SC-100 Identity & Access Management Architecture 2 — Questions and Answers
Question 1: A cybersecurity architect needs to enforce that all privileged role activations in Azure AD Privileged Identity Management require justification and approval. Which PIM setting must be configured?
- Enable just-in-time access with no approval requirement
- Configure eligible assignments with approval workflow and require justification on activation (Correct answer)
- Use permanent active assignments for all privileged roles
- Enable access reviews without configuring activation requirements
Correct answer: Configure eligible assignments with approval workflow and require justification on activation
PIM eligible assignments with an approval workflow and justification requirement enforce human oversight before privileged access is granted.
Question 2: An organization wants to prevent lateral movement after an account compromise by ensuring users can only access resources from compliant, Intune-managed devices. Which Azure AD Conditional Access control achieves this?
- Require multi-factor authentication
- Require device to be marked as compliant (Correct answer)
- Block access from all non-corporate IP ranges
- Require hybrid Azure AD joined device only
Correct answer: Require device to be marked as compliant
The 'Require device to be marked as compliant' grant control checks Intune compliance status before allowing access.
Question 3: Which identity architecture pattern best supports Zero Trust by continuously validating user and device trustworthiness throughout a session rather than only at login?
- Kerberos ticket-based authentication with long TTLs
- Continuous Access Evaluation (CAE) with token revocation (Correct answer)
- Static IP allowlisting for trusted office networks
- SAML federation with long-lived assertions
Correct answer: Continuous Access Evaluation (CAE) with token revocation
Continuous Access Evaluation allows Azure AD to revoke tokens in near-real-time when conditions change, enforcing Zero Trust throughout a session.
Question 4: A security architect is designing an identity solution for external B2B partners. Which Azure AD feature allows partners to use their own organization's credentials without creating guest accounts for every individual?
- Azure AD B2C with local accounts
- Azure AD cross-tenant access settings with trust for external MFA claims (Correct answer)
- Azure AD Application Proxy for on-premises apps
- Microsoft Entra Verified ID for credential issuance
Correct answer: Azure AD cross-tenant access settings with trust for external MFA claims
Cross-tenant access settings allow trusting MFA and device compliance claims from partner tenants, reducing friction without requiring individual guest accounts.
Question 5: Which Microsoft Entra feature provides a decentralized identity approach where users control verifiable credentials without relying on a central identity provider for every transaction?
- Azure AD B2C custom policies
- Microsoft Entra Verified ID (Correct answer)
- Azure AD Privileged Identity Management
- Microsoft Entra Permissions Management
Correct answer: Microsoft Entra Verified ID
Microsoft Entra Verified ID implements W3C Verifiable Credentials standards, letting users present cryptographically signed credentials without a central authority.
Question 6: An architect wants to discover and right-size overprivileged permissions across AWS, Azure, and GCP. Which Microsoft product provides unified multicloud permissions analytics?
- Microsoft Defender for Cloud
- Microsoft Entra Permissions Management (formerly CloudKnox) (Correct answer)
- Azure Policy with built-in RBAC compliance
- Microsoft Sentinel with UEBA
Correct answer: Microsoft Entra Permissions Management (formerly CloudKnox)
Microsoft Entra Permissions Management (CIEM) analyzes permissions granted versus permissions used across AWS, Azure, and GCP to identify and remediate excessive access.
Question 7: When designing authentication for a high-security Azure environment, which combination best satisfies phishing-resistant MFA requirements per Microsoft's Zero Trust guidance?
- SMS OTP plus password
- FIDO2 security keys or Windows Hello for Business (Correct answer)
- Authenticator app push notifications plus password
- Hardware token TOTP plus password
Correct answer: FIDO2 security keys or Windows Hello for Business
FIDO2 security keys and Windows Hello for Business are phishing-resistant because they bind credentials to the registered device and domain using public key cryptography.
SC-100 Identity & Access Management Architecture 2
A cybersecurity architect needs to enforce that all privileged role activations in Azure AD Privileged Identity Management require justification and approval.
Which PIM setting must be configured?