SC-900 Microsoft Identity & Access Management 4 — Questions and Answers
Question 1: What is Azure AD Entitlement Management used for?
- Detecting risky sign-in attempts
- Automating identity governance by managing access packages for users to request (Correct answer)
- Syncing identities from on-premises AD
- Configuring MFA registration policies
Correct answer: Automating identity governance by managing access packages for users to request
Entitlement Management lets organizations define access packages (bundles of resources) that users can request and managers can approve.
Question 2: Which statement about Azure AD B2B collaboration is correct?
- B2B requires guest users to create a new Microsoft account
- B2B allows external partners to use their own credentials to access your organization's resources (Correct answer)
- B2B is only for consumer applications
- B2B replaces Azure AD Connect for hybrid identity
Correct answer: B2B allows external partners to use their own credentials to access your organization's resources
Azure AD B2B lets external users authenticate with their own identity provider while accessing your organization's apps and data.
Question 3: What is the role of a 'Global Administrator' in Azure AD?
- Manages only Azure subscription billing
- Has full access to all Azure AD administrative features and can manage all aspects of the tenant (Correct answer)
- Can only reset passwords for non-admin users
- Manages only Azure resource groups
Correct answer: Has full access to all Azure AD administrative features and can manage all aspects of the tenant
Global Administrators have the highest-privilege role in Azure AD with full control over all tenant administrative functions.
Question 4: How does Azure AD Connect help organizations with hybrid identity?
- It replaces on-premises Active Directory entirely
- It synchronizes on-premises AD user accounts and groups to Azure AD (Correct answer)
- It provides MFA for on-premises applications
- It creates service principals for cloud apps
Correct answer: It synchronizes on-premises AD user accounts and groups to Azure AD
Azure AD Connect syncs on-premises AD objects (users, groups, passwords) to Azure AD, enabling hybrid identity scenarios.
Question 5: What is 'Password Hash Synchronization' (PHS) in Azure AD Connect?
- Syncing plain-text passwords to Azure AD
- Syncing a hashed representation of on-premises passwords to Azure AD for cloud authentication (Correct answer)
- Forcing users to change passwords every 30 days
- Generating temporary passwords for guest users
Correct answer: Syncing a hashed representation of on-premises passwords to Azure AD for cloud authentication
PHS syncs a hash of the on-premises password hash to Azure AD, enabling users to authenticate to cloud services with their on-premises credentials.
Question 6: Which Azure AD feature provides a risk score for each user based on their identity behavior over time?
- Conditional Access sign-in risk
- Identity Protection user risk (Correct answer)
- Access Reviews
- PIM role activation risk
Correct answer: Identity Protection user risk
User risk in Identity Protection is a cumulative score reflecting the likelihood that a user's account has been compromised based on detected anomalies.
Question 7: What is the purpose of 'Administrative Units' in Azure AD?
- Creating billing segments in Azure subscriptions
- Scoping admin permissions to a subset of users or groups within the tenant (Correct answer)
- Managing Azure resource groups
- Defining Conditional Access policy scope
Correct answer: Scoping admin permissions to a subset of users or groups within the tenant
Administrative Units let you delegate admin roles (like Password Administrator) to manage only a specific set of users or groups.
SC-900 Microsoft Identity & Access Management 4
What is Azure AD Entitlement Management used for?