SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 5 — Questions and Answers
Question 1: What is the primary purpose of the 'Identity Secure Score' in Azure AD?
- It measures how well an organization's identity configuration follows Microsoft's recommended security practices and provides actionable improvement steps (Correct answer)
- It grades individual users on their password strength
- It monitors real-time threat detection events per hour
- It calculates the risk level of each sign-in attempt
Correct answer: It measures how well an organization's identity configuration follows Microsoft's recommended security practices and provides actionable improvement steps
Identity Secure Score evaluates your Azure AD tenant configuration against Microsoft's identity security best practices and gives a percentage score with prioritized recommendations to improve your posture.
Question 2: Which Azure AD Conditional Access grant control can require a device to be marked as compliant in Microsoft Intune before allowing access?
- Require device to be marked as compliant (Correct answer)
- Require Hybrid Azure AD joined device
- Require approved client app
- Require MFA
Correct answer: Require device to be marked as compliant
The 'Require device to be marked as compliant' grant control checks that the device meets Intune compliance policies (e.g., encryption, OS version) before granting access to the resource.
Question 3: In Azure AD Identity Protection, what action should an administrator take when they confirm a risky user alert is a false positive?
- Dismiss the user risk (Correct answer)
- Block the user account
- Require password change
- Delete and recreate the user account
Correct answer: Dismiss the user risk
Dismissing user risk in Identity Protection clears the risk state for a confirmed false positive, preventing unnecessary remediation actions while providing feedback to Microsoft's ML models.
Question 4: What does 'separation of duties' in identity governance help prevent?
- A single user having conflicting access rights that could enable fraud or errors, such as creating and approving their own purchase orders (Correct answer)
- Two users sharing the same login credentials
- An admin managing both on-premises and cloud identities
- Users signing in from multiple geographic locations
Correct answer: A single user having conflicting access rights that could enable fraud or errors, such as creating and approving their own purchase orders
Separation of duties ensures no individual holds combinations of permissions that could be abused without detection, a core internal control principle enforced through access review and entitlement management.
Question 5: Which Microsoft service can detect when on-premises Active Directory accounts are behaving suspiciously, such as performing reconnaissance or lateral movement?
- Microsoft Defender for Identity (Correct answer)
- Azure AD Identity Protection
- Microsoft Sentinel
- Azure AD Privileged Identity Management
Correct answer: Microsoft Defender for Identity
Microsoft Defender for Identity (formerly Azure ATP) monitors on-premises Active Directory signals and network traffic to detect advanced attacks like pass-the-hash, golden ticket, and lateral movement.
Question 6: An organization enables the Azure AD Identity Protection policy to require password change when user risk is 'High'. What must users do to regain normal access?
- Complete a self-service password reset to prove identity and clear the risk (Correct answer)
- Contact the help desk to have an admin reset the password
- Wait 24 hours for the risk to automatically expire
- Re-enroll in MFA from a new device
Correct answer: Complete a self-service password reset to prove identity and clear the risk
When user risk policy enforces password change, affected users can self-remediate by completing SSPR (Self-Service Password Reset), which clears the risk flag and restores normal access.
Question 7: What is a 'lifecycle workflow' in Azure AD Identity Governance, introduced to automate joiner-mover-leaver processes?
- Automated task sequences that run when employees join, change roles, or leave the organization to provision or deprovision access (Correct answer)
- A manual checklist HR completes when hiring new employees
- A report showing how long each user has held their current role
- A Conditional Access policy that blocks stale accounts
Correct answer: Automated task sequences that run when employees join, change roles, or leave the organization to provision or deprovision access
Lifecycle Workflows automate identity tasks triggered by HR events (new hire start date, department change, termination) such as sending welcome emails, adding to groups, or disabling accounts.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 5
What is the primary purpose of the 'Identity Secure Score' in Azure AD?