Describe Identity Protection and Governance Capabilities of Microsoft Entra SC-900 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key feature of Microsoft Entra Privileged Identity Management (PIM)?

   • ACreation of new user accounts
   • BSynchronization of identities from on-premises directories
   • CJust-in-time access to privileged roles
   • DAutomatic password reset for all users
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which capability is provided by Microsoft Entra Privileged Identity Management (PIM)?

   • AAccess reviews for privileged roles
   • BSelf-service password reset for users
   • CMultifactor authentication for all users
   • DConditional access policies for all apps
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is migrating to a least-privilege model. They have 10 users who are currently permanent Global Administrators. The security team wants to require these users to activate the role only when needed, with a maximum duration of 2 hours, and they want to receive notifications when activation occurs. They also want to periodically confirm that these users still need the Global Administrator role. What should you configure in Microsoft Entra?

   • AKeep the assignments as active but add a conditional access policy that requires MFA and limits session duration
   • BCreate an access review for the Global Administrator role and set the review frequency to monthly
   • CUse ID Protection to monitor the users and require a password change if risk is detected
   • DConvert the assignments to eligible in PIM, set activation duration to 2 hours, enable notifications, and create an access review for the role
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a large number of users who work remotely and often sign in from different locations. Microsoft Entra ID Protection flags many sign-ins as risky due to impossible travel, but the security team believes these are false positives because users use VPNs. They want to reduce the number of false positives without disabling risk detection. What should they do?

   • AIncrease the risk level threshold to high for all policies
   • BAdd trusted named locations for the VPN IP ranges in conditional access
   • CCreate an access review to manually approve all risky sign-ins
   • DDisable the impossible travel risk detection
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a policy that all privileged role activations must be approved by a manager and require multi-factor authentication. However, a recent security incident showed that a compromised administrator account was used to activate a privileged role because the activation did not require MFA. The company wants to reduce the risk of similar incidents without slowing down legitimate activations. What should they do?

   • AUse conditional access to block all privileged role activations from non-compliant devices
   • BRequire MFA for all privileged role activations and keep the approval requirement
   • CRemove the approval requirement to speed up activations
   • DRequire a second approval from a different manager
   Reveal Solution Discussion Select an answer first