Free SC-100 flashcards

Which Microsoft Entra ID capability rejects an already-issued access token within minutes when an account is disabled or flagged risky, for services like Exchange Online and SharePoint Online?

Continuous access evaluation. Microsoft Entra ID pushes critical events such as account disablement, password change, and elevated user risk directly to supported resource providers, which then reject a live token within minutes instead of honouring it until expiry. This closes the gap that any fixed token lifetime or re-authentication interval leaves open.

Tightening Conditional Access sign-in frequency to a short interval delivers near-real-time revocation of access mid-session.

A short sign-in frequency only reapplies policy at the next scheduled prompt, not at the moment access is revoked. It feels responsive but still leaves a window where a live token works. Continuous access evaluation is what enforces revocation and critical events in near real time.

How do you remove the lateral-movement risk of every Windows device sharing an identical, rarely rotated built-in local administrator password?

Windows Local Administrator Password Solution (Windows LAPS) generates a unique random local administrator password per device, rotates it on a schedule, and backs it up to Microsoft Entra ID or Active Directory with permission-controlled retrieval. Unique per-device passwords break the pass-the-credential path that identical shared passwords create.

Microsoft Entra Privileged Identity Management can randomise and rotate each Windows device's built-in local administrator password.

Privileged Identity Management brokers just-in-time, time-bound activation of directory and Azure roles. It does not randomise or rotate the per-device built-in local administrator password stored on each machine, which is what Windows LAPS handles.

What backup property survives a ransomware operator who already holds Global Administrator rights and wants to destroy restore points?

Writing backups to immutable, time-locked storage with a retention lock. The platform itself prevents any administrator role from deleting or altering the restore points until retention expires, enforcing the assume-breach principle so even a fully compromised privileged identity cannot reach them.

Replicating backups to a second Azure region protects restore points from a compromised Global Administrator.

Geo-replication only defends against a datacentre or regional outage. A privileged attacker can issue deletion commands against the replicated copies just as easily as the primary, so it does nothing against a malicious admin-level identity. Immutable, retention-locked storage is what blocks deletion.

Which security practice surfaces architectural and trust-boundary flaws such as missing authorisation before any code is written?

Threat modelling. It reasons about a system's data flows, trust boundaries, and assets while the design is still on paper, enumerating how the system could be attacked. Because it precedes implementation, it catches authorisation, trust, and exposure flaws when they are cheapest to fix, which is something testing techniques that need running or committed code cannot do.

Dynamic application security testing against a staging build can catch design-level trust-boundary flaws before code is written.

Dynamic testing runs against built, deployed code, so it can only find exploitable issues in software that already exists. It cannot surface design-level trust-boundary or missing-authorisation flaws before code is written; that is the role of threat modelling during the design phase.