What is the primary purpose of Microsoft Entra Verified ID?

To provide single sign-on for external users

To synchronize identities between different tenants

To issue and verify verifiable credentials for decentralized identity scenarios

To manage external user access to applications

A company is adopting a Zero Trust strategy. They want to ensure that all access to Microsoft 365 apps is explicitly verified and uses least privilege. They also want to minimize user friction for low-risk scenarios. What should you implement?

Enable Security Defaults and require all users to use the Microsoft Authenticator app.

Implement a single Conditional Access policy that requires MFA and a compliant device for all users.

Create Conditional Access policies that require MFA for all users, block legacy authentication, and use risk-based policies to step up authentication for high-risk sign-ins.

Use Microsoft Entra Permissions Management to enforce just-in-time access for all Microsoft 365 apps.

A company uses Microsoft Entra ID and wants to implement continuous access evaluation (CAE) to protect their cloud apps. They also want to use risk-based Conditional Access to block sign-ins that are deemed high risk. What should you configure?

Use Microsoft Entra ID Protection to automatically block all sign-ins that are not from trusted locations.

Configure CAE for all applications and require MFA for all sign-ins.

Implement a Conditional Access policy that requires a compliant device for all cloud apps.

Enable CAE for supported applications and create a Conditional Access policy that uses the sign-in risk condition to block high-risk sign-ins.

Your company has a hybrid identity environment with on-premises Active Directory and Microsoft Entra ID. You need to design a solution that allows users to use the same password for both on-premises and cloud resources, while also enabling Conditional Access and risk-based policies. What should you implement?

Configure password hash synchronization with seamless SSO

Implement pass-through authentication without password sync

Use Azure AD Domain Services to sync passwords

Set up Active Directory Federation Services (AD FS) with MFA

What is the recommended way for an application to retrieve a secret from Azure Key Vault?

Use a shared access signature (SAS) token

Use a managed identity to authenticate to Key Vault

Store the Key Vault URI and access key in the application configuration

Embed the secret in the application code

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 2

Design Solutions for Identity and Access Management SC-100 Practice Questions (Page 9)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

25–30%of the exam

Questions 41–45

41foundation · easy
What is the primary purpose of Microsoft Entra Verified ID?
Select an answer first
42application · medium
A company is adopting a Zero Trust strategy. They want to ensure that all access to Microsoft 365 apps is explicitly verified and uses least privilege. They also want to minimize user friction for low-risk scenarios. What should you implement?
Select an answer first
43application · medium
A company uses Microsoft Entra ID and wants to implement continuous access evaluation (CAE) to protect their cloud apps. They also want to use risk-based Conditional Access to block sign-ins that are deemed high risk. What should you configure?
Select an answer first
44application · medium
Your company has a hybrid identity environment with on-premises Active Directory and Microsoft Entra ID. You need to design a solution that allows users to use the same password for both on-premises and cloud resources, while also enabling Conditional Access and risk-based policies. What should you implement?
Select an answer first
45foundation · easy
What is the recommended way for an application to retrieve a secret from Azure Key Vault?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.