Microsoft - SC-900: Microsoft Security, Compliance, and Identity Fundamentals

Sample Questions

Explanation:

Microsoft Entra Conditional Access lets you apply access controls based on conditions surrounding a sign-in. Microsoft documents Conditional Access as the recommended way to require multifactor authentication (MFA) for specific sign-in events.

For this scenario, the policy can target the appropriate Microsoft 365/Exchange Online resource and use location-related conditions to determine when the access control applies. Conditional Access supports targeting specific applications and services, including Microsoft 365 services.

References:

Microsoft Entra Conditional Access documentation

Conditional Access: Target resources

Explanation:

Microsoft Entra ID Governance access reviews enable organizations to periodically review and recertify user access to groups, applications, and other resources.

Access reviews help organizations ensure that users retain access only when it is still required and approved.

In this scenario, you should configure an access review for the Microsoft Entra ID group that grants access to the financial application.

The access review can be configured to:

• Review group membership: Periodically verify whether users still require access to the financial application.
• Assign reviewers: Allow group owners, designated reviewers, or users themselves to review access.
• Schedule recurring reviews: Configure reviews to run weekly, monthly, quarterly, or annually.
• Require approval: Reviewers determine whether users should retain their access.
• Automatically remove access: Enable automatic application of review results so that denied users are removed from the group.

Exam Tip

For Microsoft certification exams, remember the differences between these Microsoft Entra features:

References:

What are access reviews?

Create an access review of groups and applications in Microsoft Entra ID

Explanation:

Microsoft specifically recommends managed identities for Azure applications that need to authenticate to resources such as Azure Key Vault without embedding credentials in application code.

A managed identity provides the Azure web app with an identity in Microsoft Entra ID whose credentials are managed by Azure. The app can use that identity to authenticate to Azure Key Vault, so developers don't have to provision, store, or rotate credentials themselves.

References:

Use managed identities for App Service and Azure Functions

Tutorial: Use a managed identity to connect Key Vault to an Azure web app in .NET

Explanation:

Microsoft Entra ID Protection helps organizations detect, investigate, and remediate identity-based risks.

It uses Microsoft's threat intelligence and machine learning to identify potentially compromised user accounts and suspicious sign-in activities.

Microsoft Entra ID Protection provides three primary capabilities:

• Risk detection: Identifies suspicious activities, such as leaked credentials, unfamiliar sign-in properties, and malicious IP addresses.
• Risk investigation: Enables administrators to investigate risky users and risky sign-ins.
• Risk remediation: Supports automated responses, such as requiring multifactor authentication (MFA) or a secure password change.

References:

What is Microsoft Entra ID Protection?

What are risk detections?

• The users must request administrative permissions when they need them.
• The administrative permissions must be active for a maximum of three hours.

Explanation:

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time, time-based privileged access. Users with eligible role assignments can request activation when they need privileged access. 

For this scenario, PIM directly satisfies both requirements:

• Request permissions when needed: PIM supports role activation and can require approval before a privileged role is activated.

• Maximum three-hour activation: PIM provides an Activation maximum duration setting. Microsoft states that this controls how long an activated role assignment remains active before it expires, with configurable values from 1 to 24 hours. Therefore, it can be configured for 3 hours.

References:

Activate my Azure resource roles in Privileged Identity Management

Configure Microsoft Entra role settings in Privileged Identity Management