SC-100 Identity Management 2

Question 1

A cybersecurity architect needs to ensure that privileged access to Azure resources is time-bound and requires justification. Which Azure AD feature should be implemented?

Accepted Answer

Azure AD Privileged Identity Management (PIM)

Answer

PIM provides just-in-time privileged access with time-bound activation requiring business justification and approval.

Question 2

An organization wants to detect when a user's credentials have been leaked to the dark web and automatically block sign-ins. Which Azure AD feature addresses this?

Accepted Answer

Azure AD Identity Protection leaked credentials risk detection

Answer

Azure AD Identity Protection's leaked credentials risk detection identifies credentials exposed in public data breaches and triggers risk-based policies.

Question 3

Which authentication method provides the highest phishing resistance for SC-100 purposes when securing privileged administrator accounts?

Accepted Answer

FIDO2 security keys

Answer

FIDO2 security keys provide the highest phishing resistance because they use hardware-bound cryptographic credentials tied to the specific site.

Question 4

A company has federated their on-premises Active Directory with Azure AD. They want to block legacy authentication protocols at the identity provider level. What should they configure?

Accepted Answer

AD FS claim rules to block legacy authentication

Answer

When using AD FS federation, claim rules must be configured on AD FS to block legacy authentication protocols before requests reach Azure AD.

Question 5

An architect is designing identity for a Zero Trust deployment. Which principle should govern how identities access resources in this model?

Accepted Answer

Verify explicitly, use least privilege, and assume breach

Answer

Zero Trust identity design follows three principles: verify explicitly using all available signals, use least-privilege access, and assume breach by segmenting access.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Identity Management 2