SC-100 Identity Management 2 — Questions and Answers
Question 1: A cybersecurity architect needs to ensure that privileged access to Azure resources is time-bound and requires justification. Which Azure AD feature should be implemented?
- Azure AD Privileged Identity Management (PIM) (Correct answer)
- Azure AD Conditional Access
- Azure AD Identity Protection
- Azure AD Access Reviews
Correct answer: Azure AD Privileged Identity Management (PIM)
PIM provides just-in-time privileged access with time-bound activation requiring business justification and approval.
Question 2: An organization wants to detect when a user's credentials have been leaked to the dark web and automatically block sign-ins. Which Azure AD feature addresses this?
- Azure AD Smart Lockout
- Azure AD Identity Protection leaked credentials risk detection (Correct answer)
- Microsoft Defender for Identity
- Azure AD Password Protection
Correct answer: Azure AD Identity Protection leaked credentials risk detection
Azure AD Identity Protection's leaked credentials risk detection identifies credentials exposed in public data breaches and triggers risk-based policies.
Question 3: Which authentication method provides the highest phishing resistance for SC-100 purposes when securing privileged administrator accounts?
- SMS-based one-time passcode
- FIDO2 security keys (Correct answer)
- Microsoft Authenticator push notifications
- Voice call verification
Correct answer: FIDO2 security keys
FIDO2 security keys provide the highest phishing resistance because they use hardware-bound cryptographic credentials tied to the specific site.
Question 4: A company has federated their on-premises Active Directory with Azure AD. They want to block legacy authentication protocols at the identity provider level. What should they configure?
- Azure AD Conditional Access policies
- AD FS claim rules to block legacy authentication (Correct answer)
- Azure AD Password Hash Synchronization
- Azure AD Application Proxy
Correct answer: AD FS claim rules to block legacy authentication
When using AD FS federation, claim rules must be configured on AD FS to block legacy authentication protocols before requests reach Azure AD.
Question 5: An architect is designing identity for a Zero Trust deployment. Which principle should govern how identities access resources in this model?
- Trust all users inside the corporate network perimeter
- Verify explicitly, use least privilege, and assume breach (Correct answer)
- Trust identities that pass multi-factor authentication once per session
- Grant access based on Active Directory group membership only
Correct answer: Verify explicitly, use least privilege, and assume breach
Zero Trust identity design follows three principles: verify explicitly using all available signals, use least-privilege access, and assume breach by segmenting access.
Question 6: Which Azure AD feature enables an organization to require that only compliant, hybrid-joined, or Azure AD-joined devices can access corporate resources?
- Azure AD Identity Protection
- Conditional Access with device compliance grant controls (Correct answer)
- Azure AD Privileged Identity Management
- Microsoft Entra Verified ID
Correct answer: Conditional Access with device compliance grant controls
Conditional Access grant controls can enforce device compliance or require hybrid Azure AD join as conditions for granting resource access.
Question 7: A security architect needs to implement a solution where external partners can access specific Azure resources without creating guest accounts in the corporate Azure AD tenant. What should be recommended?
- Azure AD B2B Collaboration
- Azure AD B2C tenant
- Azure AD External Identities cross-tenant access with trust settings (Correct answer)
- Separate Azure AD tenant for partners
Correct answer: Azure AD External Identities cross-tenant access with trust settings
Cross-tenant access settings allow organizations to trust MFA and device compliance from partner tenants, enabling resource access without creating guest accounts.
SC-100 Identity Management 2
A cybersecurity architect needs to ensure that privileged access to Azure resources is time-bound and requires justification.
Which Azure AD feature should be implemented?