SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 2

Question 1

Which Azure AD feature automatically blocks or challenges sign-ins that are flagged as risky based on machine learning analysis?

Accepted Answer

Azure AD Identity Protection risk-based Conditional Access

Answer

Azure AD Identity Protection integrates with Conditional Access to automatically enforce policies (block, MFA, or password reset) when sign-in or user risk levels exceed configured thresholds.

Question 2

What is the purpose of Privileged Identity Management (PIM) 'justification' when activating a role?

Accepted Answer

It records the business reason for the temporary role activation for audit purposes

Answer

PIM requires users to provide a justification (business reason) when activating a privileged role, creating an auditable record of why elevated access was needed.

Question 3

An organization wants to ensure users periodically confirm they still need access to a sensitive SharePoint site. Which Azure AD feature should they use?

Accepted Answer

Access Reviews

Answer

Azure AD Access Reviews allow administrators to schedule periodic reviews where resource owners or users themselves certify ongoing need for access, and automatically remove access if not confirmed.

Question 4

Which identity governance feature in Azure AD allows organizations to define packages of access to multiple resources that users can request?

Accepted Answer

Entitlement Management

Answer

Entitlement Management lets administrators bundle access to groups, apps, and SharePoint sites into 'access packages' that users can self-request through an approval workflow.

Question 5

What does a 'sign-in risk' level of 'High' in Azure AD Identity Protection indicate?

Accepted Answer

Microsoft's ML models are highly confident the sign-in is not from the legitimate account owner

Answer

A High sign-in risk means Identity Protection's machine learning has high confidence that the authentication attempt is fraudulent or compromised, such as impossible travel or known malicious IP.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 2