SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 3 — Questions and Answers
Question 1: What is the difference between 'eligible' and 'active' role assignments in Azure AD Privileged Identity Management?
- Eligible means the user can activate the role when needed; active means the role is always on (Correct answer)
- Eligible roles are permanent and active roles expire after 8 hours
- Eligible assignments require no MFA while active assignments require MFA
- Active assignments are for global admins only while eligible are for regular users
Correct answer: Eligible means the user can activate the role when needed; active means the role is always on
In PIM, eligible assignments grant the right to activate a privileged role on demand (just-in-time), while active assignments mean the user continuously holds the role without needing to activate it.
Question 2: Which Azure AD Identity Protection detection identifies when a user signs in from two geographically distant locations within an impossible travel timeframe?
- Impossible travel (Correct answer)
- Anonymous IP address
- Malware-linked IP address
- Unfamiliar sign-in properties
Correct answer: Impossible travel
The 'Impossible travel' risk detection flags sign-ins from two locations that could not be reached within the time between the two sign-ins, indicating credential compromise.
Question 3: What is the primary benefit of using Azure AD External Identities (B2B) over creating separate local accounts for partners?
- Partners authenticate with their own organizational credentials, reducing password management overhead for both parties (Correct answer)
- Partners get higher privilege levels than internal users
- B2B accounts bypass Conditional Access policies
- External partners can manage your Azure AD tenant settings
Correct answer: Partners authenticate with their own organizational credentials, reducing password management overhead for both parties
B2B allows external partners to use their existing identity (work, school, or social account), so your organization doesn't need to create and manage separate credentials for them.
Question 4: An administrator wants to require approval before a user can activate the Security Administrator role in PIM. Where is this configured?
- In the PIM role settings for Security Administrator (Correct answer)
- In the Azure AD Conditional Access policies
- In the Microsoft 365 admin center security tab
- In the user's profile properties
Correct answer: In the PIM role settings for Security Administrator
PIM role settings allow administrators to require approvers, set activation duration, mandate MFA, and require justification — all configured per role in the PIM blade.
Question 5: What happens to a user's access when an Access Review concludes and the reviewer chose 'auto-apply results'?
- Users whose access was denied by reviewers automatically have that access removed (Correct answer)
- All users in the review are permanently blocked from the resource
- The access review results are sent as a report but no changes are made
- Users receive an email to confirm they still need access
Correct answer: Users whose access was denied by reviewers automatically have that access removed
When auto-apply is enabled, Access Reviews automatically remove access for users whose access was denied or not reviewed, enforcing the principle of least privilege without manual admin intervention.
Question 6: Which Azure AD governance feature helps organizations manage the entire lifecycle of user access — from request through approval, assignment, and eventual expiration?
- Entitlement Management (Correct answer)
- Access Reviews
- Privileged Identity Management
- Identity Protection
Correct answer: Entitlement Management
Entitlement Management handles the full identity governance lifecycle: users request access packages, approvers grant them, access is time-limited, and expiration triggers removal or renewal.
Question 7: What is 'user risk' in Azure AD Identity Protection, as distinct from 'sign-in risk'?
- User risk is a persistent probability that an account is compromised, based on detected anomalies over time (Correct answer)
- User risk is the number of failed sign-in attempts in the last 30 days
- User risk measures how many privileged roles a user holds
- User risk is triggered only by impossible travel detections
Correct answer: User risk is a persistent probability that an account is compromised, based on detected anomalies over time
User risk reflects the overall probability that a user's identity is compromised based on cumulative detections (like leaked credentials or suspicious activity patterns), whereas sign-in risk evaluates a single authentication event.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 3
What is the difference between 'eligible' and 'active' role assignments in Azure AD Privileged Identity Management?