SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management Questions and Answers — Questions and Answers
Question 1: A company wants to implement a solution that ensures users only have access to resources for a limited time and that their access is reviewed periodically by their managers. Which Microsoft Entra feature is MOST suitable for this requirement?
- Conditional Access policies
- Microsoft Entra ID Protection
- Access reviews (Correct answer)
- Self-service password reset (SSPR)
Correct answer: Access reviews
Access reviews in Microsoft Entra ID Governance enable organizations to manage access to resources by scheduling regular reviews, delegating reviews to appropriate personnel like managers, and automating the removal of access for users who no longer need it. This directly addresses the company's need for periodic recertification of user access.
Question 2: An administrator is configuring a Microsoft Entra Conditional Access policy. The policy should require multi-factor authentication (MFA) ONLY when a user signs in from a location that is not on the corporate network. Which two components must be configured in the policy?
- Users and Groups & Client apps
- Sign-in risk & Access controls
- Cloud apps or actions & Session controls
- Conditions (Locations) & Access controls (Grant) (Correct answer)
Correct answer: Conditions (Locations) & Access controls (Grant)
A Conditional Access policy is an if-then statement. The 'if' part is the 'Conditions,' and the 'then' part is the 'Access controls.' To trigger the policy based on the user's network location, the 'Locations' condition must be configured. To enforce MFA, the 'Grant' access control must be set to 'Require multifactor authentication.'
Question 3: Which of the following is a primary function of Microsoft Entra ID Governance?
- To block sign-ins from malicious IP addresses.
- To provide a cloud-based domain controller.
- To manage the identity and access lifecycle for users. (Correct answer)
- To enforce security baselines on endpoint devices.
Correct answer: To manage the identity and access lifecycle for users.
Microsoft Entra ID Governance is designed to help organizations manage the entire identity and access lifecycle. This includes automating access requests, assignments, reviews, and expiration to ensure that the right people have the right access at the right time.
Question 4: A company is concerned about 'permission creep,' where users accumulate more access rights than they need over time. They want a solution that provides visibility into the gap between granted permissions and used permissions across their multi-cloud environment. Which Microsoft Entra solution addresses this specific need?
- Microsoft Entra ID Protection
- Microsoft Entra Domain Services
- Microsoft Entra Application Proxy
- Microsoft Entra Permissions Management (Correct answer)
Correct answer: Microsoft Entra Permissions Management
Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides comprehensive visibility into permissions across multi-cloud environments. It is specifically designed to identify the gap between permissions granted and permissions used, helping to enforce the principle of least privilege and remediate excessive permissions.
Question 5: A user with a global administrator role in Microsoft Entra ID needs to perform a highly sensitive task. To minimize the security risk, access to this role should only be granted for a few hours and require an approval workflow. Which Microsoft Entra feature should be used to achieve this?
- Administrative Units
- Privileged Identity Management (PIM) (Correct answer)
- Dynamic Groups
- Conditional Access
Correct answer: Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate the risks associated with excessive or unnecessary privileged access. It allows for 'just-in-time' (JIT) access to administrative roles, requiring users to activate their role, often with an approval step, for a limited duration.
Question 6: What is the primary purpose of defining assignments within a Microsoft Entra Conditional Access policy?
- To specify the remediation actions, such as forcing a password reset.
- To define the scope of the policy, such as which users, groups, and applications it applies to. (Correct answer)
- To analyze the potential impact of the policy before it is enabled.
- To configure session-level controls, like sign-in frequency.
Correct answer: To define the scope of the policy, such as which users, groups, and applications it applies to.
The 'Assignments' section of a Conditional Access policy defines the scope of the policy. It specifies the 'if' conditions, such as the users, groups, cloud apps, or actions that will trigger the policy evaluation.
SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Access Management Questions and Answers
A company wants to implement a solution that ensures users only have access to resources for a limited time and that their access is reviewed periodically by their managers.
Which Microsoft Entra feature is MOST suitable for this requirement?