SkillTestPro | SC-900 Practice Test 20 Hard Questions

SC-900 Exam Practice Test 20 (Hard) - Conditional Access and Identity Protection Deep-Dive

SC-900 Exam Practice Tests

1 / 15

Which Conditional Access component defines the specific requirements, such as requiring MFA or a compliant device, that must be met before access is granted?

Assignments

Session controls

Grant controls

Named locations alone

Sign-in risk levels alone

User risk levels alone

2 / 15

Which Conditional Access component defines ongoing restrictions applied during an active session, such as limiting the ability to download files in a browser session?

Grant controls

Assignments

Session controls

Named locations alone

Sign-in risk levels alone

User risk levels alone

3 / 15

Which Conditional Access condition allows an administrator to define trusted IP address ranges, such as a corporate office network, treated differently from untrusted locations?

Grant controls

Session controls

Named locations

Assignments alone

Sign-in risk levels alone

User risk levels alone

4 / 15

Which Conditional Access session control integrates with Microsoft Defender for Cloud Apps to enforce real-time monitoring and restrictions, such as blocking downloads, within a cloud app session?

Sign-in frequency alone, which controls re-authentication timing rather than real-time in-session restrictions

Persistent browser session alone, which controls session persistence rather than real-time monitoring

Use Conditional Access App Control

Named locations alone

Grant controls alone

User risk levels alone

5 / 15

Which Conditional Access session control defines how frequently a user is required to re-authenticate during an active session, rather than remaining signed in indefinitely?

Persistent browser session alone

Use Conditional Access App Control alone

Sign-in frequency

Named locations alone

Grant controls alone

User risk levels alone

6 / 15

Which Microsoft Entra ID Protection remediation action would automatically be recommended for a user flagged with high user risk due to leaked credentials?

Immediately and permanently deleting the user's account with no remediation option

Ignoring the risk entirely with no remediation action

Requiring the user to securely reset their password

Granting the user additional administrative privileges

Disabling multifactor authentication for that specific user

Removing all Conditional Access policies for that specific user

7 / 15

Which Microsoft Entra ID Protection policy type would automatically require MFA when a sign-in attempt is deemed medium or high risk, based on real-time signals?

A user risk-based Conditional Access policy alone, which focuses on the user account's overall compromise likelihood rather than a specific sign-in attempt

A named location policy alone

A sign-in risk-based Conditional Access policy

A device compliance policy alone

An application-based policy alone with no risk signal involved

A group membership-based policy alone with no risk signal involved

8 / 15

Which Microsoft Entra ID Protection risk detection type would flag a sign-in attempt occurring from a location that would be physically impossible to reach from the user's previous sign-in location within the elapsed time?

Anonymous IP address usage, which flags use of anonymizing services rather than physically impossible travel

Leaked credentials, which flags exposure in breach data rather than travel patterns

Impossible travel

Password spray, which flags a specific attack pattern rather than travel distance

Malware-linked IP address, which flags known malicious infrastructure rather than travel distance

Unfamiliar sign-in properties, which is a broader category rather than the specific travel-distance calculation

9 / 15

Which Microsoft Entra ID Protection risk detection type would flag a sign-in attempt originating from an IP address associated with a known Tor exit node or anonymizing proxy service?

Impossible travel, which flags a physically implausible travel distance rather than anonymizing infrastructure

Leaked credentials

Anonymous IP address

Password spray

Malware-linked IP address, which flags known malware command-and-control infrastructure rather than general anonymizing services

Unfamiliar sign-in properties

10 / 15

Which Microsoft Entra Privileged Identity Management (PIM) concept requires a user to provide a business justification and can trigger an approval workflow before they can activate an eligible privileged role?

Standing (always-on) role assignment, which grants the role permanently without requiring activation

A basic user role with no privileged capabilities

Role activation (with approval and justification requirements)

A guest account with no role assignment at all

A service principal with no interactive role activation process

A managed identity with no interactive role activation process

11 / 15

Which Privileged Identity Management (PIM) feature sends a notification to administrators when a privileged role is activated, supporting oversight and monitoring of privileged access usage?

Entitlement management alone, which manages access packages rather than PIM-specific role activation alerts

Conditional Access alone, which controls sign-in conditions rather than PIM role activation notifications

PIM alerts and audit history

Access reviews alone, which periodically verify existing access rather than provide real-time activation alerts

Self-service password reset alone

Company branding alone

12 / 15

Which Microsoft Entra Identity Governance feature allows an organization to configure automatic access expiration, ensuring temporary access, such as for a contractor, does not persist indefinitely?

Conditional Access alone, which controls sign-in conditions rather than automatic access expiration

Identity Protection alone, which focuses on risk detection rather than automatic access expiration

Entitlement management (with time-limited access packages)

Self-service password reset alone

Company branding alone

Password protection alone

13 / 15

Which access review scenario would be most appropriate for periodically confirming that members of a highly privileged security group still require that membership?

An access review scoped to every single user and group in the entire tenant with no targeted scoping

A one-time review conducted only when the tenant was first created, with no recurring cadence

An access review scoped to that specific privileged group's membership

Skipping any review entirely for privileged groups since they were manually assigned

A review conducted solely by an external, unrelated third-party with no internal stakeholder involvement

A review that only examines guest accounts, excluding privileged internal group membership

14 / 15

Which term describes the overall Microsoft Entra Identity Governance capability that encompasses entitlement management, access reviews, and Privileged Identity Management together?

Conditional Access alone, which is a distinct policy engine rather than the overarching governance capability

Identity Protection alone, which focuses specifically on risk-based detection rather than the broader governance capability

Identity Governance

Single sign-on alone

Federation alone

Self-service password reset alone

15 / 15

Which term describes an Identity Protection workflow allowing a self-remediation option, where a flagged user can resolve their own risk, such as by completing MFA, without requiring administrator intervention?

A requirement for every flagged risk to always be manually resolved by an administrator with no self-service option

Immediate and automatic permanent account deletion with no remediation path

Self-remediation (self-service risk remediation)

A requirement to always ignore flagged risk with no action taken

A requirement to grant the flagged user additional administrative privileges

A requirement to disable Conditional Access entirely for any flagged user

Your score is

The average score is 0%