Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   Your organization uses Microsoft Entra ID Privileged Identity Management (PIM) to manage privileged roles. You have a requirement to ensure that all privileged role assignments are reviewed quarterly. However, the compliance team has expressed concern that the current review process is too time-consuming and that reviewers are not providing accurate decisions. You need to improve the review process without compromising security. What should you do?

   • AUse multi-stage reviews with the user's manager as the first reviewer and the role owner as the second reviewer.
   • BUse a single reviewer for all roles to ensure consistency.
   • CReduce the frequency of reviews to annually to save time.
   • DAutomatically approve all reviews that have no recent activity.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has a hybrid identity environment and uses Microsoft Entra ID. The security team wants to implement a privileged access strategy that reduces the risk of credential theft. They have a limited budget and cannot deploy new hardware. They also want to ensure that all privileged actions are audited. Which combination of controls should you recommend?

   • ADeploy a new dedicated Active Directory forest and require all admins to use a separate physical workstation.
   • BImplement Azure AD Identity Protection to automatically block risky sign-ins and rely on that for privileged access.
   • CUse Microsoft Entra Privileged Identity Management for Entra ID roles and configure Conditional Access to require MFA and a compliant device for privileged role activation.
   • DUse Microsoft Entra Permissions Management to manage all privileged access and ignore PIM.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses Microsoft 365 and has a team of IT administrators who need to manage user accounts and licenses. The security team wants to apply the principle of least privilege and ensure that the administrators can only perform these tasks. They also want to require multi-factor authentication for all administrative actions. What should you do?

   • AAssign the License Administrator role to the team and require MFA for all users.
   • BAssign the Global Administrator role to the team and enable security defaults.
   • CAssign the User Administrator role to the team and enable a conditional access policy that requires MFA for the Microsoft Entra admin center.
   • DCreate a custom role that includes all permissions and assign it to the team.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which Microsoft Entra ID feature provides time-bound and approval-based role activation for privileged roles?

   • AEntitlement management
   • BAccess reviews
   • CPrivileged Identity Management (PIM)
   • DConditional Access
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   Your organization is implementing the enterprise access model. You need to design a role assignment strategy for the tier 0 identity administrators. The strategy must ensure that only the most critical roles are eligible for activation, and that activation requires approval from a separate security team. You also need to ensure that the workstations used for these activations are hardened. What should you include in the design?

   • AMake the Global Administrator role eligible in Privileged Identity Management (PIM) with approval required, and require activations to be performed from a Privileged Access Workstation (PAW).
   • BUse entitlement management to create an access package for the Global Administrator role, and require the identity team to use Azure AD-joined devices.
   • CAssign the Global Administrator role as permanent to the identity team, and require them to use Privileged Access Workstations (PAWs).
   • DAssign the Privileged Role Administrator role as eligible in PIM, and require activations to be performed from a mobile device with the Authenticator app.
   Reveal Solution Discussion Select an answer first