SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management 5 — Questions and Answers
Question 1: What is Microsoft Entra Domain Services (formerly Azure AD Domain Services) primarily used for?
- Providing cloud-based LDAP, Kerberos, and NTLM services for legacy apps without on-premises DCs (Correct answer)
- Replacing Microsoft Entra ID as the primary identity store
- Enabling passwordless authentication for mobile devices
- Syncing on-premises AD groups to Microsoft 365
Correct answer: Providing cloud-based LDAP, Kerberos, and NTLM services for legacy apps without on-premises DCs
Microsoft Entra Domain Services provides managed domain services such as LDAP, Kerberos, and NTLM, allowing legacy applications to use domain features without on-premises domain controllers.
Question 2: In Microsoft Entra ID, what is a 'Service Principal'?
- A special admin account used for emergency break-glass scenarios
- The identity representation of an application or service in a tenant, used to authenticate and access resources (Correct answer)
- A managed identity assigned to a virtual machine
- A role that grants read-only access to the directory
Correct answer: The identity representation of an application or service in a tenant, used to authenticate and access resources
A service principal is the local representation of an application registration in a specific Microsoft Entra ID tenant, enabling the app to authenticate and be assigned permissions.
Question 3: Which report in Microsoft Entra ID helps identify users who have not used their account within a specified period?
- Risk detections report
- Audit log report
- Inactive users report / Sign-in activity report (Correct answer)
- Registered authentication methods report
Correct answer: Inactive users report / Sign-in activity report
The sign-in activity report and inactive users insights in Microsoft Entra ID help identify accounts that haven't signed in recently, supporting access hygiene.
Question 4: What does 'Continuous Access Evaluation' (CAE) enable in Microsoft Entra ID?
- It forces users to re-enroll in MFA every 30 days
- It allows services to revoke access tokens in near real-time when user conditions change (Correct answer)
- It evaluates device compliance every time a file is downloaded
- It scans emails continuously for phishing links
Correct answer: It allows services to revoke access tokens in near real-time when user conditions change
CAE enables Microsoft Entra ID to signal participating services to revoke access tokens immediately when critical events occur, such as account disablement or IP address change.
Question 5: Which Microsoft Entra workload identity feature helps protect non-human identities like apps and service principals?
- Microsoft Entra Workload Identities (with Identity Protection for workloads) (Correct answer)
- Microsoft Entra Verified ID
- Privileged Identity Management for users only
- Self-Service Password Reset
Correct answer: Microsoft Entra Workload Identities (with Identity Protection for workloads)
Microsoft Entra Workload Identities extends identity protection capabilities to apps and service principals, detecting risky workload credential usage.
Question 6: What is the 'My Access' portal in Microsoft Entra ID used for?
- Administrators reviewing all privileged role assignments
- End users requesting, managing, and reviewing their own access packages and group memberships (Correct answer)
- Security teams viewing Identity Protection risk reports
- IT staff approving device compliance policies
Correct answer: End users requesting, managing, and reviewing their own access packages and group memberships
The My Access portal (myaccess.microsoft.com) allows end users to request access packages, view their current access, and complete access reviews assigned to them.
Question 7: In Microsoft Entra ID, what is the difference between 'Authentication' and 'Authorization'?
- Authentication determines what you can do; authorization verifies who you are
- Authentication verifies identity; authorization determines what an authenticated identity is allowed to do (Correct answer)
- They are interchangeable terms for the same process in Entra ID
- Authentication applies only to humans; authorization applies only to applications
Correct answer: Authentication verifies identity; authorization determines what an authenticated identity is allowed to do
Authentication is the process of proving who you are (verifying identity), while authorization is the process of determining what you are allowed to access or do after authentication.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management 5
What is Microsoft Entra Domain Services (formerly Azure AD Domain Services) primarily used for?