Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management Flashcards

A company wants to implement a solution that ensures users only have access to resources for a limited time and that their access is reviewed periodically by their managers. Which Microsoft Entra feature is MOST suitable for this requirement?

Answer: Access reviews

Access reviews in Microsoft Entra ID Governance enable organizations to manage access to resources by scheduling regular reviews, delegating reviews to appropriate personnel like managers, and automating the removal of access for users who no longer need it. This directly addresses the company's need for periodic recertification of user access.

An administrator is configuring a Microsoft Entra Conditional Access policy. The policy should require multi-factor authentication (MFA) ONLY when a user signs in from a location that is not on the corporate network. Which two components must be configured in the policy?

Answer: Conditions (Locations) & Access controls (Grant)

A Conditional Access policy is an if-then statement. The 'if' part is the 'Conditions,' and the 'then' part is the 'Access controls.' To trigger the policy based on the user's network location, the 'Locations' condition must be configured. To enforce MFA, the 'Grant' access control must be set to 'Require multifactor authentication.'

Which of the following is a primary function of Microsoft Entra ID Governance?

Answer: To manage the identity and access lifecycle for users.

Microsoft Entra ID Governance is designed to help organizations manage the entire identity and access lifecycle. This includes automating access requests, assignments, reviews, and expiration to ensure that the right people have the right access at the right time.

A company is concerned about 'permission creep,' where users accumulate more access rights than they need over time. They want a solution that provides visibility into the gap between granted permissions and used permissions across their multi-cloud environment. Which Microsoft Entra solution addresses this specific need?

Answer: Microsoft Entra Permissions Management

Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides comprehensive visibility into permissions across multi-cloud environments. It is specifically designed to identify the gap between permissions granted and permissions used, helping to enforce the principle of least privilege and remediate excessive permissions.

A user with a global administrator role in Microsoft Entra ID needs to perform a highly sensitive task. To minimize the security risk, access to this role should only be granted for a few hours and require an approval workflow. Which Microsoft Entra feature should be used to achieve this?

Answer: Privileged Identity Management (PIM)

Microsoft Entra Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate the risks associated with excessive or unnecessary privileged access. It allows for 'just-in-time' (JIT) access to administrative roles, requiring users to activate their role, often with an approval step, for a limited duration.

What is the primary purpose of defining assignments within a Microsoft Entra Conditional Access policy?

Answer: To define the scope of the policy, such as which users, groups, and applications it applies to.

The 'Assignments' section of a Conditional Access policy defines the scope of the policy. It specifies the 'if' conditions, such as the users, groups, cloud apps, or actions that will trigger the policy evaluation.