SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 5

Question 1

What is the primary purpose of the 'Identity Secure Score' in Azure AD?

Accepted Answer

It measures how well an organization's identity configuration follows Microsoft's recommended security practices and provides actionable improvement steps

Answer

Identity Secure Score evaluates your Azure AD tenant configuration against Microsoft's identity security best practices and gives a percentage score with prioritized recommendations to improve your posture.

Question 2

Which Azure AD Conditional Access grant control can require a device to be marked as compliant in Microsoft Intune before allowing access?

Accepted Answer

Require device to be marked as compliant

Answer

The 'Require device to be marked as compliant' grant control checks that the device meets Intune compliance policies (e.g., encryption, OS version) before granting access to the resource.

Question 3

In Azure AD Identity Protection, what action should an administrator take when they confirm a risky user alert is a false positive?

Accepted Answer

Dismiss the user risk

Answer

Dismissing user risk in Identity Protection clears the risk state for a confirmed false positive, preventing unnecessary remediation actions while providing feedback to Microsoft's ML models.

Question 4

What does 'separation of duties' in identity governance help prevent?

Accepted Answer

A single user having conflicting access rights that could enable fraud or errors, such as creating and approving their own purchase orders

Answer

Separation of duties ensures no individual holds combinations of permissions that could be abused without detection, a core internal control principle enforced through access review and entitlement management.

Question 5

Which Microsoft service can detect when on-premises Active Directory accounts are behaving suspiciously, such as performing reconnaissance or lateral movement?

Accepted Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Identity (formerly Azure ATP) monitors on-premises Active Directory signals and network traffic to detect advanced attacks like pass-the-hash, golden ticket, and lateral movement.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Identity Protection and Governance 5