SC-100 Identity & Access Management Architecture 4 — Questions and Answers
Question 1: A global organization needs to govern external user access so that guests automatically lose access after 90 days unless explicitly recertified. Which Azure AD feature automates this lifecycle?
- Azure AD Conditional Access with time-based location policies
- Azure AD Entitlement Management access packages with expiration and access reviews (Correct answer)
- Azure AD Identity Protection user risk policies
- Azure AD B2C custom user flows
Correct answer: Azure AD Entitlement Management access packages with expiration and access reviews
Entitlement Management access packages support configurable expiration periods and recurring access reviews to automatically remove guest access.
Question 2: When designing workload identity security for Kubernetes pods running in Azure Kubernetes Service (AKS), which approach eliminates pod-level secrets for Azure resource access?
- Store service principal client secrets in Kubernetes secrets
- Use AKS workload identity with federated identity credentials tied to pod service accounts (Correct answer)
- Mount Azure Key Vault secrets directly as environment variables in pod specs
- Assign system-assigned managed identity to the AKS node pool VM scale set only
Correct answer: Use AKS workload identity with federated identity credentials tied to pod service accounts
AKS workload identity federates Kubernetes service account tokens with Azure AD using OIDC, allowing pods to obtain Azure AD tokens without any stored secrets.
Question 3: An SC-100 architect must recommend a strategy to reduce the attack surface for administrative access to Azure management plane resources. Which combination best achieves this?
- Enable Azure AD smart lockout and require complex passwords for admin accounts
- Use privileged access workstations (PAWs), PIM just-in-time access, and Conditional Access requiring compliant devices for admin roles (Correct answer)
- Enforce MFA only for Global Administrator role and use permanent assignments for other roles
- Restrict admin access to on-premises AD only and avoid syncing admin accounts to Azure AD
Correct answer: Use privileged access workstations (PAWs), PIM just-in-time access, and Conditional Access requiring compliant devices for admin roles
PAWs, PIM just-in-time access, and Conditional Access requiring compliant devices create a layered defense that reduces both credential theft risk and standing privilege.
Question 4: Which Azure AD token type is used specifically to prove a user's identity and contains claims such as name, email, and object ID, as opposed to authorizing access to APIs?
- Access token
- ID token (Correct answer)
- Refresh token
- SAML assertion
Correct answer: ID token
The ID token in OpenID Connect is a JWT issued to the client application proving user authentication and containing identity claims.
Question 5: A company wants to enforce that service principals accessing the Microsoft Graph API can only perform approved operations and cannot exceed their granted scopes even if compromised. Which mechanism enforces this at the application level?
- Conditional Access app control via Microsoft Defender for Cloud Apps
- Azure AD application role assignments with admin consent, using least-privilege scopes (Correct answer)
- Azure Policy deny assignment on resource groups
- PIM for groups with time-limited role membership
Correct answer: Azure AD application role assignments with admin consent, using least-privilege scopes
Granting only the least-privilege Graph API application permissions with admin consent ensures that even a compromised service principal cannot exceed its approved scopes.
Question 6: When a user is deleted from Azure AD, what happens to their access tokens that are currently valid and in use by applications?
- Tokens are immediately invalidated across all applications
- Tokens remain valid until they naturally expire unless Continuous Access Evaluation (CAE) is enabled and enforced by the resource (Correct answer)
- Tokens are revoked within 1 minute by the Azure AD token revocation service
- Tokens are invalidated only for Microsoft 365 apps, not third-party apps
Correct answer: Tokens remain valid until they naturally expire unless Continuous Access Evaluation (CAE) is enabled and enforced by the resource
Without CAE, access tokens remain valid until expiry (typically 60–75 minutes); CAE-enabled resources can receive near-real-time revocation signals from Azure AD.
Question 7: An architect designing a Zero Trust network access solution recommends replacing VPN with Azure AD Application Proxy for on-premises web apps. Which security capability does Application Proxy provide that traditional VPN does not?
- IP-layer encryption for all traffic between user and datacenter
- Pre-authentication via Azure AD before requests reach the on-premises application (Correct answer)
- Network segmentation using Azure Virtual Network peering
- Automatic certificate rotation for on-premises IIS servers
Correct answer: Pre-authentication via Azure AD before requests reach the on-premises application
Application Proxy authenticates users against Azure AD before any request reaches the on-premises connector, preventing unauthenticated traffic from ever touching the internal network.
SC-100 Identity & Access Management Architecture 4
A global organization needs to govern external user access so that guests automatically lose access after 90 days unless explicitly recertified.
Which Azure AD feature automates this lifecycle?