Privileged Identity Management, but the core SSPR and MFA registration work with P1 or even free tier licenses.

Practice this question →

302

MCQmedium

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 90 days on trusted devices, but force MFA for every sign-in on untrusted devices. Which Conditional Access session control must they configure to meet this requirement?

A.Sign-in frequency

B.Application enforced restrictions

C.Use app enforced restrictions

D.Persistent browser session

AnswerA

Sign-in frequency is a session control that determines how often a user must provide authentication credentials again, such as after a set number of days or hours. It can be configured differently for trusted and untrusted devices.

Why this answer

Sign-in frequency is the Conditional Access session control that allows administrators to define the time interval after which a user must re-authenticate, even on a trusted device. By setting the sign-in frequency to 90 days for trusted devices and requiring re-authentication for every sign-in on untrusted devices (by setting the frequency to 0 or 1), the requirement is met. This control directly manages the re-prompt interval for MFA, independent of the session token lifetime.

Exam trap

The trap here is that candidates confuse 'Persistent browser session' (which controls session persistence across browser closes) with 'Sign-in frequency' (which controls the re-authentication interval), leading them to choose the wrong option for MFA frequency requirements.

How to eliminate wrong answers

Option B is wrong because 'Application enforced restrictions' is not a valid Conditional Access session control; it is a generic term that does not exist in the Microsoft Entra Conditional Access policy settings. Option C is wrong because 'Use app enforced restrictions' is also not a valid session control; it is a misnomer and does not correspond to any configurable setting in Conditional Access. Option D is wrong because 'Persistent browser session' controls whether the browser session cookie persists after the browser is closed, not the frequency of MFA prompts; it affects session lifetime but not the re-authentication interval for MFA.

Practice this question →

303

Drag & Dropmedium

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Identity Protection investigation involves accessing the portal, reviewing risks, selecting a user, analyzing events, and taking action.

Practice this question →

304

MCQmedium

A company wants to improve password security across its Microsoft Entra ID tenant. The security team wants to prevent users from setting passwords that appear on Microsoft's global banned password list, which includes commonly compromised passwords. Additionally, they need to add a custom banned password containing the company name so that users cannot use variations of it. Which Microsoft Entra ID feature should they configure to enforce these password policies?

A.Conditional Access

B.Identity Protection

C.Password Protection

D.Multi-factor authentication (MFA)

AnswerC

Microsoft Entra ID Password Protection directly addresses the goal of improving password security by enforcing policies that prevent users from creating weak, easily guessable, or commonly compromised passwords. It utilizes both a global banned password list, maintained by Microsoft, and allows administrators to configure a custom banned password list specific to their organization. This feature actively checks new or reset passwords against these lists, rejecting those that fail to meet the defined security standards and thereby reducing the risk of password-based attacks.

Why this answer

Password Protection in Microsoft Entra ID is the feature specifically designed to enforce both global and custom banned password lists. It prevents users from using commonly compromised passwords from Microsoft's global list and allows administrators to add custom terms, such as the company name, to block variations. This directly addresses the requirement to improve password security by blocking weak and organization-specific passwords.

Exam trap

The trap here is that candidates may confuse Identity Protection's 'leaked credentials' detection with the ability to block password creation, but Identity Protection only detects credentials that have already been compromised, not prevents users from setting weak passwords in the first place.

Why the other options are wrong

Conditional Access enforces access controls based on signals like user, location, or device state, but it does not manage password content policies such as banned password lists.

Identity Protection is designed to detect and respond to identity-based risks, such as leaked credentials or suspicious sign-ins, but it does not enforce password policies like banning specific passwords.

Multi-factor authentication (MFA) adds a second verification step during sign-in, but it does not enforce password content policies like banning specific passwords. The question specifically asks about preventing users from setting banned passwords, which is handled by Password Protection, not MFA.

Practice this question →

305

MCQhard

Refer to the exhibit. You run the cmdlet and get a list of risk detections. What does this cmdlet retrieve?

A.Users who have been flagged for risky sign-ins

B.All risk detections in the tenant

C.All sign-in logs with unfamiliar properties

D.Risk detections for the unfamiliar sign-in properties risk event type

AnswerD

This option is correct because the `Get-MSRiskDetection` cmdlet is used to retrieve risk detections from Azure AD Identity Protection. The `-Filter "riskEventType eq 'unfamiliarSignInProperties'"` parameter precisely targets and returns only those risk detection objects where the `riskEventType` property matches 'unfamiliarSignInProperties'. This accurately identifies sign-ins exhibiting characteristics outside a user's typical patterns, as indicated by the specified risk event type.

Why this answer

The cmdlet `Get-MgRiskDetection` retrieves all risk detections in the tenant, but when combined with the `-Filter` parameter for `riskEventType eq 'unfamiliarSigninProperties'`, it specifically returns only those risk detections that match the unfamiliar sign-in properties risk event type. This is because the cmdlet supports filtering by the `riskEventType` property, which corresponds to the type of risk detection as defined by Microsoft Entra ID Protection.

Exam trap

The trap here is that candidates confuse retrieving risk detections (which are events) with retrieving risky users or sign-in logs, and they overlook the `-Filter` parameter that narrows the scope to a specific risk event type, leading them to choose the overly broad 'All risk detections' option.

How to eliminate wrong answers

Option A is wrong because `Get-MgRiskDetection` retrieves risk detection objects, not user objects; users flagged for risky sign-ins are retrieved using `Get-MgRiskyUser` or `Get-MgRiskDetection` with a different filter. Option B is wrong because the cmdlet in the exhibit includes a `-Filter` parameter that limits the results to a specific risk event type, not all risk detections in the tenant. Option C is wrong because sign-in logs with unfamiliar properties are a subset of risk detections, but the cmdlet retrieves risk detection objects (which include metadata like risk level, risk state, and detection timing), not raw sign-in logs; sign-in logs are retrieved via `Get-MgAuditLogSignIn`.

Practice this question →

306

MCQmedium

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for users who sign in from sessions that Microsoft Entra ID Protection determines to have medium or high sign-in risk. Users signing in from low-risk sessions should not be prompted for MFA. Which feature should the security team configure?

A.Configure a Conditional Access policy with Sign-in risk as a condition and MFA as a grant control

B.Configure a user risk policy in Microsoft Entra ID Protection

C.Assign the Global Administrator role with Privileged Identity Management (PIM) activation requiring MFA

D.Create an access review in Microsoft Entra ID Governance

AnswerA

Configuring a Conditional Access policy with 'Sign-in risk' as a condition and 'Require multi-factor authentication' as a grant control is the correct solution. This policy leverages real-time risk detections from Microsoft Entra ID Protection, dynamically enforcing MFA only when a user's sign-in attempt is deemed risky. This approach provides adaptive security, ensuring that users are prompted for additional verification specifically when their access attempt presents a potential threat, aligning with a Zero Trust model.

Why this answer

A Conditional Access policy can use Sign-in risk (a condition from Microsoft Entra ID Protection) to require MFA as a grant control. This allows the security team to enforce MFA only for sessions with medium or high sign-in risk, while low-risk sessions are not prompted, exactly matching the requirement.

Exam trap

The trap here is confusing sign-in risk (session-level) with user risk (user-level), leading candidates to choose the user risk policy (Option B) instead of the Conditional Access policy with sign-in risk condition.

Why the other options are wrong

The question requires MFA based on sign-in risk (session risk), not user risk. A user risk policy in ID Protection addresses user-level risk (e.g., compromised account), not sign-in risk from a specific session.

This option addresses privileged role activation requiring MFA, not sign-in risk-based MFA for all users. The question specifically requires MFA based on sign-in risk level (medium/high), which is a Conditional Access policy condition, not a PIM activation setting.

Access reviews are used to verify and manage user access rights periodically, not to enforce MFA based on sign-in risk. The question specifically requires MFA enforcement for medium/high risk sessions, which is done via Conditional Access policies with sign-in risk condition.

Practice this question →

307

MCQmedium

A company uses Microsoft Entra ID. The security team wants to enforce a policy that prevents users from choosing commonly used weak passwords like 'Winter2024!' or 'Password@123', and also blocks customized variants based on organizational context (e.g., company name). Users must create passwords that meet standard complexity requirements. Which Microsoft Entra ID feature should they enable?

A.Password hash synchronization

B.Microsoft Entra ID Password Protection

C.Self-Service Password Reset

D.Conditional Access

AnswerB

Correct. Microsoft Entra ID Password Protection blocks weak passwords and their common variants, including custom banned lists. It is the appropriate feature for enforcing strong password choices beyond default complexity.

Why this answer

Microsoft Entra ID Password Protection (B) is the correct feature because it specifically enforces custom banned password lists that block weak passwords like 'Winter2024!' and organizational variants such as the company name. It works alongside standard password complexity requirements to prevent users from choosing passwords that appear on a global banned list or a tenant-specific custom list. This directly addresses the security team's need to block commonly used weak passwords and context-based variants.

Exam trap

The trap here is that candidates often confuse Self-Service Password Reset (SSPR) with password policy enforcement, but SSPR only facilitates password changes and does not block weak passwords; the actual blocking is done by Password Protection, which is a separate feature.

Why the other options are wrong

Password hash synchronization is a feature for syncing password hashes from on-premises AD to Entra ID for authentication, not for enforcing password policies like blocking weak or context-specific passwords.

Self-Service Password Reset (SSPR) allows users to reset their own passwords but does not enforce password policies that block weak or context-specific passwords. The question asks for a feature to prevent weak passwords, which is handled by Password Protection, not SSPR.

Conditional Access is used to enforce access controls based on signals like user location or device state, not to enforce password complexity or block weak passwords.

Practice this question →

308

MCQmedium

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

A.Entra External ID

B.Identity Protection

C.Conditional Access

D.Privileged Identity Management

AnswerA

Microsoft Entra External ID is the comprehensive solution designed for managing all external identities, including partners, customers, and other collaborators. It facilitates secure business-to-business (B2B) collaboration by allowing organizations to invite guest users from other Microsoft Entra tenants, social identity providers, or via email one-time passcodes. This enables external users to access internal applications and resources while maintaining their original identity provider.

Why this answer

Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Exam trap

The trap here is that candidates often confuse Conditional Access (a policy engine) with the ability to invite external identities, mistakenly thinking policies alone can grant external access without a federation mechanism.

How to eliminate wrong answers

Option B is wrong because Identity Protection is a risk-detection service that monitors sign-in anomalies and user risk, not a feature for inviting external users with their own credentials. Option C is wrong because Conditional Access enforces policy-based access controls (e.g., MFA, location) after authentication, but does not itself enable external identity federation. Option D is wrong because Privileged Identity Management manages just-in-time privileged role activation and access reviews for internal users, not external partner authentication.

Practice this question →

309

MCQmedium

A company uses Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) only when users sign in from devices that are not compliant with company security policies. They also want to block sign-ins from unknown geographic locations. Which Microsoft Entra feature should they configure?

A.Identity Protection

B.Privileged Identity Management (PIM)

C.Conditional Access

D.Self-Service Password Reset (SSPR)

AnswerC

Microsoft Entra Conditional Access is a policy engine that evaluates various signals, including user identity, device state, sign-in location, and application, to make real-time access decisions. It directly enables the creation of granular policies to enforce requirements like multi-factor authentication (MFA) or compliant devices, or to block access entirely, based on specific conditions such as device compliance or trusted network locations, precisely meeting the stated requirements.

Why this answer

Conditional Access is the correct feature because it allows administrators to create policies that evaluate signals such as device compliance and geographic location before granting access. By configuring a policy that requires MFA for non-compliant devices and blocks sign-ins from unknown locations, the security team can enforce these specific conditions. This granular control is unique to Conditional Access, which integrates with Microsoft Entra ID to enforce access decisions based on real-time risk and context.

Exam trap

The trap here is that candidates often confuse Identity Protection's risk-based conditional access with the broader Conditional Access feature, not realizing that Identity Protection only provides risk signals and requires Conditional Access to enforce the actual MFA or block action.

How to eliminate wrong answers

Option A is wrong because Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, anonymous IP addresses) but does not natively enforce MFA based on device compliance or block sign-ins from unknown geographic locations; it can trigger Conditional Access policies but is not the feature to configure the rules themselves. Option B is wrong because Privileged Identity Management (PIM) is designed for just-in-time privileged role activation and access reviews, not for enforcing MFA or location-based blocking for regular user sign-ins. Option D is wrong because Self-Service Password Reset (SSPR) allows users to reset their own passwords and does not provide any mechanism to enforce MFA or block sign-ins based on device compliance or geographic location.

Practice this question →

310

Multi-Selectmedium

Which two capabilities are provided by Microsoft Entra ID? (Choose two.)

Select 2 answers

A.Mobile device management (MDM)

B.Conditional Access policies

C.Identity protection with risk-based conditional access

D.Data loss prevention (DLP) for sensitive information

E.Cloud access security broker (CASB)

AnswersB, C

Conditional Access policies are a core security feature within Microsoft Entra ID, allowing organizations to enforce specific access controls based on various signals. These policies evaluate conditions such as user identity, device state, location, and application to determine whether to grant access, block access, or require additional authentication methods like multi-factor authentication. This capability is fundamental for implementing Zero Trust principles in Entra ID by ensuring only authorized users on compliant devices can access resources.

Why this answer

Conditional Access policies (B) are a core capability of Microsoft Entra ID, enabling administrators to enforce access controls based on signals like user location, device state, and application sensitivity. Identity Protection with risk-based conditional access (C) leverages machine learning to detect sign-in and user risks, automatically applying policies to block or require multi-factor authentication. Both are native to Microsoft Entra ID and integral to its identity and access management (IAM) framework.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID's identity-focused capabilities (Conditional Access, Identity Protection) with adjacent security services like Intune (MDM), Microsoft Purview (DLP), and Defender for Cloud Apps (CASB), which are separate products in the Microsoft security stack.

Practice this question →

311

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing Facebook accounts without creating a separate Microsoft Entra ID account. What should you configure?

A.Configure Microsoft Entra ID Protection

B.Create a Microsoft Entra External ID tenant and add Facebook as an identity provider

C.Enable Microsoft Entra ID Domain Services

D.Configure Microsoft Entra ID Governance

AnswerB

Microsoft Entra External ID (formerly Azure AD B2C) is a customer identity and access management (CIAM) solution specifically designed for managing consumer identities for customer-facing applications. By creating an External ID tenant, organizations can integrate various social identity providers, including Facebook, Google, and Microsoft accounts, allowing users to sign up and sign in using their existing social credentials. This capability directly addresses the requirement for enabling social login functionality for external users.

Why this answer

Microsoft Entra External ID (formerly Azure AD B2C) is designed to allow external identities, such as social identity providers like Facebook, to authenticate users without requiring a separate Microsoft Entra ID account. By creating an External ID tenant and adding Facebook as an identity provider, you enable users to sign in using their existing Facebook credentials via OAuth 2.0 or OpenID Connect protocols.

Exam trap

The trap here is that candidates often confuse Microsoft Entra External ID (B2C) with Microsoft Entra ID (Azure AD) itself, assuming social identity providers can be added directly to a standard tenant, but only an External ID tenant supports social identity federation without requiring a separate Microsoft Entra ID account.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Protection is a security feature that detects and responds to identity risks (e.g., leaked credentials, sign-ins from anonymous IPs), not a mechanism for adding external identity providers like Facebook. Option C is wrong because Microsoft Entra ID Domain Services provides managed domain services (e.g., LDAP, Kerberos, NTLM) for legacy on-premises applications, not social identity federation. Option D is wrong because Microsoft Entra ID Governance focuses on managing identity lifecycle, access reviews, and entitlement management, not on configuring external authentication sources.

Practice this question →

312

MCQmedium

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-bound administrative access to the Microsoft 365 user management role for IT support staff. The access should require an approval from a senior administrator, and all actions should be audited. Which Microsoft Entra ID feature should they configure?

A.Conditional Access

B.Identity Protection

C.Privileged Identity Management (PIM)

D.Identity Governance

AnswerC

Microsoft Entra Privileged Identity Management (PIM) is the specific service designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) privileged access, allowing users to activate roles for a limited duration, often requiring multi-factor authentication and an approval workflow. This capability directly addresses the need for time-bound privilege elevation with comprehensive auditing and accountability, significantly reducing the attack surface.

Why this answer

Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access with time-bound role activation, approval workflows, and full auditing. This directly matches the requirement for temporary, approved administrative access to the Microsoft 365 user management role with audit trails.

Exam trap

The trap here is confusing Identity Governance (which handles access reviews and entitlement management for regular users) with Privileged Identity Management (which specifically handles just-in-time privileged role activation and approval).

Why the other options are wrong

Conditional Access controls access based on conditions like location or device state, but it does not provide time-bound, approval-based role activation or auditing for administrative roles.

Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage temporary, time-bound administrative access with approval workflows.

Identity Governance focuses on managing user identity lifecycles, access certifications, and entitlement management, but does not provide time-bound, approval-based privileged role activation with auditing. PIM is required for just-in-time administrative access.

Practice this question →

313

MCQeasy

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

A.Block legacy authentication protocols

B.Require MFA for all applications

C.Disable the policy for emergency access

D.Allow only iOS devices

AnswerA

The policy's "Client apps" condition is configured to target "Other clients," which is the category encompassing applications that utilize legacy authentication protocols such as POP, IMAP, SMTP, and older versions of Office clients that do not support modern authentication. By combining this specific client app condition with a "Block access" grant control, the policy effectively prevents users from authenticating via these less secure, legacy protocols. This significantly enhances security by forcing the use of modern authentication methods.

Why this answer

The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Exam trap

The trap here is that candidates often confuse 'blocking legacy authentication' with 'requiring MFA' — the policy blocks the protocol entirely rather than prompting for an additional factor, which is a distinct control in Conditional Access.

How to eliminate wrong answers

Option B is wrong because the policy does not require MFA; it explicitly blocks authentication entirely, not just requiring an additional factor. Option C is wrong because the policy does not include any exclusion for emergency access accounts (e.g., break-glass accounts) — it applies to all users unless a separate exclusion is configured. Option D is wrong because the policy does not filter by device platform (iOS) — it targets authentication protocol, not device type.

Practice this question →

314

MCQmedium

Your company is implementing a hybrid identity solution with Microsoft Entra ID. Users report that they can sign in to Microsoft 365 but cannot access on-premises applications that are configured for integrated Windows authentication. You need to ensure seamless single sign-on (SSO) for both cloud and on-premises resources. What should you implement?

A.Implement Passthrough Authentication.

B.Deploy Active Directory Federation Services (AD FS).

C.Enable Microsoft Entra seamless SSO.

D.Configure password hash synchronization.

AnswerC

Enabling Microsoft Entra seamless SSO is the correct solution as it provides automatic sign-in for users on corporate domain-joined devices connected to the corporate network. It achieves this by leveraging Kerberos, allowing users to silently authenticate to both cloud-based Microsoft Entra ID applications and on-premises applications configured for Integrated Windows Authentication (IWA) without re-entering their credentials. This mechanism ensures a true single sign-on experience across the hybrid environment.

Why this answer

Microsoft Entra seamless SSO (Seamless SSO) is the correct choice because it automatically signs users in when they are on corporate devices connected to the corporate network, using Kerberos delegation to provide single sign-on for both cloud resources (like Microsoft 365) and on-premises applications configured for Integrated Windows Authentication (IWA). This eliminates the need for users to re-enter credentials when accessing on-premises apps after authenticating to the cloud.

Exam trap

The trap here is that candidates often confuse Passthrough Authentication or password hash synchronization with providing SSO for on-premises applications, but neither includes the Kerberos delegation required for Integrated Windows Authentication, which is the specific need in this scenario.

How to eliminate wrong answers

Option A is wrong because Passthrough Authentication validates passwords against on-premises Active Directory but does not provide the Kerberos-based SSO needed for Integrated Windows Authentication to on-premises applications; it only handles cloud authentication. Option B is wrong because Active Directory Federation Services (AD FS) is a more complex, on-premises federation solution that can provide SSO, but it is overkill for this scenario and not the simplest or recommended approach when Seamless SSO can achieve the same goal with less infrastructure. Option D is wrong because password hash synchronization only synchronizes password hashes to the cloud for cloud authentication and does not enable Kerberos-based SSO for on-premises IWA applications.

Practice this question →