SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 3

Question 1

What is the difference between 'eligible' and 'active' role assignments in Azure AD Privileged Identity Management?

Accepted Answer

Eligible means the user can activate the role when needed; active means the role is always on

Answer

In PIM, eligible assignments grant the right to activate a privileged role on demand (just-in-time), while active assignments mean the user continuously holds the role without needing to activate it.

Question 2

Which Azure AD Identity Protection detection identifies when a user signs in from two geographically distant locations within an impossible travel timeframe?

Accepted Answer

Impossible travel

Answer

The 'Impossible travel' risk detection flags sign-ins from two locations that could not be reached within the time between the two sign-ins, indicating credential compromise.

Question 3

What is the primary benefit of using Azure AD External Identities (B2B) over creating separate local accounts for partners?

Accepted Answer

Partners authenticate with their own organizational credentials, reducing password management overhead for both parties

Answer

B2B allows external partners to use their existing identity (work, school, or social account), so your organization doesn't need to create and manage separate credentials for them.

Question 4

An administrator wants to require approval before a user can activate the Security Administrator role in PIM. Where is this configured?

Accepted Answer

In the PIM role settings for Security Administrator

Answer

PIM role settings allow administrators to require approvers, set activation duration, mandate MFA, and require justification — all configured per role in the PIM blade.

Question 5

What happens to a user's access when an Access Review concludes and the reviewer chose 'auto-apply results'?

Accepted Answer

Users whose access was denied by reviewers automatically have that access removed

Answer

When auto-apply is enabled, Access Reviews automatically remove access for users whose access was denied or not reviewed, enforcing the principle of least privilege without manual admin intervention.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 3