Design Solutions for Identity and Access Management SC-100 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   Your company has a critical PaaS application that uses Azure SQL Database. You need to design access so that the application can connect to the database without storing connection strings, but you also need to block access from specific IP ranges. The application uses a system-assigned managed identity. What should you do?

   • AEnable Azure AD authentication for SQL and grant the managed identity access; configure a Conditional Access policy to block IP ranges
   • BUse a service principal with a client secret and a firewall rule
   • CUse a user-assigned managed identity and a database firewall rule
   • DStore the connection string in Key Vault and use a firewall rule to block IP ranges
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company wants to harden their on-premises Active Directory environment. They want to reduce the attack surface for credential theft and limit the impact of a compromised account. They also want to monitor for suspicious activity. What should you implement?

   • AUse Group Policy to enforce complex passwords and account lockout policies.
   • BImplement a tiered administration model and disable the built-in Administrator account.
   • CEnable password hash synchronization and require MFA for all domain users.
   • DDeploy privileged access workstations (PAWs) for administrators, enable Credential Guard, and use Microsoft Defender for Identity to monitor for attacks.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which feature of Microsoft Entra ID allows a user's session to be revoked in near real-time when a risk is detected, without waiting for the token to expire?

   • AContinuous access evaluation (CAE)
   • BPrivileged Identity Management
   • CConditional Access
   • DIdentity Protection
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses both Azure and Amazon Web Services (AWS). They want to allow their Azure AD users to access AWS resources using their existing corporate credentials and enforce Conditional Access policies such as MFA for sensitive AWS workloads. What should you implement?

   • ACreate IAM roles in AWS and manually map each Azure AD user to a role using AWS IAM.
   • BSet up a VPN between Azure and AWS and use Azure AD Domain Services to authenticate AWS resources.
   • CUse Microsoft Entra ID as an identity provider for AWS IAM Identity Center (successor to AWS SSO) and configure an app in Entra ID for AWS.
   • DInstall the Microsoft Entra Connect agent on an AWS EC2 instance to sync users to AWS IAM.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is planning to harden their Active Directory environment. They have a large number of domain admins and want to reduce the risk of credential theft. They also want to maintain compatibility with legacy applications that require NTLM authentication. What should you recommend?

   • AMigrate all domain controllers to Azure and use Microsoft Entra Domain Services.
   • BDisable NTLM authentication immediately across the domain.
   • CUse Group Policy to enforce a minimum password length of 15 characters for all users.
   • DImplement a tiered administration model, deploy privileged access workstations, and gradually disable NTLM authentication where possible.
   Reveal Solution Discussion Select an answer first