Focus keyphrase: SC-900 practice questions
Use these SC-900 practice questions to drill the Microsoft Entra identity and access management skills that show up repeatedly on the Microsoft Security, Compliance, and Identity Fundamentals exam. This set covers hybrid identity, external identities, Conditional Access, privileged access, access reviews, identity risk, password protection, and least-privilege role selection.
These are original practice questions based on public Microsoft exam objectives and official documentation. They are not copied from real exams or exam-dump sites.
SC-900 Questions 11-20: Microsoft Entra identity and access management
For each question, choose the best answer, then review the explanation and the distractor analysis. Watch for small wording details: SC-900 questions often separate authentication, authorization, governance, and risk detection with one sentence.
Question 11: Hybrid identity synchronization
Scenario: A company has an on-premises Active Directory Domain Services environment. The company wants users to sign in to Microsoft 365 with identities that are synchronized from the on-premises directory. Password hash synchronization is acceptable, and the company wants a standard Microsoft-supported synchronization tool.
Choose one answer.
- Microsoft Entra Connect Sync
- Microsoft Purview Data Loss Prevention
- Microsoft Sentinel
- Azure Firewall Manager
Correct answer: A — Microsoft Entra Connect Sync
Explanation: Microsoft Entra Connect Sync is used to synchronize identity data between on-premises Active Directory and Microsoft Entra ID. It supports common hybrid identity patterns, including password hash synchronization.
Why the other options are wrong
- B. Microsoft Purview DLP helps protect sensitive data; it does not synchronize identities.
- C. Microsoft Sentinel is a SIEM/SOAR solution for security operations, not directory synchronization.
- D. Azure Firewall Manager centrally manages network security policies, not hybrid identity.
Official reference: What is Microsoft Entra Connect and Connect Health?
Question 12: Partner access to internal apps
Scenario: A project team needs to collaborate with users from a partner organization. The partner users should use their own identities, but they need access to a SharePoint site and a line-of-business application in your tenant.
Choose one answer.
- Microsoft Entra B2B collaboration
- Microsoft Entra Connect Health
- Microsoft Defender for Endpoint
- Microsoft Purview Records Management
Correct answer: A — Microsoft Entra B2B collaboration
Explanation: Microsoft Entra B2B collaboration is designed for external collaboration with business partners and guests. It lets external users access your resources while authenticating with their own identities.
Why the other options are wrong
- B. Connect Health monitors hybrid identity infrastructure; it is not the guest collaboration feature.
- C. Defender for Endpoint protects endpoint devices and supports endpoint detection and response.
- D. Records Management manages retention and record declaration, not guest access.
Official reference: What is Microsoft Entra B2B collaboration?
Question 13: Conditional access controls
Scenario: Administrators want users to access the Microsoft Azure portal only when they complete multifactor authentication and sign in from a compliant device. The decision should be based on user, application, device, and sign-in conditions.
Choose one answer.
- Microsoft Entra Conditional Access
- Microsoft Secure Score
- Azure Service Health
- Microsoft Purview Communication Compliance
Correct answer: A — Microsoft Entra Conditional Access
Explanation: Conditional Access evaluates signals such as user, group, cloud app, location, device state, and risk before applying controls such as requiring MFA or requiring a compliant device.
Why the other options are wrong
- B. Microsoft Secure Score recommends security improvements, but it does not enforce sign-in controls.
- C. Azure Service Health reports Azure service incidents and maintenance.
- D. Communication Compliance helps detect risky communications, not govern application sign-in.
Official reference: Microsoft Entra Conditional Access overview
Question 14: Just-in-time administrator access
Scenario: A security team wants administrators to be eligible for privileged roles but not active all the time. When an administrator needs the role, they should activate it for a limited time, complete MFA, and provide a justification.
Choose one answer.
- Microsoft Entra Privileged Identity Management
- Microsoft Entra Password Protection
- Microsoft Defender for Cloud Apps
- Azure DDoS Protection
Correct answer: A — Microsoft Entra Privileged Identity Management
Explanation: Privileged Identity Management (PIM) supports just-in-time privileged role activation, approval workflows, MFA requirements, activation duration, and auditing for privileged access.
Why the other options are wrong
- B. Password Protection blocks weak or banned passwords; it does not manage privileged role activation.
- C. Defender for Cloud Apps is a cloud access security broker capability, not the Entra role activation service.
- D. DDoS Protection helps protect network-facing resources from distributed denial-of-service attacks.
Official reference: What is Privileged Identity Management?
Question 15: Periodic review of group access
Scenario: A compliance requirement says business owners must periodically confirm whether users and guest accounts should remain members of high-impact Microsoft 365 groups. Access should be removed when reviewers deny or fail to approve continued access.
Choose one answer.
- Microsoft Entra access reviews
- Azure Advisor
- Microsoft Defender Vulnerability Management
- Microsoft Purview Audit only
Correct answer: A — Microsoft Entra access reviews
Explanation: Access reviews are part of Microsoft Entra ID Governance and help organizations periodically review group membership, application access, and privileged role assignments.
Why the other options are wrong
- B. Azure Advisor provides recommendations for Azure resources, not identity governance reviews.
- C. Vulnerability Management helps find and prioritize endpoint vulnerabilities.
- D. Purview Audit can record activities, but it does not run access certification campaigns.
Official reference: What are access reviews?
Question 16: Risky sign-ins and risky users
Scenario: A tenant needs automated detection for identity risks such as leaked credentials, impossible travel, and suspicious sign-in behavior. The security team also wants risk-based policies that can require password changes or MFA.
Choose one answer.
- Microsoft Entra ID Protection
- Microsoft Purview eDiscovery
- Azure Bastion
- Microsoft Defender for Office 365 Safe Attachments
Correct answer: A — Microsoft Entra ID Protection
Explanation: Microsoft Entra ID Protection detects identity-based risks, reports risky users and risky sign-ins, and can be used with risk-based policies to help remediate suspicious access.
Why the other options are wrong
- B. eDiscovery supports legal discovery and investigations, not real-time identity risk detection.
- C. Azure Bastion provides secure browser-based RDP/SSH access to virtual machines.
- D. Safe Attachments helps protect email and collaboration workloads from malicious attachments, not identity sign-in risk.
Official reference: What is Microsoft Entra ID Protection?
Question 17: Blocking weak and company-specific passwords
Scenario: An organization wants to reduce password spray risk by blocking common weak passwords and company-specific terms such as the company name, product names, and local sports teams. The protection should apply to password changes.
Choose one answer.
- Microsoft Entra Password Protection with a custom banned password list
- Microsoft Sentinel workbooks
- Microsoft Purview sensitivity labels
- Azure Network Security Groups
Correct answer: A — Microsoft Entra Password Protection with a custom banned password list
Explanation: Microsoft Entra Password Protection detects and blocks known weak passwords and can use a custom banned password list for organization-specific terms.
Why the other options are wrong
- B. Sentinel workbooks visualize security data; they do not enforce password rules.
- C. Sensitivity labels classify and protect content, not passwords.
- D. Network Security Groups filter network traffic to Azure resources.
Official reference: Eliminate bad passwords using Microsoft Entra Password Protection
Question 18: User self-service password recovery
Scenario: A company wants standard users to reset their own passwords after proving their identity with approved authentication methods. The goal is to reduce help desk password reset tickets without giving users administrative privileges.
Choose one answer.
- Microsoft Entra self-service password reset
- Microsoft Defender for Identity
- Microsoft Purview Compliance Manager
- Azure Firewall
Correct answer: A — Microsoft Entra self-service password reset
Explanation: Self-service password reset (SSPR) lets users reset or unlock their own accounts after satisfying configured verification requirements. It is the Entra feature aligned with reducing help desk password reset work.
Why the other options are wrong
- B. Defender for Identity detects identity threats in hybrid environments; it does not let users reset their own passwords.
- C. Compliance Manager tracks compliance posture and improvement actions.
- D. Azure Firewall is a cloud-native network firewall service.
Official reference: How Microsoft Entra self-service password reset works
Question 19: Least-privilege role selection
Scenario: A junior security analyst needs to view security-related information and reports in Microsoft Entra ID but must not be able to change security settings, reset passwords, or manage users.
Choose one answer.
- Security Reader
- Global Administrator
- User Administrator
- Privileged Role Administrator
Correct answer: A — Security Reader
Explanation: Security Reader is a read-only role for viewing security-related information. It fits the least-privilege requirement because the analyst needs visibility but not administrative control.
Why the other options are wrong
- B. Global Administrator has broad control across the tenant and is far beyond the requirement.
- C. User Administrator can manage users and groups, which the scenario explicitly does not require.
- D. Privileged Role Administrator can manage role assignments and privileged access, which is too powerful for read-only security reporting.
Official reference: Microsoft Entra built-in roles permissions reference
Question 20: Authentication versus authorization
Scenario: During a training session, a manager says, “MFA proves who the user is, and role assignments decide what the user can do after sign-in.” Which statement correctly maps these concepts?
Choose one answer.
- MFA is authentication; role assignments are authorization.
- MFA is authorization; role assignments are authentication.
- Both MFA and role assignments are encryption controls.
- Both MFA and role assignments are compliance score controls only.
Correct answer: A — MFA is authentication; role assignments are authorization.
Explanation: Authentication verifies identity, such as proving the user is who they claim to be. Authorization determines what an authenticated identity is allowed to access or perform.
Why the other options are wrong
- B. This reverses the concepts.
- C. Encryption protects data confidentiality; it is not the same as authentication or authorization.
- D. Compliance score can track improvement actions, but it does not redefine identity fundamentals.
Official reference: Microsoft SC-900 study guide
Answer key summary
| Question | Correct answer | Objective focus |
|---|---|---|
| 11 | A. Microsoft Entra Connect Sync | Hybrid identity |
| 12 | A. Microsoft Entra B2B collaboration | External identities |
| 13 | A. Microsoft Entra Conditional Access | Access management |
| 14 | A. Microsoft Entra Privileged Identity Management | Privileged access governance |
| 15 | A. Microsoft Entra access reviews | Identity governance |
| 16 | A. Microsoft Entra ID Protection | Identity risk detection |
| 17 | A. Microsoft Entra Password Protection | Password protection |
| 18 | A. Microsoft Entra self-service password reset | Password management |
| 19 | A. Security Reader | Role-based access control |
| 20 | A. MFA is authentication; role assignments are authorization | Identity concepts |
Quick study notes for SC-900 Microsoft Entra questions
- Authentication proves identity; authorization determines allowed actions.
- Conditional Access is policy-based access control using signals such as user, app, device, location, and risk.
- PIM reduces standing privileged access by using eligible assignments and time-bound activation.
- Access reviews help keep group, app, and role access from quietly becoming permanent “forever access.” Sneaky little governance gremlin defeated.
- ID Protection focuses on identity risk detection and remediation workflows.
Sources
- Microsoft SC-900 study guide
- What is Microsoft Entra Connect and Connect Health?
- What is Microsoft Entra B2B collaboration?
- Microsoft Entra Conditional Access overview
- What is Privileged Identity Management?
- What are access reviews?
- What is Microsoft Entra ID Protection?
- Eliminate bad passwords using Microsoft Entra Password Protection
- How Microsoft Entra self-service password reset works
- Microsoft Entra built-in roles permissions reference
