SC-300 Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. An application using a service principal is failing to authenticate with the error shown. What is the most likely cause?

Accepted Answer

The client secret used by the application is invalid or expired.. This error specifically indicates that the client secret being used by the application has expired, is incorrect, or has been revoked. In the context of service principals, this is the most common failure point. To resolve this, you must generate a new secret in the Azure portal, update the application configuration, and ensure the change is propagated, which might take several minutes in some scenarios.

Answer

The service principal has been deleted from Azure AD.

Answer

The application lacks RBAC permissions to access the resource.

Answer

The user is required to perform Multi-Factor Authentication.

Question 2

You are configuring an Access Review for a group that provides access to sensitive financial data. To comply with internal audits, you must ensure that the review occurs every quarter and that the 'User's manager' is always the primary reviewer. What should you do if some users in the group do not have a manager defined in Microsoft Entra ID?

Accepted Answer

Specify a fallback reviewer in the Access Review settings.. When 'Manager' is selected as the reviewer in an Access Review, Microsoft Entra ID relies on the 'manager' attribute of the user object. If this attribute is empty, the review for that specific user cannot be completed by a manager. You must configure a fallback reviewer to ensure no users are skipped during the audit.

Answer

The review will automatically skip users without a manager.

Answer

The Global Administrator will receive all reviews for users without managers.

Answer

Users without a manager will be prompted to review their own access.

Question 3

You are automating the offboarding process for employees using Lifecycle Workflows. You want to ensure that 30 days after an employee's departure date, their account is disabled and they are removed from all groups. Which workflow template should you use?

Accepted Answer

Post-offboarding of an employee. Lifecycle workflows support 'scheduled' tasks that can be triggered relative to a user's departure date. The 'Post-offboarding' template is specifically designed for these delayed cleanup tasks, allowing organizations to maintain access for a short period (e.g., for data recovery) before finally securing the environment by disabling the account.

Answer

Onboard pre-hire employee

Answer

Real-time termination

Answer

Mover workflow

Question 4

You need to delegate the ability for a project lead to manage their own resources within Entitlement Management without granting them full Identity Governance Administrator permissions. What is the most restrictive role you should assign the project lead for a specific catalog?

Accepted Answer

Catalog Owner. The Catalog Owner role is the correct and most restrictive role that allows a user to manage resources and access packages within a specific catalog without requiring global Identity Governance permissions.

Answer

Access Package Manager

Answer

Identity Governance Administrator

Answer

User Administrator

Question 5

What is the primary difference between a system-assigned and a user-assigned managed identity?

Accepted Answer

User-assigned identities can be shared across multiple Azure resources.. The primary distinction lies in their lifecycle and reusability. A system-assigned identity is bound to a single Azure resource and is deleted when that resource is removed. Conversely, a user-assigned identity is created as a standalone Azure resource, allowing it to be shared across multiple resources, such as several virtual machines or function apps, offering more flexibility for complex architectural patterns.

Answer

System-assigned identities support more Azure services than user-assigned identities.

Answer

System-assigned identities are standalone resources, while user-assigned are not.

Answer

System-assigned identities require manual secret rotation.

Question 6

Your organization works with a external vendor, Fabrikam, which requires access to specific SharePoint sites and Teams for a six-month project. You need to ensure that Fabrikam employees can request access themselves, but their access must be automatically revoked when the project ends or if they no longer require it. Which Entitlement Management feature should you implement?

Accepted Answer

Access packages with a linked connected organization.. Access packages in Entitlement Management allow you to bundle resources like SharePoint sites and Teams into a single unit for assignment. By defining a lifecycle with an expiration date and requiring periodic access reviews, you ensure that external users only maintain access as long as necessary. This automation reduces the risk of orphaned accounts and simplifies the offboarding process for temporary project staff.

Answer

Privileged Identity Management (PIM) for Azure Resources.

Answer

Manual Guest User invitation via the Microsoft Entra admin center.

Answer

Conditional Access policies with Session Control.

Question 7

You are implementing Entitlement Management for a multinational company with multiple connected organizations. You need to create an access package that is available to users from any of your three primary partners (Contoso, Fabrikam, and Adatum). Which TWO steps must you take to ensure these external users can request the package?

Accepted Answer

Add Contoso, Fabrikam, and Adatum as Connected Organizations.. To allow external users from specific partners to request access, you must first establish a trust relationship by adding them as connected organizations. Once established, you must create a policy within an access package that explicitly targets these organizations. This ensures that only users from verified partners can see and request the resources.

Answer

Enable the 'Allow All Users' setting in the External Identities provider.

Answer

Assign the 'Guest Inviter' role to the users in the external organizations.

Answer

Set the access package visibility to 'Public'.

Question 8

Which Azure feature is used to audit the usage of managed identities and service principals to detect suspicious activity?

Accepted Answer

Azure Monitor Log Analytics.. Azure AD Sign-in logs and Audit logs are the primary tools for monitoring identity usage. They provide detailed information about who (or what) accessed which resource, at what time, and from where. By configuring these logs to export to a Log Analytics workspace, you can create alerts for anomalous behavior, such as a service principal accessing resources outside of normal operational patterns, enabling quick incident response and security auditing.

Answer

Azure Advisor.

Answer

Azure Policy.

Answer

Azure Cost Management.

Question 9

You are configuring Workload Identity Federation for a GitHub Actions workflow to deploy resources to Azure. Which TWO components are required to establish the trust relationship between GitHub and Microsoft Entra ID?

Accepted Answer

A Federated Identity Credential.. Workload Identity Federation allows you to trust an external identity provider like GitHub. To set this up, you must have an identity in Entra ID (Application or Managed Identity) and a Federated Identity Credential. This credential defines the trust by specifying the issuer and subject identifiers provided by the GitHub OIDC token.

Answer

A client secret with a 24-month expiration.

Answer

A Microsoft Entra ID P2 license for every developer.

Answer

An Azure Key Vault Access Policy.

Question 10

Refer to the exhibit. This JSON represents a Microsoft Entra Conditional Access policy. What is the primary effect of this policy configuration?

Accepted Answer

It blocks high-risk service principals from accessing Office 365.. This JSON configuration defines a Conditional Access policy that triggers when a service principal is identified as having a high risk level. By blocking access to Office 365 services for high-risk service principals, the organization can prevent automated attacks or compromised identities from accessing sensitive cloud data while investigations occur.

Answer

It requires multi-factor authentication for all service principals.

Answer

It disables all service principals that have not signed in recently.

Answer

It limits service principal access to trusted IP locations only.

Question 11

You are configuring a 'Leaver' Lifecycle Workflow for employees who are resigning. You need to ensure that their access is immediately disabled and their manager is notified. Which TWO tasks should you include in the workflow to achieve this according to Microsoft best practices?

Accepted Answer

Disable user account.. Lifecycle Workflows automate the offboarding process, which is critical for security. When an employee leaves, the primary goals are to revoke their ability to sign in and inform their supervisor. This prevents unauthorized access to corporate data and ensures that the manager is aware that the offboarding process has been initiated.

Answer

Delete user account.

Answer

Remove user from all SharePoint sites.

Answer

Reset user password.

Question 12

Your organization wants to implement Access Reviews for workload identities. Which THREE requirements must be met to use this feature for service principals assigned to directory roles?

Accepted Answer

Microsoft Entra ID Governance license.. The explanation is accurate, but the question requires specific trap information to help students avoid common pitfalls.

Answer

The service principal must have a client secret.

Answer

The service principal must be a system-assigned identity.

Question 13

You are configuring an Access Review for a group that contains 500 users. You want to reduce the manual effort for reviewers by providing them with system-generated insights. Which TWO features should you enable in the 'Reviewer decision helpers' section?

Accepted Answer

No info on last sign-in within 30 days.. Decision helpers assist reviewers by providing data-driven recommendations. This is especially useful in large groups where reviewers may not be familiar with every user's activity. By surfacing sign-in data and 'no-interaction' flags, the system helps reviewers make faster, more accurate decisions about who truly needs to retain access.

Answer

Auto-apply results to resource.

Answer

Multi-Factor Authentication status.

Answer

Conditional Access policy count.

Question 14

You are creating an access package for the Sales department. You want the package to be discoverable by all internal employees, but you want to ensure that only employees with the 'Sales' attribute in their user profile are allowed to request it. How should you configure the policy?

Accepted Answer

Create a dynamic group for Sales employees and scope the policy to that group.. Entitlement Management allows you to scope policies to specific sets of users. While you can make a package visible to all internal users, you can use 'Targeted' policies or group-based requirements to limit who can actually submit a request. This ensures that only relevant staff can obtain access to department-specific resources.

Answer

Create a policy for 'All users (All members)' and add an approval step.

Answer

Set the 'Hidden' property of the access package to 'Yes'.

Answer

Use a Conditional Access policy to block non-Sales users from the MyAccess portal.

Question 15

You need to allow users from a specific partner organization to request access packages in your directory. The partner uses their own Entra ID tenant. What must you create first in Entitlement Management?

Answer

A new guest user account for every partner employee.

Answer

A cross-tenant access policy in the External Identities blade.

Answer

A dynamic group that includes all external users.

Answer

A Connected Organization.

Question 16

You are implementing Privileged Identity Management (PIM) for Groups to manage access to sensitive administrative tools. You need to ensure that when a user is assigned to a group, they do not have permanent access but must instead request to activate their membership for a maximum of 4 hours. Which group type and assignment type should you use?

Accepted Answer

A role-assignable security group with an Eligible assignment.. PIM for Groups requires the group to be a 'role-assignable' group. To enforce activation and time limits, the assignment must be 'Eligible'. Option A is actually the correct configuration, but it was marked as [wrong] in the provided text. The explanation correctly identifies that a role-assignable group with an Eligible assignment is required.

Answer

A standard Microsoft 365 group with an Active assignment.

Answer

A dynamic membership security group with an Eligible assignment.

Answer

A role-assignable security group with an Active assignment.

Question 17

You are implementing Lifecycle Workflows to automate the 'Joiner' process for new employees. Which TWO conditions can be used as triggers to start a workflow for a new hire?

Accepted Answer

A specific number of days before the 'employeeHireDate' attribute.. Lifecycle Workflows automate the management of users as they enter, move through, or leave an organization. Choosing the right trigger is vital for ensuring that accounts are provisioned and configured at the correct moment. Triggers can be based on specific date attributes or manual execution, allowing for flexibility in how onboarding is handled.

Answer

When a user is added to a specific 'Onboarding' security group.

Answer

Immediately when a user's 'Job Title' attribute is updated in Entra ID.

Answer

When a user signs in for the first time using Multi-Factor Authentication.

Question 18

You are configuring an access package for the Marketing department. You need to define who is allowed to request this package. Which TWO options can be selected as requestors in an access package policy?

Accepted Answer

Users in your directory. In Microsoft Entra entitlement management, the requestor settings in an access package policy determine who can request the access package. The standard options available are 'For users in your directory', 'For users not in your directory' (connected organizations), and 'None (administrator direct assignments only)'.

Answer

Any user with a valid LinkedIn account

Answer

Only users who have already been assigned a P1 license

Answer

Anonymous users via a public URL

Question 19

You are delegating administrative tasks in Microsoft Entra Entitlement Management. Which THREE roles are specifically designed to manage aspects of access packages and catalogs without requiring the Global Administrator role?

Accepted Answer

Catalog owner. Least privilege is a core tenet of identity governance. Microsoft Entra provides specific administrative roles that allow users to manage the lifecycle of access without having full control over the directory. Understanding these roles is essential for delegating responsibility to department leads or project managers while maintaining a secure administrative environment.

Answer

Billing Administrator

Answer

User Administrator

Question 20

An organization has an access review for a security group that grants access to financial data. The administrator wants to ensure that if a reviewer fails to respond to the review request within the 14-day window, the user's access is automatically removed to maintain a 'secure by default' posture. How should this be configured?

Accepted Answer

Set the 'Action on non-response' to 'Remove access'.. Configuring 'If reviewers don't respond' settings is a vital part of hardening identity governance. In high-risk scenarios, like access to financial data, an 'Apply recommendations' or 'Take no action' approach might leave unauthorized access in place. A 'Remove access' policy ensures that access must be actively justified to persist.

Answer

Set the 'Action on non-response' to 'Approve access' to prevent business disruption.

Answer

Set the 'Action on non-response' to 'Take recommendations'.

Answer

Enable 'Decision helpers' and set the default action to 'Notify Global Admin'.