SC-100 Identity Management 4 — Questions and Answers
Question 1: A company uses Azure AD and wants to enforce that any application requesting access to Microsoft Graph must be pre-approved by an administrator rather than consented to by users. How should this be configured?
- Disable user consent for all applications and require admin consent workflow (Correct answer)
- Configure Conditional Access for application consent
- Use PIM to gate API permissions
- Set application access policies in Exchange Online
Correct answer: Disable user consent for all applications and require admin consent workflow
Disabling user consent and enabling the admin consent workflow ensures all OAuth permission grants are reviewed and approved by administrators before users can access applications.
Question 2: An architect is evaluating whether to use Azure AD Password Hash Synchronization (PHS) or Pass-through Authentication (PTA). Which statement correctly represents a security trade-off?
- PHS requires on-premises agents that process each authentication, increasing attack surface
- PTA stores password hashes in Azure AD, creating cloud-side exposure risk
- PHS enables cloud-based Identity Protection risk detections including leaked credential checks (Correct answer)
- PTA provides better MFA enforcement than PHS
Correct answer: PHS enables cloud-based Identity Protection risk detections including leaked credential checks
PHS sends hashed password data to Azure AD, enabling cloud-side features like leaked credential detection in Identity Protection, which PTA cannot support without cloud hashes.
Question 3: During an SC-100 design review, an architect proposes using Azure AD groups to control access to sensitive financial applications. Which additional control should be recommended to meet least-privilege requirements?
- Replace all groups with individual user assignments
- Implement Azure AD Access Reviews to periodically validate group memberships (Correct answer)
- Switch to application-level RBAC only
- Require PIM activation for every group membership
Correct answer: Implement Azure AD Access Reviews to periodically validate group memberships
Access Reviews periodically validate whether users still need their group memberships, removing stale access that accumulates over time and violates least privilege.
Question 4: Which Azure AD feature allows an organization to verify the authenticity of credentials presented by external partners using decentralized identity standards?
- Azure AD B2B collaboration
- Microsoft Entra Verified ID (Correct answer)
- Azure AD External Identities
- Federated identity with WS-Federation
Correct answer: Microsoft Entra Verified ID
Microsoft Entra Verified ID implements W3C Verifiable Credentials standards, allowing organizations to issue and verify tamper-proof credential claims from partners.
Question 5: An organization needs to ensure that Azure AD service principals used in CI/CD pipelines authenticate to Azure without using secrets or certificates. Which modern approach should be recommended?
- Store certificates in Azure Key Vault and retrieve at runtime
- Use workload identity federation with federated credentials (Correct answer)
- Use managed identities assigned to the pipeline runner VMs
- Rotate client secrets automatically using Azure Automation
Correct answer: Use workload identity federation with federated credentials
Workload identity federation lets CI/CD systems (GitHub Actions, GitLab, etc.) authenticate to Azure AD using tokens from their own OIDC provider without any Azure-side secrets.
Question 6: A security architect must recommend controls to reduce the impact of a compromised global administrator account in Azure AD. Which combination is most effective?
- Require MFA and use Privileged Access Workstations (PAWs) for admin tasks (Correct answer)
- Enable audit logging for the admin account
- Move the account to a resource management group
- Configure Identity Protection sign-in risk policy for the account
Correct answer: Require MFA and use Privileged Access Workstations (PAWs) for admin tasks
Combining MFA with dedicated Privileged Access Workstations reduces attack surface by requiring a second factor and isolating admin activities to hardened devices.
Question 7: What is the key security benefit of implementing Azure AD Conditional Access in report-only mode before enforcing policies?
- It trains users to accept new authentication prompts
- It allows architects to evaluate policy impact and identify users who would be blocked before enforcement (Correct answer)
- It permanently logs all access decisions for compliance purposes
- It enables automatic policy rollback if issues are detected
Correct answer: It allows architects to evaluate policy impact and identify users who would be blocked before enforcement
Report-only mode evaluates Conditional Access policies against real sign-ins and logs what would happen without actually enforcing the policy, allowing safe impact assessment.
SC-100 Identity Management 4
A company uses Azure AD and wants to enforce that any application requesting access to Microsoft Graph must be pre-approved by an administrator rather than consented to by users.
How should this be configured?