Describe the capabilities of Microsoft Entra
Domain 2 of SC-900 accounts for 25-30% of the exam. EarnYourCert has 114 original questions for this domain, all with explanations: 73 multiple choice, 15 yes/no and 26 completion or ordering items, like the real exam.
Domain 2 sample questions
8 questions from our 114-question bank for this domain. Try to answer before revealing the solution.
1. An employee works remotely and signs in from a personal laptop that is not managed by the organization. Which Microsoft Entra concept lets the company still recognize and control this device for access decisions?
- A guest user
- Microsoft Entra Domain Services
- An administrative unit
- Microsoft Entra registered device
Show answer
Correct answer: D. Registered devices represent personally owned devices that access organizational resources.
2. Which feature lets users reset their own forgotten passwords without calling the help desk?
- Access reviews
- Privileged Identity Management
- Self-service password reset (SSPR)
- Conditional Access
Show answer
Correct answer: C. SSPR lets users verify their identity with registered methods and reset their own password.
3. Which statement about passkeys is correct?
- Passkeys work only offline
- Passkeys use public-key cryptography, so there is no shared secret that can be phished
- Passkeys store the user's password in plain text
- Passkeys are the same as security questions
Show answer
Correct answer: B. Passkeys bind credentials to the relying party and are phishing-resistant.
4. Which authentication method is a physical USB or NFC device that provides phishing-resistant passwordless sign-in?
- FIDO2 security key
- Security questions answered during password reset
- SMS verification code
- Voice call
Show answer
Correct answer: A. FIDO2 security keys hold a passkey bound to the site, so codes cannot be phished.
5. A new employee has no credentials yet and must register a passkey on day one. Which method lets them sign in once for a limited time?
- Security defaults
- Smart lockout
- A permanent password shared by the help desk team
- Temporary Access Pass
Show answer
Correct answer: D. A Temporary Access Pass is a time-limited passcode used to onboard or recover passwordless methods.
6. Which role would you assign to an administrator who only needs to reset passwords for non-administrator users?
- Global Administrator
- Privileged Role Administrator
- Security Administrator
- Helpdesk Administrator
Show answer
Correct answer: D. Least privilege: Helpdesk Administrator can reset passwords for non-admins without full tenant control.
7. Which capability lets Microsoft Entra ID revoke access in near real time, for example when a user is disabled, instead of waiting for the token to expire?
- Password hash synchronization every two minutes
- Continuous access evaluation
- Report-only mode
- Access reviews
Show answer
Correct answer: B. Continuous access evaluation lets supporting services react to critical events such as account disable or location change.
8. What do access reviews in Microsoft Entra ID Governance help an organization do?
- Periodically verify that users still need access to groups, apps and roles
- Detect risky sign-ins with machine learning
- Automatically create user accounts from HR data
- Encrypt data stored in SharePoint sites
Show answer
Correct answer: A. Access reviews remove unnecessary access and help prevent permission creep.