A company wants to ensure that only the IT helpdesk team can reset passwords for users in the Sales department. They also want to prevent other administrators from resetting Sales passwords. What is the best approach?

Create a Conditional Access policy to restrict password resets to the IT helpdesk team

Assign the Global Administrator role to the IT helpdesk team

Assign the Helpdesk Administrator role to the IT helpdesk team and scope it to the Sales department

Assign the Password Administrator role to all users in the Sales department

A company wants to require MFA for all users when accessing Microsoft 365, but they want to exclude break-glass accounts from this requirement. What is the recommended way to handle this in Conditional Access?

Create a Conditional Access policy that includes all users and excludes the break-glass accounts

Create a separate Conditional Access policy that blocks break-glass accounts from accessing Microsoft 365

Assign the Global Administrator role to break-glass accounts so they are exempt from MFA

Use a session control to skip MFA for break-glass accounts

A company wants to assign the Security Administrator role to a group of users. They want to ensure that the role assignment is temporary and requires approval from a manager. What should they use?

Privileged Identity Management (PIM) for role activation

Conditional Access to require MFA for the group

Assign the role directly to the group with an expiration date

In a Conditional Access policy, what does the 'Device state' condition evaluate?

The operating system version of the device

Whether the device is compliant or hybrid Azure AD joined

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 2Objective 3

Describe Access Management Capabilities of Microsoft Entra ID SC-900 Practice Questions (Page 1)

Part of the Describe the capabilities of Microsoft Entra domain, which accounts for 25–30% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~5–9 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

25–30%of the exam

Questions 1–5

1application · hard
A company wants to ensure that only the IT helpdesk team can reset passwords for users in the Sales department. They also want to prevent other administrators from resetting Sales passwords. What is the best approach?
Select an answer first
2expert · medium
A company has a security policy that requires the principle of least privilege. They need to grant a user the ability to manage Microsoft Entra ID roles, but they do not want the user to be able to manage users or groups. Which built-in role should be assigned?
Select an answer first
3application · medium
A company wants to require MFA for all users when accessing Microsoft 365, but they want to exclude break-glass accounts from this requirement. What is the recommended way to handle this in Conditional Access?
Select an answer first
4application · medium
A company wants to assign the Security Administrator role to a group of users. They want to ensure that the role assignment is temporary and requires approval from a manager. What should they use?
Select an answer first
5foundation · easy
In a Conditional Access policy, what does the 'Device state' condition evaluate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.