SC-100 Identity Management 3 — Questions and Answers
Question 1: An organization must ensure that service principals used by Azure workloads cannot have their credentials stolen. Which identity type eliminates credential management entirely?
- Service principal with client secret
- Service principal with certificate
- Managed identity (Correct answer)
- Azure AD application with federated credentials
Correct answer: Managed identity
Managed identities eliminate credential management by having Azure automatically handle credential rotation, with no secret or certificate accessible to developers.
Question 2: A cybersecurity architect reviews an application that uses client secrets for Azure AD authentication. The secrets expire every 2 years. What is the PRIMARY security risk of this approach?
- Client secrets cannot be rotated
- Secrets may be exposed in code repositories or logs and are long-lived credentials (Correct answer)
- Client secrets do not support multi-tenant applications
- Azure AD limits the number of client secrets per application
Correct answer: Secrets may be exposed in code repositories or logs and are long-lived credentials
Long-lived client secrets pose a risk because developers often embed them in code or configuration files where they can be accidentally exposed in repositories or logs.
Question 3: When designing Azure AD Conditional Access for an organization, which signal should be used to differentiate risk levels between known corporate locations and unknown locations?
- Device platform condition
- Named locations and IP ranges as a Conditional Access condition (Correct answer)
- User risk level only
- Application sensitivity classification
Correct answer: Named locations and IP ranges as a Conditional Access condition
Named locations allow organizations to define trusted IP ranges and can be used as Conditional Access conditions to apply stricter controls for sign-ins from unknown locations.
Question 4: An SC-100 candidate must recommend a solution for detecting lateral movement attacks targeting on-premises Active Directory. Which Microsoft solution is purpose-built for this scenario?
- Azure AD Identity Protection
- Microsoft Defender for Identity (Correct answer)
- Microsoft Sentinel with Azure AD data connector
- Microsoft Defender for Cloud Apps
Correct answer: Microsoft Defender for Identity
Microsoft Defender for Identity monitors on-premises Active Directory traffic to detect lateral movement, pass-the-hash, and other AD-targeted attack patterns.
Question 5: An organization wants to allow users to reset their own passwords without help desk involvement while ensuring compromised passwords cannot be reused. Which combination of features satisfies this?
- Self-Service Password Reset with Azure AD Password Protection (Correct answer)
- PIM with Access Reviews
- Identity Protection with risk-based Conditional Access
- Azure AD B2C with custom policies
Correct answer: Self-Service Password Reset with Azure AD Password Protection
SSPR allows users to reset passwords independently, while Azure AD Password Protection enforces a banned password list including Microsoft's global banned password list.
Question 6: What is the purpose of Azure AD Entitlement Management in an identity governance strategy?
- Detecting risky sign-ins and user behaviors
- Automating access package lifecycle including request, approval, and expiration for internal and external users (Correct answer)
- Providing just-in-time activation for privileged roles
- Monitoring service principal activity in Azure subscriptions
Correct answer: Automating access package lifecycle including request, approval, and expiration for internal and external users
Entitlement Management automates access lifecycle for groups, apps, and SharePoint sites through access packages with defined approval workflows and time-limited assignments.
Question 7: An organization implements Windows Hello for Business as the primary authentication method. What type of credential does this create?
- A symmetric key stored in the cloud
- A hardware-bound asymmetric key pair protected by a PIN or biometric (Correct answer)
- A one-time password synchronized with Azure AD
- A certificate stored in the user's profile
Correct answer: A hardware-bound asymmetric key pair protected by a PIN or biometric
Windows Hello for Business creates a hardware-bound asymmetric key pair where the private key never leaves the device's TPM, providing phishing-resistant authentication.
SC-100 Identity Management 3
An organization must ensure that service principals used by Azure workloads cannot have their credentials stolen.
Which identity type eliminates credential management entirely?