SC-900 Capabilities of Microsoft Entra practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

SC-900 Describe the capabilities of Microsoft Entra: 297 practice questions

SC-900 297 questions 12 shown free

12 of the 297 Describe the capabilities of Microsoft Entra questions in the Certsqill SC-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for SC-900? Take the free 5-min readiness check →

1. Password plus a security key: Which option meets the requirement?

Hard
Authentication evidence for a manufacturer shows that users currently enter a password and a PIN. The security team requires two distinct factor categories and wants the capability to support a stronger sign-in method. Which option meets the requirement?
  1. Compliant device plus a password
    Device compliance is a contextual signal, not necessarily a human authentication factor category by itself.
  2. PIN plus a security question
    A PIN and security question are both knowledge factors, despite using different secret values.
  3. Password plus another password
    Two passwords are both knowledge factors, so they do not provide two distinct authentication factor categories.
  4. Password plus a security key ✓
    A password supplies knowledge and a security key supplies possession, creating distinct factor categories.
The trap
Mistakes device state for an authentication factor. Counts two knowledge secrets as independent factors. Treats different knowledge secrets as different categories.

MFA requires distinct factor categories; a password and security key combine knowledge with possession.

2. Access reviews: Which Microsoft Entra capability provides this periodic attestation?

Easy
A media company needs quarterly confirmation that existing group members still require access. Which Microsoft Entra capability provides this periodic attestation?
  1. Conditional Access
    Conditional Access evaluates access conditions and applies controls, but it does not ask reviewers to attest membership.
  2. Access reviews ✓
    Access reviews periodically ask designated reviewers to confirm whether existing memberships or access remain necessary.
  3. Privileged Identity Management
    PIM manages eligible and time-bound privileged role activation, not periodic attestation of ordinary group membership.
  4. Identity Protection
    Identity Protection detects risky users and sign-ins; it does not conduct membership attestation.
The trap
Confuses privileged activation with recurring access confirmation. Confuses sign-in policy enforcement with periodic governance. Confuses risk detection with access governance review.

Access reviews obtain recurring reviewer confirmation that existing access remains appropriate.

3. Entra ID provides cloud identity and access management: Which statement corrects this misconception?

Easy
A software company plans to replace all on-premises domain controllers with Microsoft Entra ID and expects identical domain protocols and behavior. Which statement corrects this misconception?
  1. Replace AD DS-dependent workloads with Entra ID without evaluating their protocol and domain requirements.
    Workloads that depend on AD DS behavior may require AD DS or another appropriate architecture; replacing it without assessing requirements does not correct the misconception.
  2. Use Entra ID alone for cloud identities and every AD DS-dependent workload.
    Entra ID can provide cloud identity and access management, but it is not a replacement for every AD DS domain function or protocol.
  3. Use Azure Firewall for the domain functions.
    Azure Firewall provides network security capabilities; it does not provide directory identity or traditional domain-controller functions.
  4. Entra ID provides cloud identity and access management, not hosted AD DS domain controllers. ✓
    Microsoft Entra ID manages cloud identities and access, whereas Windows Server Active Directory Domain Services supplies traditional domains, domain controllers, and related protocols.
The trap
Confuses network traffic filtering with directory services. Assumes one identity service supplies both cloud IAM and traditional domain-controller behavior. Presumes cloud identity equivalence instead of examining workload dependencies.

Microsoft Entra ID is cloud identity management, not hosted Active Directory Domain Services.

4. Conditional Access: Which capability should evaluate those signals and enforce the policy?

Hard
An engineering team must require stronger controls when a user signs in from an unfamiliar location or with elevated risk. The team already has authentication methods and role assignments. Which capability should evaluate those signals and enforce the policy?
  1. Conditional Access ✓
    Conditional Access evaluates location and risk signals, then enforces configured grant or session controls.
  2. Authentication methods
    Authentication methods provide sign-in techniques, but they do not independently evaluate location or risk policy.
  3. Azure resource RBAC
    Azure RBAC authorizes operations on Azure resources, rather than enforcing user sign-in risk conditions.
  4. Entra directory roles
    Directory roles authorize Entra administrative operations, not contextual user sign-in conditions.
The trap
Confuses administrative permissions with conditional access. Confuses resource authorization with sign-in policy. Confuses available sign-in methods with policy evaluation.

Conditional Access evaluates contextual signals and applies configured controls without granting permissions itself.

5. Configure policy to require two distinct factor categories: Select TWO appropriate next conceptual actions.

Medium
A city department currently asks users for a password and PIN, but policy requires two distinct authentication factor categories. Registration for an additional method is available. Select TWO appropriate next conceptual actions.

Select two. More than one option is correct — every correct one is ticked below.

  1. Configure policy to require two distinct factor categories. ✓
    The access policy must require distinct categories; merely registering another method does not enforce multifactor use.
  2. Grant broader directory roles after users complete two prompts.
    Authentication strength does not grant administrative permissions; role assignment remains a separate authorization decision.
  3. Treat device compliance as the second human factor.
    Device compliance is a contextual signal and does not automatically constitute a human authentication factor.
  4. Register a second password for every user.
    Another password remains a knowledge factor and does not satisfy the distinct-category requirement.
  5. Register a possession or inherence method for eligible users. ✓
    Adding possession or inherence creates a factor category distinct from the existing knowledge methods.
The trap
Confuses stronger authentication with authorization. Adds another secret without adding an independent factor category. Confuses device posture with user authentication evidence.

The department needs a distinct factor method and policy enforcement requiring distinct categories.

6. Entitlement management access packages: Which Microsoft Entra capability meets this requirement?

Hard
A manufacturer wants new employees to request a predefined bundle of applications and groups, with approval and automatic expiration. Which Microsoft Entra capability meets this requirement?
  1. Lifecycle workflows
    Lifecycle workflows automate configured joiner, mover, and leaver tasks; they do not define requestable resource bundles with approval and expiration policies.
  2. Entitlement management access packages ✓
    Access packages bundle resources and support governed requests, approvals, and expiration policies for access.
  3. Access reviews for periodic attestation of existing memberships
    Access reviews ask reviewers whether existing access remains appropriate; they do not package resources for a new employee request.
  4. Privileged Identity Management
    Privileged Identity Management governs eligible and time-bound privileged role activation, not ordinary application and group bundles.
The trap
Confuses lifecycle task automation with entitlement packaging. Confuses privileged-role governance with general access requests. Confuses periodic validation with request and provisioning of bundled entitlements.

Entitlement management access packages bundle resources with request, approval, and expiration policies.

7. Entra ID is cloud identity and access management: Which statement correctly describes a limitation compared wi

Easy
A media company uses Microsoft Entra ID for cloud sign-in and access management. Which statement correctly describes a limitation compared with traditional Active Directory Domain Services?
  1. Entra ID supports external collaboration with appropriate access boundaries.
    External collaboration is a supported capability, not the limitation distinguishing Entra ID from AD DS.
  2. Entra ID is cloud identity and access management, not hosted domain controllers. ✓
    Entra ID manages cloud identities and access, but it is not simply hosted AD DS domain controllers providing traditional domain services.
  3. Entra ID manages cloud identities and applications.
    This is a capability of Entra ID, not a limitation compared with AD DS domain controllers.
  4. Entra ID can connect cloud and on-premises identities through configured hybrid methods.
    Hybrid identity can connect environments through configured synchronization or authentication choices; this does not describe the limitation asked about.
The trap
States a capability without identifying the service distinction. Confuses integration with equivalence or domain-controller hosting. Offers a true capability that does not answer the question about domain-controller behavior.

Entra ID provides cloud identity management; it is not hosted AD DS domain controllers.

8. Conditional Access: Which capability best fits?

Medium
A software company wants sign-ins to a finance application blocked from unmanaged devices, while allowing compliant devices from approved locations. The organization also needs different controls based on sign-in context. Which capability best fits?
  1. Conditional Access ✓
    Conditional Access evaluates device and location signals, then applies configured grant or session controls to sign-ins.
  2. Azure RBAC
    Azure RBAC authorizes Azure resource operations, but it does not evaluate device compliance and location during sign-in.
  3. Authentication methods
    Authentication methods provide ways to verify users, but they do not combine device and location policies.
  4. Network security groups
    Network security groups filter network traffic, but they do not evaluate user sign-in context or device compliance.
The trap
Methods authenticate users, not contextual access policy. RBAC grants resource permissions, not sign-in conditions. NSGs filter traffic rather than identity conditions.

Conditional Access evaluates contextual signals and applies sign-in controls, including device compliance and location requirements.

9. A FIDO2 security key or passkey: Select TWO.

Hard
A retailer is selecting authentication methods for staff. The requirement is to use methods involving possession of a registered device or physical security key, while avoiding password-only sign-in. Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. A FIDO2 security key or passkey ✓
    A security key or passkey uses possession of a registered authenticator and can support passwordless authentication.
  2. A personal identification number alone
    A PIN alone is knowledge evidence and does not demonstrate possession of the requested authenticator.
  3. A password alone
    A password supplies a knowledge factor, not possession of a registered device or physical security key.
  4. Microsoft Authenticator approval ✓
    Authenticator can provide a possession factor through a registered device, when combined appropriately with authentication requirements.
  5. Two different passwords
    Two passwords remain the same knowledge factor and do not create independent possession evidence.
The trap
Passwords represent knowledge, not possession. A PIN alone is knowledge evidence. Repeated knowledge factors are not independent factors.

Authenticator and security keys or passkeys provide possession-based authentication options beyond password-only sign-in.

10. An access review with reviewer attestation: Which capability and evidence best support this decision?

Easy
A city department moved an analyst to a new team. Managers need to determine whether the analyst still requires several existing group memberships. Which capability and evidence best support this decision?
  1. An access review with reviewer attestation ✓
    Access reviews ask designated reviewers to attest whether existing memberships or access remain necessary.
  2. Privileged Identity Management activation
    PIM governs privileged role activation and timing, not ordinary group-membership reassessment after a move.
  3. Conditional Access sign-in controls
    Conditional Access controls access conditions during sign-in, but does not collect business-owner attestations.
  4. Identity Protection risk detection
    Identity Protection detects risky users or sign-ins, not whether existing group memberships remain appropriate.
The trap
Risk signals do not reassess business access need. PIM addresses privilege activation, not membership review. Sign-in policy does not gather access attestations.

Access reviews provide reviewer attestation about whether existing memberships remain appropriate after a role change.

11. A guest identity represents an external user: Which statement corrects the designer’s claim that the supplier

Medium
A manufacturer will let a supplier access selected Microsoft 365 resources. The design must identify the supplier and limit access to assigned resources. Which statement corrects the designer’s claim that the supplier needs an anonymous identity?
  1. A guest must use an anonymous session because external users cannot be represented in the directory.
    External collaborators can be represented as guest identities in the directory; anonymity is not required.
  2. A guest identity can be assigned only unrestricted collaboration access.
    Guest access can be limited through configured permissions and collaboration controls.
  3. A guest identity grants directory administration by default.
    Guest status identifies an external collaborator but does not grant administrative privileges.
  4. A guest identity represents an external user with configured collaboration boundaries. ✓
    Entra guest identities support identifiable external collaboration while access is controlled through assigned permissions and policies.
The trap
Confuses external identity with administrative authorization. Treats guest access as inherently unrestricted. Mistakes external collaboration for anonymous access.

Guest identities represent external collaborators and remain subject to configured access boundaries.

12. Conditional Access: Which capability is closest?

Hard
A media company wants a cloud application to require stronger authentication when users sign in from outside trusted office locations. Administrators must evaluate location as a sign-in signal rather than merely restrict network packets. Which capability is closest?
  1. Conditional Access ✓
    Conditional Access can evaluate location signals and require configured authentication or access controls.
  2. Authentication methods
    Authentication methods define how users verify identity, but they do not evaluate trusted sign-in locations.
  3. Network security groups
    Network security groups filter network traffic, but they do not impose identity-based authentication requirements by location.
  4. Azure resource RBAC
    Azure RBAC controls Azure resource operations and does not apply location-based sign-in requirements.
The trap
NSGs filter packets, not user authentication. RBAC authorizes resources, not sign-in context. Methods verify identity without location policy.

Conditional Access evaluates location during sign-in and can require stronger controls for selected locations.

285 more Describe the capabilities of Microsoft Entra questions

The remaining 285 questions in this domain are part of the full SC-900 bank — 1080 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your SC-900 readiness — free

Other SC-900 domains

Part of the Certsqill SC-900 question bank · Describe the capabilities of Microsoft Entra · Every answer, right and wrong, comes with its own explanation.