SC-900 Microsoft Identity & Access Management 5 — Questions and Answers
Question 1: What does SSPR 'writeback' enable in a hybrid Azure AD environment?
- Writing new users from Azure AD back to on-premises AD
- Allowing password changes made in Azure AD to sync back to on-premises Active Directory (Correct answer)
- Enabling on-premises apps to authenticate via Azure AD
- Writing audit logs from Azure AD to on-premises SIEM
Correct answer: Allowing password changes made in Azure AD to sync back to on-premises Active Directory
Password writeback ensures that when a user resets their password in Azure AD, the change is also applied to their on-premises AD account.
Question 2: Which authentication method in Azure AD is considered the most phishing-resistant?
- SMS one-time passcode
- Email verification code
- FIDO2 security keys (Correct answer)
- Authenticator app push notification
Correct answer: FIDO2 security keys
FIDO2 security keys use public-key cryptography bound to the specific site, making them immune to phishing attacks.
Question 3: In Azure AD, what is a 'sign-in risk policy' within Identity Protection?
- A policy that blocks all sign-ins outside business hours
- A Conditional Access policy that triggers additional verification when a sign-in is detected as risky (Correct answer)
- A policy that enforces password complexity
- A policy that limits the number of daily sign-ins
Correct answer: A Conditional Access policy that triggers additional verification when a sign-in is detected as risky
Sign-in risk policies evaluate the risk of each authentication attempt and can require MFA or block access based on the detected risk level.
Question 4: What is 'Pass-through Authentication' (PTA) in Azure AD Connect, and how does it differ from PHS?
- PTA caches credentials in Azure; PHS validates them on-premises
- PTA validates passwords against on-premises AD in real time; PHS syncs password hashes to the cloud (Correct answer)
- PTA and PHS are identical in function
- PTA is used for guest users; PHS is for employees
Correct answer: PTA validates passwords against on-premises AD in real time; PHS syncs password hashes to the cloud
PTA agents on-premises validate each user's password directly against on-premises AD at sign-in time, without storing any password data in Azure AD.
Question 5: Which Azure AD feature allows an organization to define and enforce terms of use that users must accept before accessing resources?
- Identity Protection
- Conditional Access — Terms of Use (Correct answer)
- Entitlement Management
- Access Reviews
Correct answer: Conditional Access — Terms of Use
Conditional Access can include a Terms of Use policy that requires users to read and accept legal terms before gaining access.
Question 6: What is the 'principle of least privilege' as it applies to Azure AD role assignments?
- Assigning all users the Global Administrator role for flexibility
- Giving users only the minimum permissions necessary to perform their job functions (Correct answer)
- Requiring all role assignments to be permanent
- Limiting MFA to privileged accounts only
Correct answer: Giving users only the minimum permissions necessary to perform their job functions
Least privilege means users receive only the specific permissions they need, reducing the potential damage from compromised accounts.
Question 7: Which capability does Azure AD Multi-Tenant Organization (MTO) provide?
- Merging multiple Azure subscriptions into a single billing account
- Enabling seamless collaboration between multiple Azure AD tenants within the same organization (Correct answer)
- Allowing consumer users to access enterprise apps
- Replacing Azure AD B2B for partner collaboration
Correct answer: Enabling seamless collaboration between multiple Azure AD tenants within the same organization
Multi-Tenant Organization allows companies with multiple Azure AD tenants (e.g., after mergers) to enable seamless cross-tenant access and collaboration.
SC-900 Microsoft Identity & Access Management 5
What does SSPR 'writeback' enable in a hybrid Azure AD environment?