A multinational company uses Microsoft 365, AWS, and Google Cloud Platform. The security team wants to centrally manage privileged access across all three cloud platforms and enforce just-in-time access with approval workflows. They also want to minimize the number of separate tools. What should you use?

Microsoft Entra Permissions Management

Microsoft Entra Privileged Identity Management

Your organization uses Microsoft Entra ID Privileged Identity Management (PIM) to manage access to a critical application. You need to ensure that users who request access to the application are automatically approved if they meet certain criteria, such as being a manager. What should you configure?

Configure PIM role settings to require approval for activation, and assign the application owner as the approver.

Use entitlement management to create an access package for the application, and configure a policy that grants access automatically to users who are managers.

Create an access review in PIM that runs weekly and automatically removes users who do not need access.

Configure PIM to require multi-factor authentication (MFA) on activation and set the activation duration to 8 hours.

An organization has a single Active Directory domain and wants to protect against the Pass-the-Hash attack. They have already implemented a dedicated administrative forest with a one-way trust. Which additional control should they implement to further reduce the risk?

Implement the Protected Users group and add all privileged users to it.

Enable Credential Guard on all domain controllers and administrative workstations.

Deploy a read-only domain controller (RODC) in each site.

Disable NTLM authentication across the entire domain.

Your organization is using a SaaS application that supports SAML-based single sign-on (SSO). You need to design a solution to secure the administration of the SaaS application. The solution must ensure that only authorized administrators can manage the application's configuration, and that their access is time-bound. What should you do?

Use the SaaS application's native admin console to create administrator accounts and set a password expiration policy.

Use Microsoft Entra ID to provision administrators to the SaaS application and assign them to a role that is eligible in PIM.

Use Azure AD Application Proxy to publish the SaaS application and require MFA for access.

Create a custom role in the SaaS application and assign it to the administrators permanently.

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 3

Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 1)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

25–30%of the exam

Questions 1–5

1application · medium
A multinational company uses Microsoft 365, AWS, and Google Cloud Platform. The security team wants to centrally manage privileged access across all three cloud platforms and enforce just-in-time access with approval workflows. They also want to minimize the number of separate tools. What should you use?
Select an answer first
2application · medium
Your organization uses Microsoft Entra ID Privileged Identity Management (PIM) to manage access to a critical application. You need to ensure that users who request access to the application are automatically approved if they meet certain criteria, such as being a manager. What should you configure?
Select an answer first
3application · medium
An organization has a single Active Directory domain and wants to protect against the Pass-the-Hash attack. They have already implemented a dedicated administrative forest with a one-way trust. Which additional control should they implement to further reduce the risk?
Select an answer first
4application · medium
Your organization is using a SaaS application that supports SAML-based single sign-on (SSO). You need to design a solution to secure the administration of the SaaS application. The solution must ensure that only authorized administrators can manage the application's configuration, and that their access is time-bound. What should you do?
Select an answer first
5foundation · easy
Which Microsoft tool provides a unified view of security posture across multicloud environments, including Azure, AWS, and Google Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 1)

Questions 1–5

An organization has a single Active Directory domain and wants to protect against the Pass-the-Hash attack. They have already implemented a dedicated administrative forest with a one-way trust. Which additional control should they implement to further reduce the risk?

Which Microsoft tool provides a unified view of security posture across multicloud environments, including Azure, AWS, and Google Cloud?

Keep studying — Design security operations, identity, and compliance capabilities