SkillTestPro | SC-900 Practice Test 21 Hard Questions

SC-900 Exam Practice Test 21 (Hard) - Identity Governance Deep-Dive

SC-900 Exam Practice Tests

1 / 15

Which term describes granting a user only the minimum level of access necessary to perform their specific job function?

Federation

Single sign-on

The principle of least privilege

Multi-tenancy

Defense in depth alone

Zero Trust alone, without reference to the specific access-minimization principle

2 / 15

Which Privileged Identity Management (PIM) role state means a user is permanently assigned a privileged role, without needing to activate it?

An eligible assignment, which requires activation before the role becomes active

A guest assignment

An active (standing) assignment

A service principal assignment with no interactive activation

A managed identity assignment

A conditional assignment requiring MFA before activation alone with no time-bound expiration

3 / 15

Which Privileged Identity Management (PIM) role state means a user CAN activate a privileged role when needed, but does not have that access by default until they do so?

An active (standing) assignment, which grants the role immediately without requiring activation

A guest assignment

An eligible assignment

A service principal assignment

A managed identity assignment

A permanently revoked assignment

4 / 15

Which PIM setting allows an administrator to require a specific duration limit, such as a maximum of 8 hours, for how long an activated privileged role remains active before automatically expiring?

Approval workflow requirement alone, which governs whether approval is needed rather than the duration limit

Justification requirement alone, which governs whether a reason must be provided rather than the duration limit

Maximum activation duration

MFA requirement for activation alone, which governs the authentication method rather than the duration limit

Notification settings alone, which govern alerting rather than the duration limit

Role eligibility assignment alone, which governs who can activate rather than how long the activation lasts

5 / 15

Which entitlement management concept represents the specific bundle of resources, such as groups, Teams, and applications, that a requester gains access to when their request is approved?

An access review, which periodically re-verifies existing access rather than defining an initial resource bundle

A Conditional Access policy, which controls sign-in conditions rather than defining a resource bundle

An access package

A PIM role assignment, which focuses on privileged roles rather than a broader resource bundle

A sensitivity label, which classifies content rather than defining an access resource bundle

A named location, which defines network conditions rather than an access resource bundle

6 / 15

Which entitlement management concept defines who is allowed to request access to a specific access package, such as only members of a particular department or external partner organization?

A resource role assignment alone, which defines what access is granted rather than who can request it

An approval stage alone, which defines who approves rather than who is initially permitted to request

A policy governing who can request access to an access package

A lifecycle setting alone, which defines expiration rather than eligibility to request

A catalog alone, which organizes resources for administration rather than defining requester eligibility

A connected organization alone, which enables external requests generally rather than defining specific requester eligibility criteria

7 / 15

Which entitlement management concept groups related resources, such as several applications and groups belonging to a specific project, for easier administrative management?

An access package alone, which represents what a specific requester receives rather than the broader organizational grouping

An access review alone

A catalog

A PIM role alone

A Conditional Access policy alone

A sensitivity label alone

8 / 15

Which entitlement management feature allows an organization to enable access requests from users in external, connected partner organizations, supporting broader B2B collaboration scenarios?

A catalog alone, which organizes resources rather than enabling external requester connectivity

An access review alone

Connected organizations

A PIM role alone

A Conditional Access policy alone

A sensitivity label alone

9 / 15

Which access review outcome option would automatically remove a user's access if the assigned reviewer does not respond within the review period?

A setting that automatically extends the reviewer's deadline indefinitely with no default outcome

A setting that automatically grants the user additional privileges if the reviewer does not respond

An auto-apply setting configured to remove access on no response

A setting that has no defined outcome whatsoever if a reviewer fails to respond

A setting that automatically deletes the entire access review record with no action taken on the user's access

A setting that always defaults to keeping the user's access regardless of configuration

10 / 15

Which access review scenario is well-suited to periodically verifying that external guest users still require access to a specific resource, such as a Teams site shared with a partner organization?

A one-time review with no recurring schedule, regardless of the resource's ongoing external sharing

A review scoped only to internal, licensed employees with no consideration of external guest access

A recurring access review scoped specifically to guest users' access to that resource

Assuming guest access never requires review since it was initially manually approved

A review conducted only by the external guest users themselves reviewing their own access

A review with no defined reviewer assigned at all

11 / 15

Which PIM concept requires a privileged role activation request to be approved by a designated approver before the role becomes active, adding an additional layer of oversight?

A justification requirement alone, which only requires a stated reason rather than a separate approver's decision

A maximum activation duration alone

An approval workflow

An MFA requirement alone

A notification setting alone

An eligible assignment alone, without an approval-specific workflow requirement

12 / 15

Which Identity Governance concept refers to the overall process of managing a user's access throughout their time with an organization, from onboarding through role changes to eventual offboarding?

Conditional Access alone, which is a real-time policy enforcement mechanism rather than the broader lifecycle process

Identity Protection alone, which focuses on risk detection rather than the broader lifecycle process

Identity lifecycle management

Single sign-on alone

Federation alone

Self-service password reset alone

13 / 15

Which entitlement management lifecycle setting would automatically require a user's access package assignment to be periodically re-approved, or it will expire?

A one-time approval with permanent, non-expiring access and no ongoing review

A setting that grants access indefinitely with no possibility of expiration or review

Access package expiration combined with a recurring access review requirement

A setting that only applies to internal users, never external connected organization users

A setting that removes the need for any initial approval whatsoever

A setting that applies only to PIM role assignments, not entitlement management access packages

14 / 15

Which term describes the risk of a user accumulating excessive, unnecessary permissions over time as they change roles within an organization, without those excess permissions ever being removed?

Federation

Single sign-on

Privilege creep

Multi-tenancy

Defense in depth

Zero Trust

15 / 15

Which Identity Governance capability is most directly designed to help mitigate the risk of privilege creep by periodically re-verifying whether existing access assignments are still needed?

Conditional Access alone, which enforces real-time sign-in conditions rather than periodically re-verifying existing standing access

Identity Protection alone, which focuses on risk-based sign-in and user risk detection rather than periodic access re-verification

Access reviews

Single sign-on alone

Federation alone

Self-service password reset alone

Your score is

The average score is 0%