SC-900 Microsoft Identity & Access Management 2 — Questions and Answers
Question 1: Which Azure AD feature allows users to reset their own passwords without contacting IT support?
- Self-Service Password Reset (SSPR) (Correct answer)
- Privileged Identity Management (PIM)
- Conditional Access
- Identity Protection
Correct answer: Self-Service Password Reset (SSPR)
SSPR lets users reset or unlock their passwords without IT helpdesk involvement, reducing support costs.
Question 2: What is the primary purpose of Azure AD Privileged Identity Management (PIM)?
- Manage guest user access
- Provide just-in-time privileged access to reduce standing permissions (Correct answer)
- Sync on-premises Active Directory to Azure AD
- Monitor user sign-in activity
Correct answer: Provide just-in-time privileged access to reduce standing permissions
PIM provides just-in-time (JIT) privileged access so admin roles are only active when needed, reducing attack surface.
Question 3: Which identity type in Azure AD represents an application that needs to authenticate to access Azure resources?
- Guest user
- Service principal (Correct answer)
- Managed identity
- B2C user
Correct answer: Service principal
A service principal is the identity representation of an application in Azure AD, used for app-to-resource authentication.
Question 4: What does Azure AD External Identities B2C primarily enable?
- Federating with partner organizations via SAML
- Allowing customers to sign in to consumer-facing apps using social or local accounts (Correct answer)
- Syncing on-premises users to the cloud
- Enforcing MFA for employees
Correct answer: Allowing customers to sign in to consumer-facing apps using social or local accounts
Azure AD B2C is a customer identity solution that lets end users authenticate with social providers or custom accounts.
Question 5: Which Azure AD feature automatically detects and remediates risky sign-ins using machine learning?
- Conditional Access
- Identity Protection (Correct answer)
- PIM
- Access Reviews
Correct answer: Identity Protection
Azure AD Identity Protection uses ML to detect anomalous sign-ins and can automatically block or require MFA for risky logins.
Question 6: What is the difference between authentication and authorization in identity management?
- Authentication grants permissions; authorization verifies identity
- Authentication verifies who you are; authorization determines what you can access (Correct answer)
- They are the same process in Azure AD
- Authorization happens before authentication
Correct answer: Authentication verifies who you are; authorization determines what you can access
Authentication (AuthN) confirms identity, while authorization (AuthZ) determines what resources that identity can access.
Question 7: Which protocol does Azure AD use for modern token-based authorization between applications?
- Kerberos
- NTLM
- OAuth 2.0 (Correct answer)
- LDAP
Correct answer: OAuth 2.0
OAuth 2.0 is the industry-standard authorization protocol used by Azure AD for delegating access between apps and APIs.
SC-900 Microsoft Identity & Access Management 2
Which Azure AD feature allows users to reset their own passwords without contacting IT support?