Free SC-100 flashcards

Which Microsoft Entra ID capability rejects an already-issued access token within minutes when an account is disabled or flagged risky, for services like Exchange Online and SharePoint Online?

Continuous access evaluation. Microsoft Entra ID pushes critical events such as account disablement, password change, and elevated user risk directly to supported resource providers, which then reject a live token within minutes instead of honouring it until expiry. This closes the gap that any fixed token lifetime or re-authentication interval leaves open.

What design isolates control-plane credentials so that compromise of an admin's everyday email-and-browsing laptop cannot expose them?

The enterprise access model with tiered administration and privileged access workstations. Privileged tasks are performed only from hardened, isolated workstations that do not handle email or browsing, so the productivity device never holds the privileged credential to be stolen. This breaks the credential-theft chain that strong authentication alone cannot close.

Common misconceptionThat multi-factor authentication and long admin passwords stop a compromised laptop exposing credentials. A cached or stolen session still hands over control.

How do you remove the lateral-movement risk of every Windows device sharing an identical, rarely rotated built-in local administrator password?

Windows Local Administrator Password Solution (Windows LAPS) generates a unique random local administrator password per device, rotates it on a schedule, and backs it up to Microsoft Entra ID or Active Directory with permission-controlled retrieval. Unique per-device passwords break the pass-the-credential path that identical shared passwords create.

Under Zero Trust verify explicitly, how do you grant app access only when a client device proves it is encrypted, patched, and free of active threats at each request?

Pair Microsoft Intune compliance policies with Microsoft Entra Conditional Access. Intune evaluates encryption, patch level, and threat state and emits a compliant or non-compliant signal; Conditional Access consumes that signal to allow or block access per request. This delivers device-trust that location-based or credential-only controls cannot.

Common misconceptionThat being on an allow-listed network proves a device is trustworthy. Zero Trust requires verifying the device itself, not its network location.

What backup property survives a ransomware operator who already holds Global Administrator rights and wants to destroy restore points?

Writing backups to immutable, time-locked storage with a retention lock. The platform itself prevents any administrator role from deleting or altering the restore points until retention expires, enforcing the assume-breach principle so even a fully compromised privileged identity cannot reach them.

In a business continuity design, what does adding a recovery point objective bound that the recovery time objective does not?

The recovery point objective bounds the maximum tolerable amount of lost data and therefore drives how often protected restore points are captured. The recovery time objective bounds downtime only. A complete BCDR design needs both, or the data-loss risk is left uncontrolled.

Common misconceptionThat the recovery point objective governs how fast a system comes back online. It bounds tolerable data loss, not downtime; that measure belongs to the recovery time objective.

Which security practice surfaces architectural and trust-boundary flaws such as missing authorisation before any code is written?

Threat modelling. It reasons about a system's data flows, trust boundaries, and assets while the design is still on paper, enumerating how the system could be attacked. Because it precedes implementation, it catches authorisation, trust, and exposure flaws when they are cheapest to fix, which is something testing techniques that need running or committed code cannot do.

In DevSecOps, where do you catch insecure infrastructure-as-code like public storage at the earliest, cheapest point to fix?

Scan infrastructure-as-code templates inside the pull request and pipeline. This embeds the check in the developer workflow and blocks insecure definitions before any environment is provisioned, which is the shift-left point where fixes cost the least. Platform-deny and posture tools act at or after provisioning, and manual reviews add a late bottleneck.

Common misconceptionThat an Azure Policy deny effect counts as shifting security left. It blocks a bad deployment at the platform, after the flaw has already left the pull request.