SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 4 — Questions and Answers
Question 1: A company wants to allow external customers to create their own accounts and sign in to a consumer-facing application. Which Azure AD capability supports this scenario?
- Azure AD B2C (Business to Consumer) (Correct answer)
- Azure AD B2B (Business to Business)
- Azure AD Privileged Identity Management
- Azure AD Entitlement Management
Correct answer: Azure AD B2C (Business to Consumer)
Azure AD B2C is designed for customer-facing apps, allowing millions of external consumers to self-register and authenticate using social identities or local accounts.
Question 2: Which of the following best describes the Zero Trust principle of 'assume breach'?
- Design systems assuming attackers may already be inside the network and minimize blast radius through segmentation and encryption (Correct answer)
- Block all external network traffic until identity is verified
- Require all users to reset passwords every 30 days
- Disable all privileged accounts when not in active use
Correct answer: Design systems assuming attackers may already be inside the network and minimize blast radius through segmentation and encryption
Assume breach means architecting as if attackers are already inside: segment networks, encrypt traffic, enforce least privilege, and monitor everything to limit what a successful attacker can access.
Question 3: What is the role of a 'connected organization' in Azure AD Entitlement Management?
- It represents an external organization whose users can be allowed to request access packages (Correct answer)
- It is a branch office with its own Azure AD tenant that is fully federated
- It is an organization whose users are automatically granted Global Administrator rights
- It is a partner organization that manages your Conditional Access policies
Correct answer: It represents an external organization whose users can be allowed to request access packages
Connected organizations in Entitlement Management define trusted external Azure AD tenants or domains from which users can be permitted to request access packages through the self-service portal.
Question 4: Which Azure AD Identity Protection risk remediation action requires the user to complete MFA to prove they are the legitimate account owner?
- Require MFA self-remediation (Correct answer)
- Block access
- Require password change
- Dismiss user risk
Correct answer: Require MFA self-remediation
Configuring Identity Protection to 'Require MFA' allows a risky sign-in to proceed if the user successfully completes multi-factor authentication, proving they possess the second factor.
Question 5: An Access Review is configured with 'Reviewers = Managers'. What happens when a user has no manager assigned in Azure AD?
- The access review falls back to a specified fallback reviewer or the application owner (Correct answer)
- The user is automatically approved
- The user is automatically denied and access is removed
- The review is cancelled for that user
Correct answer: The access review falls back to a specified fallback reviewer or the application owner
When manager-based reviews encounter users without a manager attribute, Azure AD falls back to an administrator-designated fallback reviewer to ensure no accounts are skipped.
Question 6: What is the maximum activation duration that can be configured for a PIM eligible role assignment?
- 24 hours (Correct answer)
- 8 hours
- 72 hours
- 1 hour
Correct answer: 24 hours
PIM allows role activation durations to be configured up to a maximum of 24 hours per activation, after which the user must re-activate if continued access is needed.
Question 7: Which Azure AD feature provides a self-service portal where users can view their own risk status and trigger remediation like a password reset?
- My Sign-Ins (mysignins.microsoft.com) (Correct answer)
- Azure AD Identity Protection dashboard (admin only)
- Microsoft 365 Security & Compliance Center
- Azure Portal > Identity Protection > Risky Users
Correct answer: My Sign-Ins (mysignins.microsoft.com)
The My Sign-Ins portal lets end users review their own recent sign-ins, report suspicious activity, and trigger self-service password reset to remediate risk without admin involvement.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 4
A company wants to allow external customers to create their own accounts and sign in to a consumer-facing application.
Which Azure AD capability supports this scenario?