SC-100 Identity Management 5 — Questions and Answers
Question 1: An organization must comply with a regulation requiring that access to sensitive data be reviewed quarterly and revoked if no longer justified. Which Microsoft solution automates this process?
- Azure AD Privileged Identity Management
- Azure AD Access Reviews (Correct answer)
- Microsoft Defender for Cloud Apps governance actions
- Microsoft Purview Data Governance
Correct answer: Azure AD Access Reviews
Azure AD Access Reviews can be scheduled quarterly to require resource owners or managers to certify ongoing access need, with automatic revocation if reviewers do not respond.
Question 2: A cybersecurity architect needs to prevent password spray attacks against Azure AD accounts. Which controls should be prioritized?
- Enable Smart Lockout and block legacy authentication protocols (Correct answer)
- Enforce 90-day password expiration policies
- Require all users to change passwords immediately
- Deploy Microsoft Defender for Endpoint on all devices
Correct answer: Enable Smart Lockout and block legacy authentication protocols
Smart Lockout detects and blocks repeated failed sign-in attempts, while blocking legacy authentication eliminates protocols that bypass MFA and are commonly exploited in spray attacks.
Question 3: An organization has multiple Azure AD tenants and needs consistent identity governance across all tenants. Which feature enables cross-tenant synchronization of user identities?
- Azure AD B2B collaboration guest accounts
- Azure AD Connect cloud sync with multi-tenant support
- Cross-tenant synchronization in Azure AD External Identities (Correct answer)
- Azure Lighthouse with identity delegation
Correct answer: Cross-tenant synchronization in Azure AD External Identities
Cross-tenant synchronization automatically provisions and manages user identities across organizational Azure AD tenants, keeping attributes in sync bidirectionally.
Question 4: When an application uses the OAuth 2.0 On-Behalf-Of (OBO) flow, what security consideration must the SC-100 architect address?
- OBO tokens have unlimited lifetime and must be manually revoked
- The middle-tier service acquires tokens with the user's delegated permissions, so the API must validate scopes carefully to prevent privilege escalation (Correct answer)
- OBO flow requires service accounts instead of user identities
- OBO tokens bypass Conditional Access policies
Correct answer: The middle-tier service acquires tokens with the user's delegated permissions, so the API must validate scopes carefully to prevent privilege escalation
In OBO flow, a middle-tier API acquires tokens acting on behalf of the user, so the downstream API must validate that only appropriate delegated scopes are present to prevent escalation.
Question 5: A company wants to ensure that Azure AD guest users from external organizations are subject to the same MFA requirements as internal users. What is the correct approach?
- Require guests to register MFA in the resource tenant
- Configure inbound cross-tenant access trust settings to accept MFA claims from the partner tenant (Correct answer)
- Use Azure AD B2C to manage guest authentication
- Apply Conditional Access MFA requirements to the guest users directly
Correct answer: Configure inbound cross-tenant access trust settings to accept MFA claims from the partner tenant
Configuring inbound cross-tenant trust to accept MFA from partner tenants avoids double-MFA prompts while ensuring guests have completed MFA in their home tenant.
Question 6: Which Azure AD Identity Protection risk policy should an architect configure to require immediate password change when high user risk is detected?
- Sign-in risk policy requiring MFA for high-risk sign-ins
- User risk policy requiring password change for high user risk (Correct answer)
- Conditional Access policy blocking all high-risk users
- PIM alert policy for privileged account risk
Correct answer: User risk policy requiring password change for high user risk
The user risk policy in Identity Protection can require a secure password change (via SSPR) when a user's cumulative risk level reaches the high threshold, remediating the detected compromise.
Question 7: An architect is designing identity for an application that needs to access multiple Azure AD-protected APIs without user interaction. Which OAuth 2.0 grant type is appropriate and what permission type must be used?
- Authorization Code flow with delegated permissions
- Client Credentials flow with application permissions (Correct answer)
- Device Code flow with delegated permissions
- On-Behalf-Of flow with application permissions
Correct answer: Client Credentials flow with application permissions
Daemon applications use the Client Credentials flow with application permissions (not delegated) because there is no user context — the app acts as itself with admin-granted permissions.
SC-100 Identity Management 5
An organization must comply with a regulation requiring that access to sensitive data be reviewed quarterly and revoked if no longer justified.
Which Microsoft solution automates this process?