SC-100 Identity & Access Management Architecture 3 â Questions and Answers
Question 1: A company is migrating to Azure and needs to synchronize on-premises Active Directory identities to Azure AD while also enabling password hash synchronization as a fallback. Which tool fulfills both requirements?
- Azure AD Application Proxy
- Azure AD Connect with password hash sync enabled (Correct answer)
- Active Directory Federation Services (AD FS) only
- Microsoft Entra Permissions Management
Correct answer: Azure AD Connect with password hash sync enabled
Azure AD Connect synchronizes on-premises AD objects to Azure AD and optionally replicates password hashes to support cloud authentication.
Question 2: Which Azure AD Conditional Access signal can be used to block access attempts originating from countries where the organization has no business presence?
- Device compliance state
- Named locations based on country/region (Correct answer)
- Risk-based sign-in policy using Identity Protection
- Application sensitivity label
Correct answer: Named locations based on country/region
Named locations can define allowed or blocked countries/regions, and Conditional Access policies can enforce access restrictions based on those locations.
Question 3: An organization wants to ensure that when a user's account risk level rises to 'high' in Azure AD Identity Protection, access is blocked until the risk is remediated. Which policy type enforces this?
- Sign-in risk policy set to block when risk is medium or above
- User risk policy set to block when user risk is high (Correct answer)
- Conditional Access policy requiring compliant device
- PIM eligible role assignment requiring approval
Correct answer: User risk policy set to block when user risk is high
A user risk policy in Identity Protection (or via Conditional Access) blocks or requires password change when user risk reaches the configured threshold.
Question 4: A cybersecurity architect recommends replacing service account passwords with managed identities for Azure workloads. What is the primary security benefit of system-assigned managed identities?
- They support cross-tenant resource access without additional configuration
- They eliminate the need to manage credentialsâAzure handles lifecycle automatically (Correct answer)
- They can be shared across multiple Azure resources to simplify management
- They support on-premises resource authentication natively
Correct answer: They eliminate the need to manage credentialsâAzure handles lifecycle automatically
System-assigned managed identities are created and deleted with the resource, and Azure automatically rotates their credentials, eliminating secrets management burden.
Question 5: Which Azure AD feature allows an architect to define the maximum session lifetime and re-authentication frequency for sensitive applications accessed via Conditional Access?
- Azure AD B2C session management policies
- Conditional Access session controls: sign-in frequency and persistent browser session (Correct answer)
- Token lifetime policies applied at the application registration
- Azure AD smart lockout configuration
Correct answer: Conditional Access session controls: sign-in frequency and persistent browser session
Conditional Access session controls for sign-in frequency and persistent browser sessions override default token lifetimes for specific app or user conditions.
Question 6: To comply with separation of duties requirements, which Azure AD PIM feature prevents a user from holding two conflicting privileged roles simultaneously?
- Access reviews requiring manager attestation
- Role-incompatible assignments blocked via Azure Policy
- PIM role assignment with incompatible role detection using access packages in Entitlement Management (Correct answer)
- Conditional Access requiring MFA for all privileged roles
Correct answer: PIM role assignment with incompatible role detection using access packages in Entitlement Management
Azure AD Entitlement Management access packages can enforce incompatible access packages, preventing users from holding conflicting roles simultaneously.
Question 7: An architect is evaluating authentication protocols for a new SaaS application. Which protocol provides the most modern, token-based delegated authorization standard supported natively by Azure AD?
- SAML 2.0 with signed assertions
- OAuth 2.0 with OpenID Connect (Correct answer)
- Kerberos with NTLM fallback
- WS-Federation with passive profile
Correct answer: OAuth 2.0 with OpenID Connect
OAuth 2.0 paired with OpenID Connect provides delegated authorization and identity federation using short-lived tokens, and is Azure AD's preferred modern protocol.
SC-100 Identity & Access Management Architecture 3
A company is migrating to Azure and needs to synchronize on-premises Active Directory identities to Azure AD while also enabling password hash synchronization as a fallback.
Which tool fulfills both requirements?