A company has a hybrid Active Directory environment and wants to allow a small team of domain administrators to perform administrative tasks from home. The security team wants to ensure that the administrators use a dedicated, hardened device and that the device is managed. What should you recommend?

Use a Remote Desktop Gateway to allow administrators to connect to a jump server from any device.

Provide each administrator with a corporate-managed laptop that is enrolled in Microsoft Intune and configured as a Privileged Access Workstation.

Allow administrators to use their personal computers with a VPN connection to the corporate network.

Deploy a virtual desktop infrastructure (VDI) that is accessed from personal devices.

Your organization uses Microsoft Entra ID Privileged Identity Management (PIM) to manage privileged roles. You need to ensure that all privileged role assignments are reviewed quarterly by the appropriate business owners, and that any access that is not approved is automatically removed. What should you configure?

Configure PIM role settings to require multi-factor authentication (MFA) on activation and set the maximum activation duration to 4 hours.

Enable PIM audit logs and export them to Azure Monitor, then create a manual process to review the logs quarterly.

Create an access review in PIM for each privileged role, set the frequency to quarterly, and enable auto-apply for denied decisions.

Create an access package in entitlement management that includes the privileged roles, and set the access review frequency to quarterly.

Your organization has an Active Directory Domain Services (AD DS) environment. You are assessing the security of the environment and need to identify common attack paths that could lead to domain compromise. You need to recommend mitigations. Which mitigation should you prioritize?

Implement tiered administration and use Privileged Access Workstations (PAWs) for tier 0 accounts.

Enforce multi-factor authentication (MFA) for all domain administrator accounts.

Implement Group Managed Service Accounts (gMSA) for all service accounts.

Disable the use of NTLM authentication across the domain.

According to the enterprise access model, which approach is recommended for delegating privileged role assignments to reduce risk?

Use just-in-time (JIT) activation and approval workflows for privileged roles

Delegate privileged roles only to external consultants to avoid internal conflicts

Assign permanent privileged roles to all administrators for operational efficiency

Grant all administrators the same level of access to simplify management

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 3

Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 4)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

25–30%of the exam

Questions 16–20

16application · medium
A company has a hybrid Active Directory environment and wants to allow a small team of domain administrators to perform administrative tasks from home. The security team wants to ensure that the administrators use a dedicated, hardened device and that the device is managed. What should you recommend?
Select an answer first
17application · medium
Your organization uses Microsoft Entra ID Privileged Identity Management (PIM) to manage privileged roles. You need to ensure that all privileged role assignments are reviewed quarterly by the appropriate business owners, and that any access that is not approved is automatically removed. What should you configure?
Select an answer first
18foundation · easy
Which Microsoft Entra ID feature allows you to create recurring access reviews for group memberships and application assignments?
Select an answer first
19application · medium
Your organization has an Active Directory Domain Services (AD DS) environment. You are assessing the security of the environment and need to identify common attack paths that could lead to domain compromise. You need to recommend mitigations. Which mitigation should you prioritize?
Select an answer first
20foundation · easy
According to the enterprise access model, which approach is recommended for delegating privileged role assignments to reduce risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 4)

Questions 16–20

Which Microsoft Entra ID feature allows you to create recurring access reviews for group memberships and application assignments?

Your organization has an Active Directory Domain Services (AD DS) environment. You are assessing the security of the environment and need to identify common attack paths that could lead to domain compromise. You need to recommend mitigations. Which mitigation should you prioritize?

According to the enterprise access model, which approach is recommended for delegating privileged role assignments to reduce risk?

Keep studying — Design security operations, identity, and compliance capabilities