SC-100 Certification Practice Question #98

Question

You have the Azure subscriptions shown in the following table.

The tenants contain the groups shown in the following table.

You perform the flowing actions:

•	Configure multi-user authorization (MUA) for Vault1 by using a resource guard deployed to Sub2.
•	Enable all available MUA controls for Vault1.
•	In contoso.com, create a Privileged Identity Management (PIM) assignment named Assignment1.
•	Configure Assignment1 to enable Group1 to activate the Contributor role for Vault1.

For each of the following statements, select Yes if the statements is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

Row 1 is false because a Resource Guard does not need to live in Sub1 — MS Learn explicitly recommends a *different* subscription/tenant for isolation, and the scenario deployed it to Sub2. Row 2 is true because modifying backup policy is an MUA-protected critical operation; with all MUA controls enabled, the security admins who own the Resource Guard (Group2) must approve changes the Backup admins (Group1) make. Row 3 is false because "Disable soft delete" is a *Mandatory* MUA-protected operation that cannot be excluded — activating a Contributor PIM assignment grants RBAC on the vault but does not waive the MUA second-approval requirement, so a Group2 user must still approve. All three community comments (combined 6 👍) independently converge on No/Yes/No and MS Learn's critical-operations table confirms it. Confidence is held just below 90 because no official Suggested Answer is recorded and the reasoning depends on "all MUA controls enabled" covering the policy-modify operation.

More SC-100 practice questions