A company uses both Azure and Google Cloud Platform (GCP). They want to allow their Azure AD users to access GCP resources using their corporate credentials, but they also want to enforce Conditional Access policies such as MFA for sensitive GCP workloads. They are considering using federation with GCP. What should you recommend?

Create service accounts in GCP and manually map each Azure AD user to a service account.

Use a VPN between Azure and GCP and rely on GCP's IAM policies.

Configure Microsoft Entra ID as an identity provider for GCP using workload identity federation, and use Conditional Access to enforce MFA.

Use Azure AD Domain Services to authenticate GCP resources.

Your organization wants to reduce the risk of token replay for a critical SaaS application. You need to design a modern authentication strategy that can terminate sessions quickly when a user's risk level changes. The solution must work with Conditional Access and support real-time enforcement. What should you implement?

Require reauthentication every hour with Conditional Access

Use a VPN for all access to the application

Set a short token lifetime for the application

Enable Continuous Access Evaluation (CAE) for the application

Your company has a legacy on-premises application running on an Azure VM that only supports Kerberos authentication. You need to allow users to access the application from the internet using their Microsoft Entra ID credentials. The solution must enforce MFA and block access from untrusted locations. What should you implement?

Set up a site-to-site VPN and join the VM to the domain

Install a certificate on the VM and use certificate-based authentication

Expose the VM's public IP and enable Azure AD Domain Services for Kerberos

Deploy Microsoft Entra Application Proxy and configure the application for pre-authentication with Conditional Access

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 2

Design Solutions for Identity and Access Management SC-100 Practice Questions (Page 2)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

25–30%of the exam

Questions 6–10

6foundation · easy
Which Azure service is designed to securely store and manage secrets, keys, and certificates?
Select an answer first
7expert · hard
A company uses both Azure and Google Cloud Platform (GCP). They want to allow their Azure AD users to access GCP resources using their corporate credentials, but they also want to enforce Conditional Access policies such as MFA for sensitive GCP workloads. They are considering using federation with GCP. What should you recommend?
Select an answer first
8application · medium
Your organization wants to reduce the risk of token replay for a critical SaaS application. You need to design a modern authentication strategy that can terminate sessions quickly when a user's risk level changes. The solution must work with Conditional Access and support real-time enforcement. What should you implement?
Select an answer first
9application · medium
Your company has a legacy on-premises application running on an Azure VM that only supports Kerberos authentication. You need to allow users to access the application from the internet using their Microsoft Entra ID credentials. The solution must enforce MFA and block access from untrusted locations. What should you implement?
Select an answer first
10foundation · easy
Which Microsoft Entra ID edition is required to use Conditional Access policies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Identity and Access Management SC-100 Practice Questions (Page 2)

Questions 6–10

Which Azure service is designed to securely store and manage secrets, keys, and certificates?

Which Microsoft Entra ID edition is required to use Conditional Access policies?

Keep studying — Design security operations, identity, and compliance capabilities