SC-100 Identity Management 4

Question 1

A company uses Azure AD and wants to enforce that any application requesting access to Microsoft Graph must be pre-approved by an administrator rather than consented to by users. How should this be configured?

Accepted Answer

Disable user consent for all applications and require admin consent workflow

Answer

Disabling user consent and enabling the admin consent workflow ensures all OAuth permission grants are reviewed and approved by administrators before users can access applications.

Question 2

An architect is evaluating whether to use Azure AD Password Hash Synchronization (PHS) or Pass-through Authentication (PTA). Which statement correctly represents a security trade-off?

Accepted Answer

PHS enables cloud-based Identity Protection risk detections including leaked credential checks

Answer

PHS sends hashed password data to Azure AD, enabling cloud-side features like leaked credential detection in Identity Protection, which PTA cannot support without cloud hashes.

Question 3

During an SC-100 design review, an architect proposes using Azure AD groups to control access to sensitive financial applications. Which additional control should be recommended to meet least-privilege requirements?

Accepted Answer

Implement Azure AD Access Reviews to periodically validate group memberships

Answer

Access Reviews periodically validate whether users still need their group memberships, removing stale access that accumulates over time and violates least privilege.

Question 4

Which Azure AD feature allows an organization to verify the authenticity of credentials presented by external partners using decentralized identity standards?

Accepted Answer

Microsoft Entra Verified ID

Answer

Microsoft Entra Verified ID implements W3C Verifiable Credentials standards, allowing organizations to issue and verify tamper-proof credential claims from partners.

Question 5

An organization needs to ensure that Azure AD service principals used in CI/CD pipelines authenticate to Azure without using secrets or certificates. Which modern approach should be recommended?

Accepted Answer

Use workload identity federation with federated credentials

Answer

Workload identity federation lets CI/CD systems (GitHub Actions, GitLab, etc.) authenticate to Azure AD using tokens from their own OIDC provider without any Azure-side secrets.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Identity Management 4