SC-100 Identity & Access Management Architecture 5

Question 1

An architect needs to design identity governance for a large enterprise where managers must periodically confirm that their direct reports still need access to sensitive SharePoint sites. Which feature automates this process?

Accepted Answer

Azure AD Access Reviews targeting group members with manager as reviewer

Answer

Azure AD Access Reviews can be configured to target group membership with the assigned manager as reviewer, automating periodic recertification of access.

Question 2

Which Conditional Access policy configuration enforces that users accessing sensitive data must agree to terms of use and cannot proceed until they do?

Accepted Answer

Grant control requiring users to accept Terms of Use

Answer

Conditional Access grant controls can include a Terms of Use requirement, blocking access until the user explicitly accepts the configured terms document.

Question 3

A security architect is designing identity for a hybrid scenario where some users must authenticate using on-premises AD FS while others use Azure AD cloud authentication. Which Azure AD Connect feature supports routing specific users to different authentication methods?

Accepted Answer

Staged rollout for cloud authentication

Answer

Staged rollout allows gradually migrating users from federated authentication (AD FS) to cloud authentication (PHS or PTA) by targeting specific groups.

Question 4

Which Azure AD feature allows administrators to define which external identity providers (like Google or Facebook) can be used by guest users during the self-service sign-up flow for B2B collaboration?

Accepted Answer

External identities settings with direct federation and social IdP configuration

Answer

Azure AD External Identities allows configuring direct federation with SAML/WS-Fed partners and social identity providers like Google for B2B guest self-service sign-up.

Question 5

An SC-100 architect recommends implementing Microsoft Sentinel UEBA to improve identity threat detection. What does UEBA establish as its baseline for detecting anomalous behavior?

Accepted Answer

Behavioral profiles per user and peer group derived from historical activity

Answer

UEBA (User and Entity Behavior Analytics) builds dynamic behavioral baselines per user and peer group, flagging deviations that may indicate compromise.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Identity & Access Management Architecture 5