SC-900 Microsoft Identity & Access Management 5

Question 1

What does SSPR 'writeback' enable in a hybrid Azure AD environment?

Accepted Answer

Allowing password changes made in Azure AD to sync back to on-premises Active Directory

Answer

Password writeback ensures that when a user resets their password in Azure AD, the change is also applied to their on-premises AD account.

Question 2

Which authentication method in Azure AD is considered the most phishing-resistant?

Accepted Answer

FIDO2 security keys

Answer

FIDO2 security keys use public-key cryptography bound to the specific site, making them immune to phishing attacks.

Question 3

In Azure AD, what is a 'sign-in risk policy' within Identity Protection?

Accepted Answer

A Conditional Access policy that triggers additional verification when a sign-in is detected as risky

Answer

Sign-in risk policies evaluate the risk of each authentication attempt and can require MFA or block access based on the detected risk level.

Question 4

What is 'Pass-through Authentication' (PTA) in Azure AD Connect, and how does it differ from PHS?

Accepted Answer

PTA validates passwords against on-premises AD in real time; PHS syncs password hashes to the cloud

Answer

PTA agents on-premises validate each user's password directly against on-premises AD at sign-in time, without storing any password data in Azure AD.

Question 5

Which Azure AD feature allows an organization to define and enforce terms of use that users must accept before accessing resources?

Accepted Answer

Conditional Access — Terms of Use

Answer

Conditional Access can include a Terms of Use policy that requires users to read and accept legal terms before gaining access.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test