Microsoft SC-300 · Identity and Access Administrator · Updated 2026
Free SC-300 Identity and Access Administrator Practice Exam (2026)
Full-length SC-300 mock exams with a realistic number of questions and the real exam time. User identities, Conditional Access, workload identities and identity governance scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 1 hour 40 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Authentication & Access
Contoso is moving all new hires to passwordless sign-in. New users have no password and must register a passkey on their first day. What should IT give each new hire to complete registration?
Correct answer: C. A Temporary Access Pass
A Temporary Access Pass is a time-limited passcode that satisfies strong authentication, so users can register passwordless methods without a password. Email one-time passcode is a guest sign-in method, not an onboarding credential for members.
A Temporary Access Pass is a time-limited passcode that satisfies strong authentication, so users can register passwordless methods without a password. Email one-time passcode is a guest sign-in method, not an onboarding credential for members.
Question 2Identity Governance
Litware uses entitlement management. The marketing manager must add and manage resources and access packages for marketing only, without rights over other catalogs. What should you do?
Correct answer: B. Catalog owner of the marketing catalog
A catalog owner can manage resources and access packages in that catalog only. Identity Governance Administrator has rights over all of entitlement management, which is broader than needed.
A catalog owner can manage resources and access packages in that catalog only. Identity Governance Administrator has rights over all of entitlement management, which is broader than needed.
Question 3Workload Identities
Litware runs one Azure virtual machine that needs to read secrets from Azure Key Vault. The identity must be deleted automatically when the VM is deleted, and no credentials may be stored in code. What should you use?
Correct answer: D. A system-assigned managed identity
A system-assigned managed identity is tied to the lifecycle of one resource and is deleted with it. A user-assigned identity is a separate resource that remains after the VM is deleted.
A system-assigned managed identity is tied to the lifecycle of one resource and is deleted with it. A user-assigned identity is a separate resource that remains after the VM is deleted.
Question 4User Identities
Contoso has offices in Berlin and Madrid. Help desk staff in Madrid must reset passwords only for Madrid users and must not affect Berlin users. You need to minimize administrative effort. What should you configure?
Correct answer: A. Helpdesk Administrator scoped to a Madrid administrative unit
An administrative unit limits a role assignment to the users it contains, so the Madrid staff can reset only Madrid passwords. A custom role still needs a scope, and on its own at tenant level it would cover Berlin users too.
An administrative unit limits a role assignment to the users it contains, so the Madrid staff can reset only Madrid passwords. A custom role still needs a scope, and on its own at tenant level it would cover Berlin users too.
Question 5Authentication & Access
Fabrikam employees use smart cards with X.509 certificates issued by an internal PKI. Fabrikam wants users to sign in to Microsoft Entra ID with these certificates and plans to retire AD FS. What should you configure?
Correct answer: B. Microsoft Entra certificate-based authentication
Microsoft Entra certificate-based authentication validates user certificates directly in the cloud, so AD FS is no longer needed. FIDO2 keys use a different protocol and do not use the existing smart card certificates.
Microsoft Entra certificate-based authentication validates user certificates directly in the cloud, so AD FS is no longer needed. FIDO2 keys use a different protocol and do not use the existing smart card certificates.
Question 6Identity Governance
Adatum works with an external supplier that uses its own Microsoft Entra tenant. Supplier users must be able to request an access package, and Adatum wants guests created automatically on approval. What should you configure first?
Correct answer: A. A connected organization for the supplier
A connected organization lets users from that directory request access packages, and entitlement management creates the guest accounts on approval. Bulk invitations create guests up front instead of on demand.
A connected organization lets users from that directory request access packages, and entitlement management creates the guest accounts on approval. Bulk invitations create guests up front instead of on demand.
Question 7Workload Identities
Adatum wants users to consent to apps on their own, but only to apps from verified publishers that request low-impact permissions. All other apps must need administrator approval. Which setting should you configure?
Correct answer: D. Allow consent for verified publishers, selected permissions
This consent setting allows user consent only for verified publisher apps that request permissions classified as low impact. Do not allow user consent blocks all user consent, which is more restrictive than required.
This consent setting allows user consent only for verified publisher apps that request permissions classified as low impact. Do not allow user consent blocks all user consent, which is more restrictive than required.
Question 8User Identities
Fabrikam wants a developer to rotate the client secrets of one specific app registration. The developer must not be able to change any other app registration or other properties of that app. What should you do?
Correct answer: A. A custom role with credential update rights scoped to the app
A custom Microsoft Entra role can contain only the credential update permission and can be assigned at the scope of a single app registration. Application Administrator at tenant scope can manage every app in the tenant.
A custom Microsoft Entra role can contain only the credential update permission and can be assigned at the scope of a single app registration. Application Administrator at tenant scope can manage every app in the tenant.
Question 9Authentication & Access
Litware has a custom banned password list in Microsoft Entra ID. The security team wants the same list enforced when users change passwords on on-premises domain controllers. What should you deploy?
Correct answer: C. The Password Protection DC agent and proxy service
Microsoft Entra Password Protection uses a proxy service and DC agents to apply the global and custom banned lists on domain controllers. Password writeback sends cloud password changes to AD but does not enforce banned passwords for on-premises changes.
Microsoft Entra Password Protection uses a proxy service and DC agents to apply the global and custom banned lists on domain controllers. Password writeback sends cloud password changes to AD but does not enforce banned passwords for on-premises changes.
Question 10Identity Governance
Tailwind Traders gives auditors access to a SharePoint site through an access package. Access must end automatically 90 days after it is granted. What should you configure?
Correct answer: A. Expiration settings in the access package policy
The access package policy can set assignments to expire a set number of days after they start, which removes access automatically. An access review needs reviewers to act and does not end access on a fixed date.
The access package policy can set assignments to expire a set number of days after they start, which removes access automatically. An access review needs reviewers to act and does not end access on a fixed date.
Question 11Workload Identities
Tailwind Traders blocked user consent. Users now see an error when an app needs consent, and they ask how to request access. You want users to submit a request that designated reviewers can approve. What should you enable?
Correct answer: D. The admin consent workflow
The admin consent workflow lets users request consent and routes the request to designated reviewers for approval. Permission classifications only label permissions as low impact for user consent.
The admin consent workflow lets users request consent and routes the request to designated reviewers for approval. Permission classifications only label permissions as low impact for user consent.
Question 12User Identities
Litware needs a security group that automatically contains every user whose department is Sales and whose country is United States. Which membership rule should you use?
Correct answer: B. (user.department -eq "Sales") -and (user.country -eq "United States")
The -and operator requires both conditions, so only Sales users in the United States are added. The -or version would add every Sales user plus every user in the United States.
The -and operator requires both conditions, so only Sales users in the United States are added. The -or version would add every Sales user plus every user in the United States.
Question 13Authentication & Access
Adatum enabled self-service password reset for synchronized users. Users can complete the reset flow, but the new password does not work when they sign in to on-premises resources. What should you enable?
Correct answer: C. Password writeback
Password writeback sends passwords reset in the cloud back to on-premises AD so both locations match. Password hash sync works in the other direction, from AD to Microsoft Entra ID.
Password writeback sends passwords reset in the cloud back to on-premises AD so both locations match. Password hash sync works in the other direction, from AD to Microsoft Entra ID.
Question 14Identity Governance
Contoso must make sure guest users accept a legal agreement before they open the company's partner portal app for the first time. What should you use?
Correct answer: B. Terms of use enforced by Conditional Access
Terms of use can be required as a Conditional Access grant control, so guests must accept the document before access. Company branding text is shown on the sign-in page but does not record acceptance.
Terms of use can be required as a Conditional Access grant control, so guests must accept the document before access. Company branding text is shown on the sign-in page but does not record acceptance.
Question 15Workload Identities
Contoso has an on-premises web app that uses Integrated Windows Authentication. Remote users must reach it from the internet with Microsoft Entra preauthentication and Conditional Access. No inbound firewall ports may be opened. What should you deploy?
Correct answer: D. Microsoft Entra application proxy
Application proxy uses an outbound-only connector, so no inbound ports are needed, and it applies Entra preauthentication and Conditional Access. Application Gateway needs inbound connectivity and does not preauthenticate with Entra ID.
Application proxy uses an outbound-only connector, so no inbound ports are needed, and it applies Entra preauthentication and Conditional Access. Application Gateway needs inbound connectivity and does not preauthenticate with Entra ID.
Question 16User Identities
Adatum hires about 40 people each month and wants new staff in the Finance department to receive a Microsoft 365 E5 license automatically. Licenses must be removed when users leave Finance. You need to minimize administrative effort. What should you implement?
Correct answer: B. Group-based licensing on a dynamic group for Finance
Group-based licensing on a dynamic group adds and removes the license as users enter or leave the group, with no manual work. A scheduled script works but adds maintenance, which fails the minimal effort requirement.
Group-based licensing on a dynamic group adds and removes the license as users enter or leave the group, with no manual work. A scheduled script works but adds maintenance, which fails the minimal effort requirement.
Question 17Authentication & Access
Tailwind Traders created a Conditional Access policy that blocks legacy authentication. Before enforcing it, the team wants to see in the sign-in logs which users would be affected, without blocking anyone. What should you do?
Correct answer: C. Set the policy to Report-only
Report-only mode evaluates the policy at every sign-in and logs the result without enforcing it. The What If tool tests single simulated sign-ins and does not show impact across real traffic.
Report-only mode evaluates the policy at every sign-in and logs the result without enforcing it. The What If tool tests single simulated sign-ins and does not show impact across real traffic.
Question 18Identity Governance
Fabrikam runs a quarterly access review of a finance app. When reviewers deny a user, the user must lose the app assignment without anyone making manual changes. What should you enable?
Correct answer: A. Auto apply results to resource
Auto apply results removes denied users from the resource when the review ends. Show recommendations only helps reviewers decide and does not apply decisions.
Auto apply results removes denied users from the resource when the review ends. Show recommendations only helps reviewers decide and does not apply decisions.
Question 19Workload Identities
Fabrikam developers are building a React single-page app that signs in users with the authorization code flow with PKCE. Which platform should they add when configuring the redirect URI in the app registration?
Correct answer: D. Single-page application
The single-page application platform supports the authorization code flow with PKCE and CORS for browser apps. The Web platform is for server-side apps that can keep a secret.
The single-page application platform supports the authorization code flow with PKCE and CORS for browser apps. The Web platform is for server-side apps that can keep a secret.
Question 20Authentication & Access
Northwind Traders requires users on unmanaged devices to sign in again every four hours when they use the Azure portal. Which Conditional Access setting should you configure?
Correct answer: A. Sign-in frequency session control
The sign-in frequency session control sets how often users must reauthenticate. Persistent browser session controls whether a browser session stays signed in after the browser is closed, not a fixed reauthentication period.
The sign-in frequency session control sets how often users must reauthenticate. Persistent browser session controls whether a browser session stays signed in after the browser is closed, not a fixed reauthentication period.
Question 21User Identities
Tailwind Traders wants to tag users with a project code that is sensitive. Only a small team of compliance admins should be able to assign and read the values, and even Global Administrators should not see them by default. What should you use?
Correct answer: C. Custom security attributes
Custom security attributes need dedicated roles such as Attribute Assignment Administrator, and Global Administrators do not get access by default. Directory extension attributes can be read by anyone who can read user objects.
Custom security attributes need dedicated roles such as Attribute Assignment Administrator, and Global Administrators do not get access by default. Directory extension attributes can be read by anyone who can read user objects.
Question 22Identity Governance
Northwind Traders has hundreds of Microsoft 365 groups and many contain guests. You need one recurring review that covers guest membership in every Microsoft 365 group, including new groups. What should you configure as the review scope?
Correct answer: D. All Microsoft 365 groups with guest users
This scope reviews guests in all Microsoft 365 groups and picks up new groups automatically. Selecting each group manually misses groups created later and adds effort.
This scope reviews guests in all Microsoft 365 groups and picks up new groups automatically. Selecting each group manually misses groups created later and adds effort.
Question 23Workload Identities
Northwind Traders has a nightly background service that reads all users' calendars through Microsoft Graph. No user is signed in when it runs. Which type of permission should the app registration request?
Correct answer: D. Application permissions with admin consent
A daemon with no signed-in user needs application permissions, which always need admin consent. Delegated permissions act on behalf of a signed-in user, so they cannot work here.
A daemon with no signed-in user needs application permissions, which always need admin consent. Delegated permissions act on behalf of a signed-in user, so they cannot work here.
Question 24Authentication & Access
Contoso stores merger documents in a SharePoint site with a highly confidential sensitivity label. Users must perform phishing-resistant MFA when they open that site, but not for other SharePoint sites. What should you use in Conditional Access?
Correct answer: B. An authentication context
An authentication context can be linked to the sensitivity label of the site and targeted by a Conditional Access policy, so stronger auth applies only to that site. App enforced restrictions limit features on unmanaged devices and do not step up authentication.
An authentication context can be linked to the sensitivity label of the site and targeted by a Conditional Access policy, so stronger auth applies only to that site. App enforced restrictions limit features on unmanaged devices and do not step up authentication.
Question 25Identity Governance
Litware wants administrators to hold the Exchange Administrator role only when they need it. Administrators must turn on the role themselves for a limited time. Which assignment type should you use in Privileged Identity Management?
Correct answer: C. Eligible
Eligible assignments require the user to activate the role for a limited time before using it. Active assignments give the permissions immediately without activation.
Eligible assignments require the user to activate the role for a limited time before using it. Active assignments give the permissions immediately without activation.
Question 26User Identities
Northwind Traders allows employees to use personal Windows laptops to access Microsoft 365. The company does not own these devices and does not want users to sign in to Windows with their work account. How should the devices be connected to Microsoft Entra ID?
Correct answer: D. Microsoft Entra registered
Microsoft Entra registration is designed for personal devices, where users keep their local or personal account and add a work account. Entra join would make the work account the Windows sign-in, which the company does not want.
Microsoft Entra registration is designed for personal devices, where users keep their local or personal account and add a work account. Entra join would make the work account the Windows sign-in, which the company does not want.
Question 27Authentication & Access
Fabrikam wants all users with administrator roles to sign in only with FIDO2 security keys, Windows Hello for Business or certificate-based authentication. Other MFA methods must not satisfy the policy. What should you configure in the Conditional Access grant controls?
Correct answer: C. Require authentication strength
The authentication strength grant control can require the built-in phishing-resistant MFA strength, which accepts only those methods. Require multifactor authentication accepts any MFA method, including SMS.
The authentication strength grant control can require the built-in phishing-resistant MFA strength, which accepts only those methods. Require multifactor authentication accepts any MFA method, including SMS.
Question 28Workload Identities
Litware runs an app on an on-premises server that calls Microsoft Graph with its own app registration. Managed identities are not available, and security wants to avoid shared secrets stored in configuration files. Which credential should you add?
Correct answer: B. A certificate
A certificate proves the app's identity with a private key and is the recommended credential over a client secret. A client secret is a shared string that is easy to leak from configuration files.
A certificate proves the app's identity with a private key and is the recommended credential over a client secret. A client secret is a shared string that is easy to leak from configuration files.
Question 29Identity Governance
Adatum uses PIM for the Global Administrator role. Each activation must be approved by the security lead before the role becomes active. Where should you configure this?
Correct answer: C. In the role settings in PIM
PIM role settings include an option to require approval to activate and to choose approvers. Conditional Access can add authentication requirements but cannot route approvals.
PIM role settings include an option to require approval to activate and to choose approvers. Conditional Access can add authentication requirements but cannot route approvals.
Question 30User Identities
Contoso users invite many guests. Security requires that guests can be invited only from three named partner domains. All other domains must be blocked. What should you configure?
Correct answer: A. Allowed domains in external collaboration settings
Collaboration restrictions in the external collaboration settings let you allow invitations only to specified domains. Guest user access restrictions control what guests can see in the directory, not who can be invited.
Collaboration restrictions in the external collaboration settings let you allow invitations only to specified domains. Guest user access restrictions control what guests can see in the directory, not who can be invited.
Question 31Authentication & Access
Litware wants access to Exchange Online and SharePoint Online to end within minutes when an account is disabled or a password is reset, instead of waiting for the access token to expire. What provides this?
Correct answer: B. Continuous access evaluation
Continuous access evaluation lets supported services such as Exchange Online and SharePoint Online react to critical events like account disablement in near real time. Shorter sign-in frequency still waits for the next reauthentication.
Continuous access evaluation lets supported services such as Exchange Online and SharePoint Online react to critical events like account disablement in near real time. Shorter sign-in frequency still waits for the next reauthentication.
Question 32Workload Identities
Adatum uses a SaaS HR app that supports SCIM 2.0. Accounts in the app must be created when users are assigned in Microsoft Entra ID and disabled when they are unassigned. What should you configure on the enterprise app?
Correct answer: A. Automatic user provisioning
Automatic provisioning uses SCIM to create, update and disable accounts in the SaaS app based on assignments. SAML SSO handles sign-in only and does not manage the account lifecycle.
Automatic provisioning uses SCIM to create, update and disable accounts in the SaaS app based on assignments. SAML SSO handles sign-in only and does not manage the account lifecycle.
Question 33Identity Governance
Tailwind Traders controls access to a payroll app through a security group. Users must join the group only when needed, for up to four hours, with justification. What should you use?
Correct answer: C. PIM for Groups
PIM for Groups gives just-in-time, time-limited group membership with activation settings such as justification. Self-service group management lets users join groups but not for a limited time.
PIM for Groups gives just-in-time, time-limited group membership with activation settings such as justification. Self-service group management lets users join groups but not for a limited time.
Question 34Authentication & Access
Adatum licenses Microsoft Entra ID P2. Users that ID Protection flags with high user risk must remediate the risk themselves by changing their password after MFA. What should you create?
Correct answer: D. A Conditional Access policy with the user risk condition
A Conditional Access policy that uses the user risk condition with the require password change control lets users remediate a compromised account. Sign-in risk relates to a single sign-in attempt, not the account itself.
A Conditional Access policy that uses the user risk condition with the require password change control lets users remediate a compromised account. Sign-in risk relates to a single sign-in attempt, not the account itself.
Question 35User Identities
Fabrikam has three Microsoft Entra tenants in one multitenant organization. Users created in the main tenant must appear automatically as members in the other two tenants so they can use apps there. You need to minimize administrative effort. What should you implement?
Correct answer: D. Cross-tenant synchronization
Cross-tenant synchronization automatically creates, updates and removes B2B users in target tenants based on the source tenant. Bulk invitations are a one-time action and must be repeated for every new user.
Cross-tenant synchronization automatically creates, updates and removes B2B users in target tenants based on the source tenant. Bulk invitations are a one-time action and must be repeated for every new user.
Question 36Workload Identities
Tailwind Traders gives HR staff access to eight apps. HR staff want these apps grouped in one section of the My Apps portal instead of mixed with other apps. What should you create?
Correct answer: A. A My Apps collection
My Apps collections group apps into named sections in the portal for chosen users or groups. An access package catalog organizes resources for requests, not how apps appear in My Apps.
My Apps collections group apps into named sections in the portal for chosen users or groups. An access package catalog organizes resources for requests, not how apps appear in My Apps.
Question 37Identity Governance
Contoso is creating emergency access accounts for when MFA or federation fails. How should these accounts be configured?
Correct answer: B. Cloud-only accounts on the onmicrosoft.com domain
Emergency access accounts should be cloud-only on the onmicrosoft.com domain so they do not depend on on-premises systems or federation. Synced or federated accounts fail if the on-premises environment is down.
Emergency access accounts should be cloud-only on the onmicrosoft.com domain so they do not depend on on-premises systems or federation. Synced or federated accounts fail if the on-premises environment is down.
Question 38Authentication & Access
Tailwind Traders uses a VPN to give remote staff access to on-premises file shares and internal web apps. The company wants to replace the VPN with identity-centric Zero Trust access controlled by Conditional Access. What should you deploy?
Correct answer: D. Microsoft Entra Private Access
Microsoft Entra Private Access gives Conditional Access controlled access to private apps over any protocol, including file shares. Application proxy publishes only web apps, so it cannot replace the VPN for file shares.
Microsoft Entra Private Access gives Conditional Access controlled access to private apps over any protocol, including file shares. Application proxy publishes only web apps, so it cannot replace the VPN for file shares.
Question 39User Identities
Litware works with a partner whose users authenticate with a third-party identity provider that supports SAML 2.0. The partner does not use Microsoft Entra ID. Litware wants partner users to sign in as guests with their existing partner credentials. What should you configure?
Correct answer: C. SAML/WS-Fed identity provider federation
SAML/WS-Fed IdP federation lets guests authenticate with any external identity provider that supports those protocols. Cross-tenant access settings apply only to other Microsoft Entra tenants.
SAML/WS-Fed IdP federation lets guests authenticate with any external identity provider that supports those protocols. Cross-tenant access settings apply only to other Microsoft Entra tenants.
Question 40Workload Identities
Contoso suspects employees use unapproved cloud storage services. The security team wants to analyze traffic logs from its firewalls to find which cloud apps are in use and how risky they are. What should you use?
Correct answer: B. Cloud Discovery in Defender for Cloud Apps
Cloud Discovery analyzes firewall and proxy logs to identify cloud apps in use and rates them against a risk catalog. Entra sign-in logs only show apps that use Entra ID for sign-in.
Cloud Discovery analyzes firewall and proxy logs to identify cloud apps in use and rates them against a risk catalog. Entra sign-in logs only show apps that use Entra ID for sign-in.
Question 41Identity Governance
Fabrikam must keep Microsoft Entra sign-in and audit logs for two years and query them with KQL alongside other security data. What should you configure?
Correct answer: C. Diagnostic settings to a Log Analytics workspace
Diagnostic settings can stream Entra logs to Log Analytics, where you set long retention and query with KQL. Retention in the Entra admin center itself is fixed at 30 days and cannot be raised to two years.
Diagnostic settings can stream Entra logs to Log Analytics, where you set long retention and query with KQL. Retention in the Entra admin center itself is fixed at 30 days and cannot be raised to two years.
Question 42Authentication & Access
A Contoso employee reports that a laptop with active Microsoft 365 sessions was stolen. You need to invalidate the user's refresh tokens so all apps require a new sign-in. What should you do first?
Correct answer: A. Revoke the user's sessions
Revoking sessions invalidates refresh tokens and session cookies, forcing reauthentication everywhere. Resetting MFA methods only requires the user to register again and does not end existing sessions.
Revoking sessions invalidates refresh tokens and session cookies, forcing reauthentication everywhere. Resetting MFA methods only requires the user to register again and does not end existing sessions.
Question 43User Identities
Adatum syncs users from Active Directory Domain Services to Microsoft Entra ID. Security requires that on-premises logon hours and account disable actions take effect immediately for cloud sign-ins. The company does not want to deploy AD FS. Which sign-in method should you use?
Correct answer: B. Pass-through authentication
Pass-through authentication validates each sign-in against on-premises AD, so logon hours and disabled accounts are enforced at once. Password hash sync validates in the cloud, so on-premises account restrictions are not checked at sign-in.
Pass-through authentication validates each sign-in against on-premises AD, so logon hours and disabled accounts are enforced at once. Password hash sync validates in the cloud, so on-premises account restrictions are not checked at sign-in.
Question 44Workload Identities
Fabrikam allows contractors to open Salesforce from unmanaged devices but they must not download files labeled confidential. Users should still be able to browse records. What should you configure in Microsoft Defender for Cloud Apps?
Correct answer: A. A session policy
A session policy works with Conditional Access app control to monitor and block actions, such as downloads, in real time. An access policy decides whether the session is allowed at all, so it cannot allow browsing while blocking downloads.
A session policy works with Conditional Access app control to monitor and block actions, such as downloads, in real time. An access policy decides whether the session is allowed at all, so it cannot allow browsing while blocking downloads.
Question 45Identity Governance
Northwind Traders sends Microsoft Entra logs to Log Analytics. An analyst needs to list only failed sign-ins. Which query should the analyst use?
Correct answer: C. SigninLogs | where ResultType != "0"
In the SigninLogs table a ResultType of 0 means success, so any other value means a failed sign-in. AuditLogs records directory changes, not sign-in attempts.
In the SigninLogs table a ResultType of 0 means success, so any other value means a failed sign-in. AuditLogs records directory changes, not sign-in attempts.
Question 46Authentication & Access
Fabrikam has more than 30 Conditional Access policies. A user reports being blocked when signing in from a hotel. You need to find which policies would apply to that sign-in from that country without asking the user to try again. What should you use?
Correct answer: B. The What If tool
The What If tool simulates a sign-in with a chosen user, app, location and device and shows which policies apply. Report-only mode logs future sign-ins and does not simulate a specific scenario.
The What If tool simulates a sign-in with a chosen user, app, location and device and shows which policies apply. Report-only mode logs future sign-ins and does not simulate a specific scenario.
Question 47User Identities
Tailwind Traders acquired two companies, each with its own Active Directory forest. There is no network connectivity or trust between the forests. Users from all forests must be provisioned to one Microsoft Entra tenant using lightweight agents. What should you deploy?
Correct answer: D. Microsoft Entra Cloud Sync
Cloud Sync uses lightweight provisioning agents and supports multiple disconnected forests. Entra Connect Sync needs a single server with line of sight to all forests, which these forests do not have.
Cloud Sync uses lightweight provisioning agents and supports multiple disconnected forests. Entra Connect Sync needs a single server with line of sight to all forests, which these forests do not have.
Question 48Workload Identities
Northwind Traders wants alerts when OAuth apps in Microsoft 365 have high privileges but rarely use them, or show unusual Graph API activity. What should you use?
Correct answer: A. App governance in Microsoft Defender for Cloud Apps
App governance monitors OAuth app permissions and Graph API usage and flags overprivileged or unusual apps. The admin consent workflow handles new consent requests but does not monitor app behavior over time.
App governance monitors OAuth app permissions and Graph API usage and flags overprivileged or unusual apps. The admin consent workflow handles new consent requests but does not monitor app behavior over time.
Question 49Identity Governance
Litware wants new employees to receive a Temporary Access Pass that is emailed to their manager one day before their start date. You need to automate this based on the employeeHireDate attribute. What should you use?
Correct answer: B. A lifecycle workflow with the pre-hire template
Lifecycle workflows run tasks relative to employeeHireDate, and the pre-hire onboarding template can generate a TAP and send it to the manager. An automatic assignment policy grants access packages but cannot generate a TAP.
Lifecycle workflows run tasks relative to employeeHireDate, and the pre-hire onboarding template can generate a TAP and send it to the manager. An automatic assignment policy grants access packages but cannot generate a TAP.
Question 50Authentication & Access
Northwind Traders wants all users to set up MFA within 14 days of their first sign-in. The company has Microsoft Entra ID P2 and wants a built-in way to prompt users to register. What should you configure?
Correct answer: D. The ID Protection MFA registration policy
The ID Protection MFA registration policy prompts targeted users to register MFA at sign-in. A sign-in risk policy only triggers MFA when a risky sign-in is detected and does not drive registration on its own.
The ID Protection MFA registration policy prompts targeted users to register MFA at sign-in. A sign-in risk policy only triggers MFA when a risky sign-in is detected and does not drive registration on its own.
The real SC-300 exam at a glance
50questions
1h 40mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Cyber Security practice tests
CEH v13 Practice Test125 questions · 312-50CISSP Practice Test150 questions · 2024 outlineCompTIA Security+ Practice Test90 questions · SY0-701 & SY0-801CompTIA CySA+ Practice Test85 questions · CS0-004CompTIA SecurityX Practice Test90 questions · CAS-005CHFI v11 Practice Test150 questions · 312-49
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the SC-300 exam. They are not real exam questions. SC-300 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 100 minutes · passing score 700 on a 1-1000 scale · the real exam can include case studies.