SC-100 Identity & Access Management Architecture 4

Question 1

A global organization needs to govern external user access so that guests automatically lose access after 90 days unless explicitly recertified. Which Azure AD feature automates this lifecycle?

Accepted Answer

Azure AD Entitlement Management access packages with expiration and access reviews

Answer

Entitlement Management access packages support configurable expiration periods and recurring access reviews to automatically remove guest access.

Question 2

When designing workload identity security for Kubernetes pods running in Azure Kubernetes Service (AKS), which approach eliminates pod-level secrets for Azure resource access?

Accepted Answer

Use AKS workload identity with federated identity credentials tied to pod service accounts

Answer

AKS workload identity federates Kubernetes service account tokens with Azure AD using OIDC, allowing pods to obtain Azure AD tokens without any stored secrets.

Question 3

An SC-100 architect must recommend a strategy to reduce the attack surface for administrative access to Azure management plane resources. Which combination best achieves this?

Accepted Answer

Use privileged access workstations (PAWs), PIM just-in-time access, and Conditional Access requiring compliant devices for admin roles

Answer

PAWs, PIM just-in-time access, and Conditional Access requiring compliant devices create a layered defense that reduces both credential theft risk and standing privilege.

Question 4

Which Azure AD token type is used specifically to prove a user's identity and contains claims such as name, email, and object ID, as opposed to authorizing access to APIs?

Accepted Answer

ID token

Answer

The ID token in OpenID Connect is a JWT issued to the client application proving user authentication and containing identity claims.

Question 5

A company wants to enforce that service principals accessing the Microsoft Graph API can only perform approved operations and cannot exceed their granted scopes even if compromised. Which mechanism enforces this at the application level?

Accepted Answer

Azure AD application role assignments with admin consent, using least-privilege scopes

Answer

Granting only the least-privilege Graph API application permissions with admin consent ensures that even a compromised service principal cannot exceed its approved scopes.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Identity & Access Management Architecture 4