SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management 3 — Questions and Answers
Question 1: What is the primary purpose of Microsoft Entra Verified ID?
- To enforce multi-factor authentication for all sign-ins
- To issue and verify decentralized digital identity credentials (Correct answer)
- To manage privileged access to Azure resources
- To detect compromised credentials in real time
Correct answer: To issue and verify decentralized digital identity credentials
Microsoft Entra Verified ID is a decentralized identity solution that allows organizations to issue and verify tamper-proof digital credentials.
Question 2: Which Conditional Access condition can restrict access based on whether a device meets organizational compliance requirements?
- User risk condition
- Sign-in frequency control
- Device compliance/state condition (Correct answer)
- Named locations condition
Correct answer: Device compliance/state condition
Conditional Access can require that a device be marked as compliant by Microsoft Intune before granting access to resources.
Question 3: In Microsoft Entra ID, what is a 'Managed Identity'?
- A user account managed by an external identity provider
- An automatically managed identity for Azure resources to authenticate to services without storing credentials (Correct answer)
- A guest account from a partner organization
- A service account with a manually rotated password
Correct answer: An automatically managed identity for Azure resources to authenticate to services without storing credentials
Managed identities provide Azure resources with an automatically managed identity in Microsoft Entra ID, eliminating the need to store credentials in code.
Question 4: What distinguishes a 'System-assigned' managed identity from a 'User-assigned' managed identity?
- System-assigned identities can be shared across multiple resources; user-assigned cannot
- System-assigned identities are tied to a single resource and deleted with it; user-assigned are standalone and reusable (Correct answer)
- User-assigned identities are created automatically; system-assigned require manual creation
- There is no functional difference between the two types
Correct answer: System-assigned identities are tied to a single resource and deleted with it; user-assigned are standalone and reusable
System-assigned managed identities have a 1:1 lifecycle with their resource, while user-assigned managed identities are independent resources that can be associated with multiple Azure services.
Question 5: Which Microsoft Entra feature provides visibility into permissions granted to identities across multi-cloud environments (Azure, AWS, GCP)?
- Microsoft Entra Identity Protection
- Microsoft Entra Privileged Identity Management
- Microsoft Entra Permissions Management (Correct answer)
- Microsoft Entra ID Governance
Correct answer: Microsoft Entra Permissions Management
Microsoft Entra Permissions Management is a CIEM (Cloud Infrastructure Entitlement Management) solution that provides visibility and control over permissions across Azure, AWS, and GCP.
Question 6: What is 'Entitlement Management' in Microsoft Entra ID Governance?
- A tool for detecting risky user behavior through ML algorithms
- A feature that automates access request, approval, and assignment workflows for resources (Correct answer)
- A policy engine that enforces device compliance before granting access
- A report that shows all privileged role assignments in the tenant
Correct answer: A feature that automates access request, approval, and assignment workflows for resources
Entitlement Management automates identity governance by creating access packages that bundle resources and define who can request them, how they're approved, and when access expires.
Question 7: In Microsoft Entra ID, which authentication method uses a physical or software key that meets FIDO2 standards?
- SMS one-time passcode
- Microsoft Authenticator push notification
- FIDO2 security key (Correct answer)
- Certificate-based authentication
Correct answer: FIDO2 security key
FIDO2 security keys (such as YubiKeys) are phishing-resistant hardware or software authenticators that meet the FIDO2 open standard supported by Microsoft Entra ID.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management 3
What is the primary purpose of Microsoft Entra Verified ID?