SC-100 Identity & Access Management Architecture 5 — Questions and Answers
Question 1: An architect needs to design identity governance for a large enterprise where managers must periodically confirm that their direct reports still need access to sensitive SharePoint sites. Which feature automates this process?
- Azure AD Identity Protection user risk reports
- Azure AD Access Reviews targeting group members with manager as reviewer (Correct answer)
- PIM role activation with approval from manager
- Microsoft Entra Permissions Management access recommendations
Correct answer: Azure AD Access Reviews targeting group members with manager as reviewer
Azure AD Access Reviews can be configured to target group membership with the assigned manager as reviewer, automating periodic recertification of access.
Question 2: Which Conditional Access policy configuration enforces that users accessing sensitive data must agree to terms of use and cannot proceed until they do?
- Session control requiring app-enforced restrictions
- Grant control requiring users to accept Terms of Use (Correct answer)
- Named location policy requiring corporate network
- Sign-in frequency set to every 1 hour
Correct answer: Grant control requiring users to accept Terms of Use
Conditional Access grant controls can include a Terms of Use requirement, blocking access until the user explicitly accepts the configured terms document.
Question 3: A security architect is designing identity for a hybrid scenario where some users must authenticate using on-premises AD FS while others use Azure AD cloud authentication. Which Azure AD Connect feature supports routing specific users to different authentication methods?
- Staged rollout for cloud authentication (Correct answer)
- Azure AD seamless SSO with Kerberos
- Password hash sync with hard match
- Pass-through authentication with agent clustering
Correct answer: Staged rollout for cloud authentication
Staged rollout allows gradually migrating users from federated authentication (AD FS) to cloud authentication (PHS or PTA) by targeting specific groups.
Question 4: Which Azure AD feature allows administrators to define which external identity providers (like Google or Facebook) can be used by guest users during the self-service sign-up flow for B2B collaboration?
- Azure AD B2C identity provider federation
- External identities settings with direct federation and social IdP configuration (Correct answer)
- Azure AD cross-tenant sync policies
- Microsoft Entra Verified ID trust framework
Correct answer: External identities settings with direct federation and social IdP configuration
Azure AD External Identities allows configuring direct federation with SAML/WS-Fed partners and social identity providers like Google for B2B guest self-service sign-up.
Question 5: An SC-100 architect recommends implementing Microsoft Sentinel UEBA to improve identity threat detection. What does UEBA establish as its baseline for detecting anomalous behavior?
- Static rules based on known attack signatures
- Behavioral profiles per user and peer group derived from historical activity (Correct answer)
- Real-time IP reputation feeds from Microsoft threat intelligence
- Compliance baselines from Azure Security Benchmark
Correct answer: Behavioral profiles per user and peer group derived from historical activity
UEBA (User and Entity Behavior Analytics) builds dynamic behavioral baselines per user and peer group, flagging deviations that may indicate compromise.
Question 6: A company requires that emergency 'break-glass' accounts for Azure AD Global Administrator access are excluded from all Conditional Access policies. What additional compensating control must the architect require for these accounts?
- Store break-glass credentials in Azure Key Vault and audit access quarterly
- Monitor break-glass account sign-in activity with alerts and conduct regular access reviews (Correct answer)
- Assign break-glass accounts as PIM eligible and require approval for activation
- Restrict break-glass accounts to sign in only from on-premises domain-joined machines
Correct answer: Monitor break-glass account sign-in activity with alerts and conduct regular access reviews
Because break-glass accounts bypass Conditional Access, continuous monitoring with real-time alerts on any sign-in activity is the critical compensating control.
Question 7: When recommending an Azure AD hybrid identity authentication method, which option provides authentication entirely in the cloud without sending password hashes to Azure AD, using on-premises agents to validate credentials?
- Password Hash Synchronization (PHS)
- Pass-Through Authentication (PTA) (Correct answer)
- Active Directory Federation Services (AD FS)
- Azure AD seamless SSO with Kerberos
Correct answer: Pass-Through Authentication (PTA)
Pass-Through Authentication validates user credentials against on-premises AD in real time via lightweight agents, without storing password hashes in Azure AD.
SC-100 Identity & Access Management Architecture 5
An architect needs to design identity governance for a large enterprise where managers must periodically confirm that their direct reports still need access to sensitive SharePoint sites.
Which feature automates this process?