SC-300 Entitlement Management and Access Reviews 2 — Questions and Answers
Question 1: In an Access Review configured for group members, who can be designated as reviewers?
- Only Global Administrators
- Group owners, selected reviewers, members themselves, or managers of members (Correct answer)
- Only the Identity Governance Administrator
- Only Microsoft Support
Correct answer: Group owners, selected reviewers, members themselves, or managers of members
Access reviews support multiple reviewer types including the resource owner, designated individuals, the users themselves for self-review, or the user's manager.
Question 2: What action does 'Apply results' perform at the end of an Access Review?
- It generates a PDF report of review decisions
- It implements the decisions made during the review by adding or removing access (Correct answer)
- It resets all decisions back to 'Not reviewed'
- It sends an email summary to the Global Administrator
Correct answer: It implements the decisions made during the review by adding or removing access
When access review results are applied (manually or automatically), Azure AD acts on the reviewers' decisions by removing access for denied users or retaining it for approved users.
Question 3: Which Access Review setting automatically removes access for users whose reviewers do not respond by the review deadline?
- Auto apply results: Approve access
- If reviewers don't respond: Remove access (Correct answer)
- Access duration: No expiration
- Notify reviewers: Enabled
Correct answer: If reviewers don't respond: Remove access
Setting 'If reviewers don't respond' to 'Remove access' ensures that non-responses are treated as denials, automatically removing access from users not explicitly approved.
Question 4: A company runs quarterly access reviews on all privileged directory roles. Which Azure AD feature is being used?
- PIM access reviews (Correct answer)
- Entitlement management access packages
- Conditional Access policies
- Identity Protection user risk policies
Correct answer: PIM access reviews
PIM includes built-in access review capabilities that allow periodic recertification of privileged directory role assignments to ensure least privilege is maintained.
Question 5: What does the 'Recommendations' feature in Access Reviews do?
- It automatically approves all active users without reviewer input
- It provides reviewers with data-driven approve or deny suggestions based on user sign-in activity (Correct answer)
- It generates a risk score for each user being reviewed
- It creates a Conditional Access policy based on review results
Correct answer: It provides reviewers with data-driven approve or deny suggestions based on user sign-in activity
The recommendations feature displays a suggested decision to reviewers based on signals such as whether the user has signed in recently, helping reviewers make informed decisions more efficiently.
Question 6: Which entitlement management setting allows a user to request renewal of their access package assignment before it expires?
- Require approval for renewal
- Allow renewal: Enabled (Correct answer)
- Assignment duration: Permanent
- Enable access reviews on the policy
Correct answer: Allow renewal: Enabled
Enabling the renewal option in an access package policy allows users to submit a renewal request before their assignment expires, subject to the same or separate approval workflow.
SC-300 Entitlement Management and Access Reviews 2
In an Access Review configured for group members, who can be designated as reviewers?