SC-900 Microsoft Identity & Access Management 3 — Questions and Answers
Question 1: What is a 'managed identity' in Azure and how does it differ from a service principal?
- A managed identity requires manual credential rotation; a service principal does not
- A managed identity has its credentials automatically managed by Azure, eliminating the need to store secrets (Correct answer)
- A managed identity is used for user accounts; a service principal is for apps
- There is no difference between them
Correct answer: A managed identity has its credentials automatically managed by Azure, eliminating the need to store secrets
Managed identities have credentials automatically maintained by Azure, so developers never need to handle or rotate secrets.
Question 2: In Azure AD Conditional Access, what is a 'named location'?
- A trusted IP range or country used as a condition in access policies (Correct answer)
- A physical office address stored in the user profile
- A nickname for a Conditional Access policy
- An Azure region for resource deployment
Correct answer: A trusted IP range or country used as a condition in access policies
Named locations define trusted IP ranges or countries/regions that can be referenced as conditions in Conditional Access policies.
Question 3: Which Azure AD license tier is required to use Conditional Access policies?
- Azure AD Free
- Microsoft 365 Business Basic
- Azure AD Premium P1 or P2 (Correct answer)
- Azure AD External Identities
Correct answer: Azure AD Premium P1 or P2
Conditional Access is a premium feature requiring Azure AD Premium P1 (or P2 for risk-based policies).
Question 4: What is 'federation' in the context of Azure AD identity management?
- Combining multiple Azure subscriptions into one
- Establishing trust between Azure AD and another identity provider so users authenticate at their home directory (Correct answer)
- Replicating Azure AD to multiple regions
- Assigning multiple roles to a single user
Correct answer: Establishing trust between Azure AD and another identity provider so users authenticate at their home directory
Federation creates a trust relationship so users can authenticate with their own identity provider and access federated resources.
Question 5: Azure AD Access Reviews are primarily used to:
- Audit sign-in logs for suspicious activity
- Periodically verify that users still need their current group memberships or role assignments (Correct answer)
- Review application permission scopes
- Monitor Conditional Access policy effectiveness
Correct answer: Periodically verify that users still need their current group memberships or role assignments
Access Reviews enable periodic recertification of user access to ensure only appropriate users retain group/role memberships.
Question 6: What is the Zero Trust principle of 'assume breach'?
- Granting broad access to maximize productivity
- Designing systems as if attackers are already inside, minimizing blast radius and segmenting access (Correct answer)
- Requiring all users to use VPN
- Disabling all external access to corporate resources
Correct answer: Designing systems as if attackers are already inside, minimizing blast radius and segmenting access
Assume breach means designing security so that even if an attacker gains entry, lateral movement and damage are contained.
Question 7: Which feature of Azure AD allows you to group users dynamically based on attributes like department or job title?
- Role-Based Access Control (RBAC)
- Dynamic groups (Correct answer)
- Administrative units
- Entitlement management
Correct answer: Dynamic groups
Dynamic groups in Azure AD automatically add or remove members based on user attribute rules, eliminating manual membership management.
SC-900 Microsoft Identity & Access Management 3
What is a 'managed identity' in Azure and how does it differ from a service principal?