A startup has no on-premises servers and all 50 employees are hired as contractors. They need to give these contractors access to Microsoft 365 apps and enforce MFA. What is the simplest identity approach?

Use Microsoft Entra ID with password hash sync from a third-party identity provider.

Set up Active Directory on a new Windows Server VM and use Microsoft Entra Connect to sync identities.

Create guest user accounts in Microsoft Entra ID for each contractor and assign Microsoft 365 licenses.

Create cloud-only user accounts in Microsoft Entra ID and enable security defaults to require MFA for all users.

What is the primary purpose of multi-factor authentication (MFA) in Microsoft 365?

To require two or more forms of verification before granting access

To replace passwords with biometric verification only

To allow users to reset their passwords without administrator help

To synchronize passwords between on-premises and cloud

An organization wants to require MFA for all users, but they also want to allow users to reset their passwords via SSPR without MFA when they are on the corporate network. Which configuration best meets both requirements?

Configure SSPR to require MFA always, and use Conditional Access to require MFA for all apps.

Disable SSPR and require users to call the helpdesk for password resets.

Enable security defaults, which enforce MFA for all users including SSPR.

Create a Conditional Access policy that requires MFA for all cloud apps, and another policy that allows SSPR only from trusted locations without MFA.

A company wants to allow users to reset their passwords using SSPR, but they want to prevent users from reusing the same password after a reset. What should they configure?

Password protection and custom banned passwords in Microsoft Entra ID.

Set a longer password expiration period.

Enforce password history in on-premises Active Directory if using hybrid identity.

Require MFA during SSPR to ensure identity verification.

A company has an on-premises Active Directory and wants to use Microsoft 365. They want to keep using their on-premises Active Directory for authentication but also want to enable cloud-only features like SSPR. Which identity model should they use?

Federated identity with AD FS but no password writeback.

Cloud-only identity with no synchronization.

On-premises identity only, with no Microsoft Entra ID.

Hybrid identity with Microsoft Entra Connect and password writeback.

Microsoft Certified:Microsoft 365 Fundamentals

Domain 3Objective 1

Describe Identity and Access Management Solutions of Microsoft 365 MS-900 Practice Questions (Page 4)

Part of the Describe security, compliance, privacy, and trust in Microsoft 365 domain, which accounts for 25–30% of the MS-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~5–9 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

25–30%of the exam

Questions 16–20

16application · medium
A startup has no on-premises servers and all 50 employees are hired as contractors. They need to give these contractors access to Microsoft 365 apps and enforce MFA. What is the simplest identity approach?
Select an answer first
17foundation · easy
What is the primary purpose of multi-factor authentication (MFA) in Microsoft 365?
Select an answer first
18expert · hard
An organization wants to require MFA for all users, but they also want to allow users to reset their passwords via SSPR without MFA when they are on the corporate network. Which configuration best meets both requirements?
Select an answer first
19application · medium
A company wants to allow users to reset their passwords using SSPR, but they want to prevent users from reusing the same password after a reset. What should they configure?
Select an answer first
20application · medium
A company has an on-premises Active Directory and wants to use Microsoft 365. They want to keep using their on-premises Active Directory for authentication but also want to enable cloud-only features like SSPR. Which identity model should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-900” is a trademark of its owner, used for identification only.