SC-300 Practice Test 1 — 10 Questions

Question 1

An organization uses Microsoft Entra ID and needs to create external user accounts for contractors. The contractors should be invited by a select group of non-administrator employees without granting them full User Administrator privileges. Which administrative role should you assign to these employees?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Guest Inviter. Assigning the Guest Inviter role allows designated non-administrator employees to securely invite external B2B collaboration users without escalating their privileges to full User Administrator. This implements the principle of least privilege while enabling decentralized partner onboarding, reducing administrative overhead for core IT teams in enterprise environments.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Directory Readers

Question 2

Your company, Fabrikam, Inc., has acquired another firm. You need to invite 500 external contractors to your Microsoft Entra ID tenant to access specific applications. You want to ensure that these users are categorized as guests and cannot browse the full directory. Which feature should you configure first to enforce these restrictions tenant-wide?

Accepted Answer

Guest user access restrictions. External collaboration settings within Microsoft Entra ID allow administrators to define the level of access guest users have to the directory. By default, guests have limited permissions, but these can be further restricted to prevent them from seeing any directory information outside of their own profile. This ensures data privacy and limits the potential for internal discovery by external entities.

Answer

Administrative Units

Answer

Conditional Access policies

Answer

Entitlement Management

Question 3

You have a large Microsoft Entra ID tenant with 10,000 users. You need to delegate the ability to reset passwords for users in the 'Seattle' office to a local IT lead, without granting them administrative rights over users in other offices. What should you create?

Accepted Answer

An Administrative Unit containing the Seattle users. Administrative Units (AUs) provide a way to define a boundary within a Microsoft Entra ID tenant for the purpose of delegating administrative permissions. This is essential for large organizations that need to distribute IT tasks to local administrators while maintaining the principle of least privilege across the entire global directory.

Answer

A new Custom Role with a scope of the entire directory

Answer

A Dynamic Security Group containing the Seattle users

Answer

A Conditional Access policy targeting the Seattle location

Question 4

You need to store specialized metadata for users in Microsoft Entra ID that is not available in the standard user profile attributes. This metadata must be accessible via the Microsoft Graph API and must support fine-grained access control so only specific administrators can read or write the data. Which THREE steps are required to implement Custom Security Attributes?

Accepted Answer

Assign the Attribute Definition Administrator role. Custom security attributes offer a way to extend the user schema with highly secure, controlled data. Unlike extension attributes, these support RBAC for the attributes themselves. This allows sensitive data, like employee IDs or clearance levels, to be stored on the user object while strictly limiting who can interact with that specific metadata.

Answer

Configure a new Schema Extension using the Azure AD Graph API

Answer

Create a new Directory Extension in Microsoft Entra Connect

Question 5

Refer to the exhibit. You are reviewing a custom role definition intended for a security auditor. What is the specific effect of the permission defined in the 'operations' array?

Accepted Answer

The role can read the actual values of custom security attributes assigned to users and other directory objects.. Custom security attributes in Microsoft Entra ID allow for the storage of sensitive metadata that is not visible to standard users or even Global Administrators by default. Understanding the specific RBAC actions required to read or write these attributes is essential for maintaining a secure environment where sensitive data like 'Salary Grade' or 'Clearance Level' is protected.

Answer

The role can view the definitions and allowed values of all custom security attributes in the tenant.

Answer

The role can assign new custom security attribute values to users but cannot modify existing ones.

Answer

The role can only read custom security attributes if they are also a member of the Attribute Definition Administrator role.

Question 6

A company wants to implement advanced identity management features for their users. You are evaluating the differences between Microsoft Entra ID P1 and P2 licenses. Which TWO features are ONLY available with the Microsoft Entra ID P2 license?

Accepted Answer

Microsoft Entra ID Protection (Risk-based Conditional Access). Microsoft Entra ID P2 includes all P1 features plus advanced identity protection and governance capabilities. Understanding these differences is crucial for administrators to ensure they have the necessary licensing for high-security environments, specifically regarding automated risk detection and administrative access control through Privileged Identity Management.

Answer

Self-Service Password Reset (SSPR) for cloud users

Answer

Conditional Access based on user location and device state

Answer

Application Proxy for accessing on-premises web applications

Question 7

You are managing guest users in Microsoft Entra ID. Which TWO statements accurately describe the properties and behaviors of guest user accounts compared to member user accounts?

Accepted Answer

Guest users have the 'UserType' attribute set to 'Guest' by default.. Guest accounts (B2B collaboration) are fundamentally different from standard member accounts in how they are managed and how they interact with the directory. Understanding these nuances, such as the UserType attribute and authentication source, is essential for implementing secure external access and managing the identity lifecycle effectively.

Answer

Guest users always authenticate against the inviting tenant's identity provider.

Answer

Guest users are automatically added to the 'All Users' dynamic group.

Answer

Guest users cannot be assigned to Administrative Units.

Question 8

You need to delegate the ability to reset passwords for users in the 'Sales' department to a local helpdesk lead. You want to ensure the helpdesk lead cannot manage users in any other department. What should you create?

Accepted Answer

An Administrative Unit (AU) and add the Sales users to it.. Administrative Units (AUs) provide a way to define a boundary for administrative delegation within a Microsoft Entra tenant. This is vital for large organizations that need to distribute management tasks to regional or departmental IT staff without granting them broad permissions across the entire directory, adhering to the principle of least privilege.

Answer

A dynamic security group containing all Sales users.

Answer

A Custom Role with the 'microsoft.directory/users/password/update' permission.

Answer

An Access Package in Entra ID Governance.

Question 9

You are configuring External Collaboration settings in Microsoft Entra ID. You want to ensure that only specific partner domains can be invited as guests, and that guest users have the most restricted access to the directory. Which THREE settings should you configure?

Accepted Answer

Set 'Guest user access is restricted to properties and memberships of their own directory objects'.. Securing external identities involves a multi-layered approach that controls both who can be invited and what those individuals can see once they are in the tenant. These settings are found in the External Collaboration settings and are vital for preventing data leakage and ensuring that guest access aligns with organizational security policies.

Answer

Disable the 'External user' account type in the User Settings blade.

Answer

Enable 'Self-service sign-up via user flows' for all external users.

Question 10

You are creating a dynamic user group in Microsoft Entra ID to automatically include all users from the Marketing department who are located in either London or Paris. Which syntax should you use for the membership rule?

Accepted Answer

(user.department -eq "Marketing") -and (user.city -in ["London", "Paris"]). Dynamic groups use a rule-based system to manage membership automatically, which is essential for scaling identity management in large organizations. Mastering the syntax for these rules allows administrators to ensure that users receive the correct access to resources and applications based on their current attributes without manual intervention by the IT staff.

Answer

(user.department -match "Marketing") -or (user.city -eq "London") -or (user.city -eq "Paris")

Answer

user.department -eq "Marketing" -and user.city -eq "London" -and user.city -eq "Paris"

Answer

user.department -contains "Marketing" -and user.city -contains "London, Paris"