SC-100 Identity Management 3

Question 1

An organization must ensure that service principals used by Azure workloads cannot have their credentials stolen. Which identity type eliminates credential management entirely?

Accepted Answer

Managed identity

Answer

Managed identities eliminate credential management by having Azure automatically handle credential rotation, with no secret or certificate accessible to developers.

Question 2

A cybersecurity architect reviews an application that uses client secrets for Azure AD authentication. The secrets expire every 2 years. What is the PRIMARY security risk of this approach?

Accepted Answer

Secrets may be exposed in code repositories or logs and are long-lived credentials

Answer

Long-lived client secrets pose a risk because developers often embed them in code or configuration files where they can be accidentally exposed in repositories or logs.

Question 3

When designing Azure AD Conditional Access for an organization, which signal should be used to differentiate risk levels between known corporate locations and unknown locations?

Accepted Answer

Named locations and IP ranges as a Conditional Access condition

Answer

Named locations allow organizations to define trusted IP ranges and can be used as Conditional Access conditions to apply stricter controls for sign-ins from unknown locations.

Question 4

An SC-100 candidate must recommend a solution for detecting lateral movement attacks targeting on-premises Active Directory. Which Microsoft solution is purpose-built for this scenario?

Accepted Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Identity monitors on-premises Active Directory traffic to detect lateral movement, pass-the-hash, and other AD-targeted attack patterns.

Question 5

An organization wants to allow users to reset their own passwords without help desk involvement while ensuring compromised passwords cannot be reused. Which combination of features satisfies this?

Accepted Answer

Self-Service Password Reset with Azure AD Password Protection

Answer

SSPR allows users to reset passwords independently, while Azure AD Password Protection enforces a banned password list including Microsoft's global banned password list.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Identity Management 3