SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management 4 — Questions and Answers
Question 1: What is the role of an 'Authentication Strength' policy in Microsoft Entra Conditional Access?
- It sets minimum password length requirements for all users
- It specifies which combinations of authentication methods are required for specific scenarios (Correct answer)
- It blocks all legacy authentication protocols tenant-wide
- It enforces SSPR registration for newly created accounts
Correct answer: It specifies which combinations of authentication methods are required for specific scenarios
Authentication Strength policies let administrators require specific combinations of authentication methods (e.g., phishing-resistant MFA) through Conditional Access.
Question 2: Which Microsoft Entra ID feature allows users to join their personal devices to the directory without full device management enrollment?
- Microsoft Entra Hybrid Join
- Microsoft Entra Device Registration (Workplace Join) (Correct answer)
- Microsoft Entra Domain Services
- Autopilot enrollment
Correct answer: Microsoft Entra Device Registration (Workplace Join)
Microsoft Entra Device Registration (Workplace Join) lets users register personal devices to get SSO to organizational resources without full MDM enrollment.
Question 3: What does 'Hybrid Azure AD Join' (Microsoft Entra Hybrid Join) accomplish?
- It syncs cloud-only users to on-premises Active Directory
- It registers on-premises Active Directory-joined devices with Microsoft Entra ID (Correct answer)
- It federates the tenant with a third-party identity provider
- It enables passwordless sign-in for all devices
Correct answer: It registers on-premises Active Directory-joined devices with Microsoft Entra ID
Hybrid Entra Join allows domain-joined on-premises devices to also register with Microsoft Entra ID, enabling both on-premises and cloud SSO scenarios.
Question 4: In Conditional Access, what is the 'Sign-in Frequency' control used for?
- Limiting the number of sign-in attempts before an account is locked
- Controlling how often users must re-authenticate to a resource (Correct answer)
- Setting the maximum session length for all Azure portal sessions
- Requiring MFA registration within a specific number of days
Correct answer: Controlling how often users must re-authenticate to a resource
Sign-in Frequency Conditional Access controls how often a user must interactively re-authenticate, which helps limit session exposure for sensitive apps.
Question 5: What type of Microsoft Entra ID account is created when a guest user accepts a B2B collaboration invitation?
- A member account with full directory permissions
- A guest user account with limited directory access by default (Correct answer)
- A service principal with app-level permissions
- A managed identity tied to the guest's home tenant
Correct answer: A guest user account with limited directory access by default
B2B guest users are represented as guest-type accounts in the inviting tenant's directory, with limited default permissions compared to member accounts.
Question 6: Which Microsoft Entra ID license tier is required to use Conditional Access policies?
- Microsoft Entra ID Free
- Microsoft Entra ID P1 or P2 (Correct answer)
- Microsoft 365 Business Basic
- Microsoft Entra Verified ID license
Correct answer: Microsoft Entra ID P1 or P2
Conditional Access requires Microsoft Entra ID P1 (or P2 for risk-based policies), which is included in Microsoft 365 E3/E5 or available as a standalone add-on.
Question 7: What is the purpose of 'Named Locations' in Microsoft Entra Conditional Access?
- To assign Azure resources to specific geographic data centers
- To define trusted or blocked IP ranges and countries for use in access policies (Correct answer)
- To configure on-premises locations for Entra Domain Services
- To mark certain devices as compliant based on their network location
Correct answer: To define trusted or blocked IP ranges and countries for use in access policies
Named Locations allow administrators to define specific IP ranges or countries/regions that can then be used as conditions within Conditional Access policies.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management 4
What is the role of an 'Authentication Strength' policy in Microsoft Entra Conditional Access?