SC-300 Practice Exam 3 — 20 Questions

Question 1

You are implementing Continuous Access Evaluation (CAE) in your tenant. A user's account is disabled by an administrator. How does CAE affect the user's active session with Exchange Online?

Accepted Answer

The session is revoked in near real-time.. Continuous Access Evaluation (CAE) is specifically designed to revoke access in near real-time when critical events occur, such as a user account being disabled. Therefore, option B is the correct answer.

Answer

The session remains active until the access token expires.

Answer

The user is prompted for MFA at the next sign-in.

Answer

The session is revoked only if the user's IP changes.

Question 2

You are implementing Privileged Identity Management (PIM) for Entra ID roles. You need to configure the 'Global Administrator' role to ensure that when a user activates the role, it is done securely and with oversight. Which TWO settings should you configure in the role's activation policy?

Accepted Answer

Require approval to activate. When configuring the activation settings for a highly privileged role like Global Administrator in Microsoft Entra ID PIM, you should configure 'Require approval to activate' to ensure oversight by designated approvers, and 'Maximum activation duration' to limit the exposure window.

Answer

Permanent eligibility

Answer

Require permanent assignment

Answer

Allow permanent activation

Question 3

You are managing service principals for an application that spans multiple environments. You need to ensure that credentials for these principals are rotated securely. Which TWO actions should you perform? (Choose two)

Accepted Answer

Store all service principal secrets in Azure Key Vault and configure automated rotation.. Managing service principal secrets requires a proactive lifecycle strategy. Azure Key Vault provides a centralized, secure location to store secrets and automate their rotation using Logic Apps or Function Apps. Additionally, migrating to certificate-based authentication or Workload Identity Federation significantly reduces the risk associated with static password leakage and simplifies the maintenance overhead of manual rotation cycles.

Answer

Use the Azure AD portal to manually update secrets every 30 days.

Answer

Enable password writeback in Azure AD Connect to force rotation.

Answer

Configure the service principal to rotate its own password every hour.

Question 4

You are configuring a Managed Identity for an Azure Virtual Machine. You need to ensure that the identity can access an Azure Key Vault secret. What is the most secure way to grant this access while adhering to the principle of least privilege?

Accepted Answer

Assign the Key Vault Secrets User role to the Managed Identity at the Key Vault scope.. Using Azure RBAC for Key Vault data plane access is the recommended approach for managing managed identities. By assigning a specific role like 'Key Vault Secrets User' at the scope of the individual secret or the vault itself, you restrict permissions to only what is necessary, effectively preventing unauthorized access and reducing the attack surface compared to legacy access policies which lack granular control.

Answer

Assign the Contributor role to the Managed Identity at the subscription scope.

Answer

Add the Managed Identity to the Key Vault access policies.

Answer

Store the Client ID and Client Secret in the application configuration file.

Question 5

You are auditing your environment for security risks related to workload identities. Which THREE conditions should you flag as high-security risks? (Choose three)

Accepted Answer

Service principals with client secrets that have no expiration date.. The selected options (A, C, D) are correct as they represent significant security risks (lack of credential rotation, credential reuse, and excessive privilege). The explanation is accurate.

Answer

Managed identities assigned to multiple virtual machines.

Answer

Service principals that use certificate-based authentication.

Question 6

You need to automate the rotation of a certificate used for service principal authentication. Which tool should you use to store the private key and manage the rotation lifecycle?

Accepted Answer

Azure Key Vault. Azure Key Vault is the industry-standard service for managing cryptographic keys and secrets. For service principal certificates, the Key Vault can store the certificate, and integrated automation (such as Logic Apps) can trigger renewal and updates to the Azure AD application registration, ensuring the identity remains secure without manual intervention.

Answer

Azure Storage Account

Answer

Azure App Configuration

Answer

Azure DevOps Secret Variables

Question 7

A company uses a service principal for an automation script running on-premises. Security policy requires that the credentials for this service principal be rotated every 30 days. Which solution provides the most secure method for managing these credentials without requiring manual updates to the script's configuration?

Accepted Answer

Use Azure Key Vault with certificate-based authentication.. Rotating secrets for service principals is a critical security task. Using Azure Key Vault with certificates allows the automation script to authenticate securely without storing hardcoded secrets. This approach ensures that even if the script environment is compromised, the credential itself is managed within a secure vault and rotated according to policy requirements.

Answer

Store a client secret in a local environment variable.

Answer

Use a Managed Identity on the on-premises server.

Answer

Implement a Personal Access Token with auto-renewal.

Question 8

You are designing an access review program in Microsoft Entra ID. Which TWO factors must you consider to ensure the review remains effective and compliant? Select exactly two.

Accepted Answer

The frequency of the review cycle. Effective access reviews require defining both the scope of identities and the specific criteria for decision-making. By choosing the correct reviewers—usually resource owners or direct managers—and setting a clear duration, you ensure that decisions are informed and timely. This practice is essential for maintaining the principle of least privilege, as it forces periodic re-validation of permissions that often suffer from 'privilege creep' over time in large enterprise environments.

Answer

The maximum number of users per review

Answer

The use of self-service groups

Answer

The integration with external identity providers

Question 9

You are managing a highly sensitive Azure subscription. You have configured PIM to require approval for the 'Owner' role. A user requests activation of this role. As the designated approver, you are unavailable. You need to ensure that the request can still be processed. What is the best way to handle this during the PIM configuration phase?

Accepted Answer

Configure a group as the approver for the role in PIM settings.. While the explanation mentions 'designating multiple approvers', it fails to explain that PIM allows assigning multiple users or groups as approvers. Using a group is the best practice for scalability and management, as it avoids the need to update PIM settings every time an individual approver changes roles or leaves the organization.

Answer

Assign the 'Global Administrator' role to the requesting user permanently.

Answer

Set the activation duration to 24 hours to reduce the number of requests.

Answer

Disable the 'Require approval' setting and use 'Require MFA' only.

Question 10

An organization needs to allow an Azure Function to access secrets in an Azure Key Vault without storing any credentials in the Function's configuration files. Which solution should you implement to satisfy this requirement with the least administrative effort?

Accepted Answer

Configure a system-assigned managed identity for the Azure Function.. Managing workload identities requires understanding how to minimize the attack surface by eliminating secrets. Using a system-assigned managed identity allows the Azure Function to authenticate directly to Key Vault without storing credentials in code or configuration. This approach reduces the risk of credential leakage and simplifies the development lifecycle by offloading credential management to Microsoft Entra ID.

Answer

Create a service principal and store the client secret in the Function app settings.

Answer

Use a shared access signature (SAS) token with a five-year expiration date.

Answer

Register a new application in Microsoft Entra ID and grant it Key Vault Secrets Officer permissions.

Question 11

You need to implement a process to periodically verify that service principals still require their assigned permissions to Microsoft Graph. What should you use to automate this process?

Accepted Answer

Microsoft Entra Access Reviews.. Access reviews are a core component of Identity Governance. While often used for human users, they can also be applied to service principals that have been assigned high-privilege roles or application permissions. This ensures that workload identities do not retain permissions indefinitely, supporting the principle of least privilege.

Answer

Microsoft Entra ID Protection alerts.

Answer

Azure Monitor Log Analytics alerts.

Answer

Privileged Identity Management (PIM) for groups.

Question 12

You are managing several service principals that use client secrets for authentication. Which TWO actions represent security best practices for managing these secrets? (Choose two)

Accepted Answer

Rotate secrets regularly and immediately after any suspected compromise.. When managed identities cannot be used, securing service principal secrets is critical. Best practices focus on reducing the lifespan of secrets and ensuring they are not exposed. This minimizes the impact of a potential credential compromise and aligns with the Zero Trust security model.

Answer

Set secret expiration to the maximum allowed (99 years) to prevent service outages.

Answer

Store the client secrets in a public GitHub repository for easy developer access.

Answer

Share a single client secret across multiple different service principals.

Question 13

Your company has a high-security requirement for its automated deployment pipelines. You must ensure that service principals used by these pipelines can only authenticate from specific corporate IP ranges. What should you configure?

Accepted Answer

A Conditional Access policy targeting 'Workload identities'.. Conditional Access for workload identities is a premium feature that extends security policies to non-human identities. By applying location-based restrictions to service principals, you ensure that even if a secret is compromised, the identity cannot be used by an attacker outside of the approved corporate network environment, significantly hardening the identity.

Answer

A Microsoft Entra ID Protection risk-based policy for users.

Answer

An Azure Virtual Network service endpoint for Microsoft Entra ID.

Answer

A Microsoft Entra security group containing the service principals.

Question 14

You delete an Azure Logic App that was configured with a system-assigned managed identity. What happens to the managed identity in Microsoft Entra ID?

Accepted Answer

The identity is automatically deleted from Microsoft Entra ID.. The lifecycle management of system-assigned managed identities is one of their primary administrative benefits. Unlike service principals or user-assigned identities, they do not require manual cleanup, which helps maintain a clean and secure identity environment by preventing the existence of orphaned identities.

Answer

The identity remains in the tenant and must be manually deleted.

Answer

The identity is disabled for 30 days before being permanently deleted.

Answer

The identity is converted into a standard service principal.

Question 15

Which type of identity should you use for an application running on an Azure Virtual Machine that needs to access Azure Storage without managing credentials?

Accepted Answer

System-assigned managed identity.. User-assigned or system-assigned managed identities are the industry standard for Azure VMs. They provide an identity in Azure AD that applications can use to authenticate to any service that supports AD authentication, such as Azure Storage. This approach removes the need to store sensitive credentials in code or configuration, significantly improving the security posture of the application and simplifying secret management.

Answer

Service Principal with a certificate.

Answer

Shared Access Signature (SAS) token.

Answer

Azure AD User account.

Question 16

Which Azure AD feature allows you to manage the lifecycle of an application's service principal, including conditional access policies and user assignment, in a centralized manner?

Accepted Answer

Enterprise Application. Enterprise Applications in Azure AD provide the management plane for service principals. This is where you configure SSO, conditional access policies (like requiring MFA), assignment/access control for users, and auditing. While the application registration defines the app globally, the enterprise application is the instance where you enforce security policies at the tenant level.

Answer

Application Registration

Answer

Managed Identity

Answer

Azure Policy

Question 17

Refer to the exhibit. You are configuring Workload Identity Federation for a GitHub Actions workflow. What is the purpose of the 'subject' field in this configuration?

Accepted Answer

It identifies the specific external workload that is authorized to use the federated identity.. Workload Identity Federation relies on trust relationships between Microsoft Entra ID and external identity providers. The 'subject' field is critical because it defines the specific criteria an external token must meet to be swapped for an Entra ID token. Correctly scoping this ensures only specific workflows can access Azure resources.

Answer

It specifies the display name of the service principal in the Entra ID tenant.

Answer

It defines the URL of the GitHub repository where the workflow is hosted.

Answer

It lists the Azure resources that the GitHub workflow is permitted to manage.

Question 18

Refer to the exhibit. An administrator runs the command shown. What is the result of this command regarding workload identity management?

Accepted Answer

It creates a service principal and assigns it a password-based secret by default.. The 'az ad sp create-for-rbac' command is a common way to create a service principal and assign it permissions in one step. Understanding the output and the impact on security (such as the default creation of a password) is essential for administrators who must secure these identities later.

Answer

It creates a system-assigned managed identity for a resource named 'myApp'.

Answer

It creates a service principal that can only be used with certificate-based authentication.

Answer

It grants the service principal access to the entire Microsoft Entra tenant.

Question 19

An application requires the 'User.Read.All' permission to Microsoft Graph to sync user data. You want to ensure the application can only read data and not modify it. Which type of permission should you assign?

Accepted Answer

Application permission with administrative consent.. Understanding the difference between Application permissions and Delegated permissions is fundamental for SC-300. Application permissions allow a service to run without a signed-in user, which is typical for background services or daemons, while Delegated permissions act on behalf of a user.

Answer

Delegated permission with administrative consent.

Answer

Managed identity with the Global Reader role.

Answer

Service principal with the 'User.ReadWrite.All' permission.

Question 20

Your company uses Azure Kubernetes Service (AKS). You want to implement workload identity to allow pods to access Azure resources without using static credentials. Which TWO steps must you perform to enable this?

Accepted Answer

Enable the OIDC issuer and workload identity on the existing AKS cluster.. To enable AKS workload identity, you must first enable the OIDC issuer and workload identity features on the AKS cluster. Once the cluster is prepared, you must create a managed identity and establish a federated identity credential that maps the Kubernetes Service Account to the Azure Managed Identity. These steps create the trust relationship necessary for pods to safely authenticate to Azure services using short-lived tokens.

Answer

Install the Azure AD Connect tool on every worker node in the cluster.

Answer

Generate a client secret for the Managed Identity and inject it as a Kubernetes Secret.

Answer

Assign the Global Administrator role to the AKS cluster service principal.