SC-300 Practice Exam 1 — 20 Questions

Question 1

An organization uses Microsoft Entra ID and needs to create external user accounts for contractors. The contractors should be invited by a select group of non-administrator employees without granting them full User Administrator privileges. Which administrative role should you assign to these employees?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Guest Inviter. Assigning the Guest Inviter role allows designated non-administrator employees to securely invite external B2B collaboration users without escalating their privileges to full User Administrator. This implements the principle of least privilege while enabling decentralized partner onboarding, reducing administrative overhead for core IT teams in enterprise environments.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Directory Readers

Question 2

Your company, Fabrikam, Inc., has acquired another firm. You need to invite 500 external contractors to your Microsoft Entra ID tenant to access specific applications. You want to ensure that these users are categorized as guests and cannot browse the full directory. Which feature should you configure first to enforce these restrictions tenant-wide?

Accepted Answer

Guest user access restrictions. External collaboration settings within Microsoft Entra ID allow administrators to define the level of access guest users have to the directory. By default, guests have limited permissions, but these can be further restricted to prevent them from seeing any directory information outside of their own profile. This ensures data privacy and limits the potential for internal discovery by external entities.

Answer

Administrative Units

Answer

Conditional Access policies

Answer

Entitlement Management

Question 3

Your organization is implementing Self-Service Password Reset (SSPR). You want to ensure that users can only reset their passwords if they have registered at least two different authentication methods. Which configuration should you modify in the Microsoft Entra admin center to enforce this?

Accepted Answer

Number of methods required to reset in the SSPR properties. In the Microsoft Entra admin center, under 'Password reset' > 'Authentication methods', the setting is explicitly named 'Number of methods required to reset'. The option text provided is correct, but the explanation claims it is 'slightly imprecise', which is confusing for the candidate. The explanation should confirm the option matches the UI exactly.

Answer

The 'Registration' tab in the Password Reset settings

Answer

The 'Combined security information registration' policy

Answer

Conditional Access policies for the 'My Profile' application

Question 4

You have a large Microsoft Entra ID tenant with 10,000 users. You need to delegate the ability to reset passwords for users in the 'Seattle' office to a local IT lead, without granting them administrative rights over users in other offices. What should you create?

Accepted Answer

An Administrative Unit containing the Seattle users. Administrative Units (AUs) provide a way to define a boundary within a Microsoft Entra ID tenant for the purpose of delegating administrative permissions. This is essential for large organizations that need to distribute IT tasks to local administrators while maintaining the principle of least privilege across the entire global directory.

Answer

A new Custom Role with a scope of the entire directory

Answer

A Dynamic Security Group containing the Seattle users

Answer

A Conditional Access policy targeting the Seattle location

Question 5

You need to store specialized metadata for users in Microsoft Entra ID that is not available in the standard user profile attributes. This metadata must be accessible via the Microsoft Graph API and must support fine-grained access control so only specific administrators can read or write the data. Which THREE steps are required to implement Custom Security Attributes?

Accepted Answer

Assign the Attribute Definition Administrator role. Custom security attributes offer a way to extend the user schema with highly secure, controlled data. Unlike extension attributes, these support RBAC for the attributes themselves. This allows sensitive data, like employee IDs or clearance levels, to be stored on the user object while strictly limiting who can interact with that specific metadata.

Answer

Configure a new Schema Extension using the Azure AD Graph API

Answer

Create a new Directory Extension in Microsoft Entra Connect

Question 6

Refer to the exhibit. You are reviewing a custom role definition intended for a security auditor. What is the specific effect of the permission defined in the 'operations' array?

Accepted Answer

The role can read the actual values of custom security attributes assigned to users and other directory objects.. Custom security attributes in Microsoft Entra ID allow for the storage of sensitive metadata that is not visible to standard users or even Global Administrators by default. Understanding the specific RBAC actions required to read or write these attributes is essential for maintaining a secure environment where sensitive data like 'Salary Grade' or 'Clearance Level' is protected.

Answer

The role can view the definitions and allowed values of all custom security attributes in the tenant.

Answer

The role can assign new custom security attribute values to users but cannot modify existing ones.

Answer

The role can only read custom security attributes if they are also a member of the Attribute Definition Administrator role.

Question 7

A company wants to implement advanced identity management features for their users. You are evaluating the differences between Microsoft Entra ID P1 and P2 licenses. Which TWO features are ONLY available with the Microsoft Entra ID P2 license?

Accepted Answer

Microsoft Entra ID Protection (Risk-based Conditional Access). Microsoft Entra ID P2 includes all P1 features plus advanced identity protection and governance capabilities. Understanding these differences is crucial for administrators to ensure they have the necessary licensing for high-security environments, specifically regarding automated risk detection and administrative access control through Privileged Identity Management.

Answer

Self-Service Password Reset (SSPR) for cloud users

Answer

Conditional Access based on user location and device state

Answer

Application Proxy for accessing on-premises web applications

Question 8

You are managing guest users in Microsoft Entra ID. Which TWO statements accurately describe the properties and behaviors of guest user accounts compared to member user accounts?

Accepted Answer

Guest users have the 'UserType' attribute set to 'Guest' by default.. Guest accounts (B2B collaboration) are fundamentally different from standard member accounts in how they are managed and how they interact with the directory. Understanding these nuances, such as the UserType attribute and authentication source, is essential for implementing secure external access and managing the identity lifecycle effectively.

Answer

Guest users always authenticate against the inviting tenant's identity provider.

Answer

Guest users are automatically added to the 'All Users' dynamic group.

Answer

Guest users cannot be assigned to Administrative Units.

Question 9

You need to delegate the ability to reset passwords for users in the 'Sales' department to a local helpdesk lead. You want to ensure the helpdesk lead cannot manage users in any other department. What should you create?

Accepted Answer

An Administrative Unit (AU) and add the Sales users to it.. Administrative Units (AUs) provide a way to define a boundary for administrative delegation within a Microsoft Entra tenant. This is vital for large organizations that need to distribute management tasks to regional or departmental IT staff without granting them broad permissions across the entire directory, adhering to the principle of least privilege.

Answer

A dynamic security group containing all Sales users.

Answer

A Custom Role with the 'microsoft.directory/users/password/update' permission.

Answer

An Access Package in Entra ID Governance.

Question 10

You are configuring External Collaboration settings in Microsoft Entra ID. You want to ensure that only specific partner domains can be invited as guests, and that guest users have the most restricted access to the directory. Which THREE settings should you configure?

Accepted Answer

Set 'Guest user access is restricted to properties and memberships of their own directory objects'.. Securing external identities involves a multi-layered approach that controls both who can be invited and what those individuals can see once they are in the tenant. These settings are found in the External Collaboration settings and are vital for preventing data leakage and ensuring that guest access aligns with organizational security policies.

Answer

Disable the 'External user' account type in the User Settings blade.

Answer

Enable 'Self-service sign-up via user flows' for all external users.

Question 11

You are creating a dynamic user group in Microsoft Entra ID to automatically include all users from the Marketing department who are located in either London or Paris. Which syntax should you use for the membership rule?

Accepted Answer

(user.department -eq "Marketing") -and (user.city -in ["London", "Paris"]). Dynamic groups use a rule-based system to manage membership automatically, which is essential for scaling identity management in large organizations. Mastering the syntax for these rules allows administrators to ensure that users receive the correct access to resources and applications based on their current attributes without manual intervention by the IT staff.

Answer

(user.department -match "Marketing") -or (user.city -eq "London") -or (user.city -eq "Paris")

Answer

user.department -eq "Marketing" -and user.city -eq "London" -and user.city -eq "Paris"

Answer

user.department -contains "Marketing" -and user.city -contains "London, Paris"

Question 12

You want to allow external users to sign in to your Microsoft Entra tenant using their Google accounts. Which TWO steps are required to configure Google federation?

Accepted Answer

Create a Google Cloud Platform project and obtain a Client ID and Client Secret.. Federating with social identity providers like Google improves the onboarding experience for B2B guests by allowing them to use familiar credentials. This reduces the need for them to manage a separate password for your tenant and leverages the security features of their existing identity provider, such as Google's own multi-factor authentication.

Answer

Enable the 'Email one-time passcode for guests' setting in the Entra admin center.

Answer

Assign a Microsoft Entra ID P2 license to every Google user who will sign in.

Answer

Configure a custom domain in Entra ID that matches the @gmail.com suffix.

Question 13

You are configuring Self-Service Password Reset (SSPR) for your organization. You want to provide users with the maximum variety of authentication methods. Which THREE of the following are valid authentication methods available for SSPR in Microsoft Entra ID?

Accepted Answer

Security questions. Microsoft Entra ID SSPR supports Mobile app notification, Mobile app code, Email, Mobile phone, and Office phone. Security questions are a legacy method that is not recommended and often disabled, but technically available; however, FIDO2 security keys are NOT supported for SSPR. Smart cards are also not a supported SSPR method.

Answer

Smart cards

Answer

FIDO2 security keys

Question 14

You are assigning a Microsoft 365 Business Premium license to a new user. The assignment fails with an error stating that the usage location is not set. Why is the 'Usage Location' attribute mandatory for license assignment?

Accepted Answer

Microsoft uses it to comply with local regulations and verify service availability in the user's region.. The 'Usage Location' attribute is not just a metadata field; it has legal and functional implications for Microsoft services. Microsoft must comply with local laws and regulations regarding data residency and service availability, which varies by country. Setting this correctly is a prerequisite for any license-based resource provisioning in Entra ID.

Answer

It determines the physical data center where the user's mailbox will be hosted.

Answer

It is used to automatically set the user's time zone and language in Outlook.

Answer

It is required for the user to be able to register for Multi-Factor Authentication.

Question 15

An administrator accidentally deletes a cloud-only user account from the Microsoft Entra admin center. How many days does the administrator have to restore the user account before it is permanently deleted?

Accepted Answer

30 days. Microsoft Entra ID implements a 'soft-delete' state for deleted users, providing a safety net for accidental deletions. Knowing the exact duration of this window is fundamental for identity recovery operations. After this period, the object and its associated data are purged and cannot be recovered through standard administrative tools.

Answer

7 days

Answer

14 days

Answer

90 days

Question 16

Your organization has a hybrid environment with Microsoft Entra Connect syncing on-premises Active Directory users to the cloud. You need to update the 'Department' attribute for a synchronized user. When you attempt to change this in the Microsoft Entra admin center, the field is grayed out. What is the most appropriate action to resolve this?

Accepted Answer

Modify the attribute in the on-premises Active Directory and wait for the next synchronization cycle.. Managing user identities in a hybrid environment requires understanding where the source of authority resides for specific objects. When accounts are synchronized from on-premises Active Directory to Microsoft Entra ID, most attributes cannot be modified directly in the cloud portal. This ensures data consistency across the hybrid identity infrastructure and prevents synchronization conflicts that could disrupt user access.

Answer

Assign the User Administrator role to your account to override the synchronization lock.

Answer

Disable the Microsoft Entra Connect sync temporarily to allow direct edits in the cloud portal.

Answer

Use the Microsoft Graph PowerShell module to force the attribute update in the cloud.

Question 17

You need to enable Self-Service Password Reset (SSPR) for a pilot group of 50 users. You want to ensure they can reset their passwords from the Windows login screen. What is a prerequisite for this specific functionality?

Accepted Answer

The users' devices must be Microsoft Entra joined or Microsoft Entra hybrid joined.. To enable SSPR on the Windows login screen, the devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. This allows the Windows login screen to communicate with the Entra ID service to facilitate the password reset process.

Answer

Users must have at least three different authentication methods registered in their profile.

Answer

The 'Writeback passwords to on-premises AD' option must be disabled for the pilot group.

Answer

The pilot group users must be assigned the 'Password Administrator' role in Entra ID.

Question 18

You need to implement Custom Security Attributes in Microsoft Entra ID to store sensitive employee data that should not be visible to standard administrators. Which TWO requirements must be met to manage these attributes?

Accepted Answer

You must be assigned the Attribute Definition Administrator role.. Custom Security Attributes provide a way to store specialized metadata with enhanced access controls. Unlike standard directory attributes, they are not visible by default to Global Administrators. Implementing them correctly requires specific role assignments and an understanding of how attribute sets function to isolate sensitive information from unauthorized viewing.

Answer

The tenant must have at least a Microsoft Entra ID Free edition.

Answer

The attributes must be stored in the 'Default' attribute set.

Answer

Global Administrators can view all custom attributes by default.

Question 19

You manage a Microsoft Entra tenant. A user named User1 reports that their cloud account is compromised. You need to instantly revoke all refresh tokens and sessions for User1 without deleting the account. What should you do?

Accepted Answer

Run the Revoke-AzureADUserAllRefreshToken PowerShell cmdlet targeting the User1 object ID.. Revoking sessions forces all issued refresh tokens to become invalid immediately, requiring the affected user to reauthenticate across all devices and applications. This crucial administrative response mitigates active breaches and prevents unauthorized access while investigating compromised credentials without disrupting overall account provisioning status.

Answer

Disable the user account temporarily by setting AccountEnabled to false in Microsoft Entra ID.

Answer

Modify the user password to a temporary value and require password reset upon next sign-in.

Answer

Delete the user object from the directory and restore it from the deleted items container.

Question 20

You are implementing Privileged Identity Management (PIM). Which TWO outcomes are achieved when you assign a user to an 'Eligible' role rather than a 'Permanent' role?

Accepted Answer

The user must request activation for the role, which can require multi-factor authentication.. PIM 'Eligible' assignments significantly reduce the risk of standing access. By requiring the user to perform an activation step, you add a layer of accountability, often including MFA and justification requirements. Permanent assignments are a major security risk because they provide persistent high-level access that can be abused if the account is compromised. Limiting standing access ensures that privileges are only active when they are absolutely necessary for the task at hand.

Answer

The user retains the permissions indefinitely without needing to take any further action.

Answer

The user is automatically notified via email whenever an administrative change occurs.

Answer

The user can bypass Conditional Access policies when activating the role.