SC-300 Practice Test 2 — 25 Questions

Question 1

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication is a cornerstone of modern identity security, as it prevents attackers from using stolen credentials or intercepting MFA codes. These methods rely on cryptographic keys bound to the hardware or the device, making it impossible for a user to accidentally provide their credentials to a malicious site. Implementing these methods significantly reduces the risk of account takeovers for high-profile users.

Answer

Microsoft Authenticator push notifications

Answer

SMS-based authentication codes

Question 2

You need to ensure that all global administrators in your tenant are using the most secure authentication methods available. Which TWO methods are recommended by Microsoft as the most secure for administrative accounts?

Accepted Answer

FIDO2 security keys. Administrative accounts are high-value targets for attackers, and securing them is a top priority for any identity administrator. Standard MFA methods like SMS or voice are no longer considered sufficient for privileged accounts. Microsoft strongly recommends moving toward passwordless and phishing-resistant methods to ensure that administrative credentials cannot be easily stolen through social engineering or sophisticated technical attacks.

Answer

SMS text messages with verification codes

Answer

Email-based verification codes

Answer

App passwords for legacy applications

Question 3

Your organization is adopting Global Secure Access (Entra Internet Access) to protect web traffic. You want to apply a Conditional Access policy that requires MFA specifically when users attempt to access a specific set of high-risk external websites. How should you configure this in the Conditional Access policy?

Accepted Answer

Select the 'Internet Access' traffic profile in the Target Resources section.. Global Secure Access extends Microsoft Entra's identity-centric security to internet traffic. By routing traffic through the Global Secure Access service, administrators can treat web traffic similarly to cloud applications. This allows for the application of Conditional Access policies based on destination, enabling fine-grained control over how users access the open internet and protecting the organization from malicious or unapproved websites.

Answer

Add the external website URLs to the 'Cloud Apps' list as custom applications.

Answer

Configure a 'Named Location' for each high-risk website IP address.

Answer

Use a 'Microsoft 365' traffic profile and filter by URL category.

Question 4

What is the recommended approach for managing emergency access accounts to ensure they are not locked out?

Accepted Answer

Exclude them from Conditional Access policies.. Emergency access accounts, or 'break-glass' accounts, must be excluded from Conditional Access policies that enforce MFA or device compliance. Since these accounts are designed for critical recovery when standard authentication flows fail (like an MFA provider outage), they must bypass these controls. This ensures that administrators can always regain access to the directory, preventing a catastrophic lockout scenario while keeping the accounts highly protected by long, complex passwords and monitoring.

Answer

Include them in all Conditional Access policies.

Answer

Apply a special MFA policy for them.

Answer

Store their passwords in a shared Excel file.

Question 5

An administrator wants to prevent brute-force attacks on user passwords by locking out accounts after several failed attempts. They want to ensure that legitimate users are not locked out by attackers from different geographical locations. Which feature should they configure?

Answer

Active Directory Group Policy

Answer

Microsoft Entra Smart Lockout

Answer

Conditional Access Block Policy

Answer

Tenant Restrictions

Question 6

A developer is choosing between using a Managed Identity and a Service Principal with a client secret for a new application. Which TWO benefits are unique to using Managed Identities? (Choose two)

Accepted Answer

Managed identities do not require the developer to manage or rotate secrets.. Managed identities provide specific security and operational advantages that service principals with secrets lack. They eliminate the need for developers to handle sensitive credentials and automate the lifecycle management of the identity. Understanding these differences is crucial for implementing secure workload identities according to Microsoft best practices.

Answer

Managed identities can be used to access resources outside of Azure via SAML.

Answer

Managed identities support the use of client certificates for authentication.

Answer

Managed identities allow for the assignment of Application permissions to Microsoft Graph.

Question 7

You need to ensure that administrative accounts are protected by requiring hardware-based MFA. Which feature supports this?

Accepted Answer

Conditional Access Authentication Strength. Authentication Strength policies in Conditional Access allow administrators to define which specific MFA methods are acceptable for access. By selecting 'FIDO2 security keys' or other hardware-based options, you can mandate that administrative accounts use the highest level of protection available. This is crucial for securing high-privilege identities, as hardware-based factors are resistant to phishing and man-in-the-middle attacks, providing a superior security posture compared to SMS or app-based push notifications.

Answer

Identity Protection risk-based policy

Answer

Azure AD PIM role settings

Answer

Intune app protection policies

Question 8

Which of the following scenarios is the primary use case for utilizing an Azure AD Service Principal over a Managed Identity?

Accepted Answer

When the application runs on-premises and needs to access Azure APIs.. Managed identities are limited to Azure-hosted resources. When your application runs on-premises, in another cloud, or on a local machine, you cannot use a managed identity. In these cases, you must register an application in Azure AD and use a service principal with either a certificate or a client secret to establish the required trust and authentication.

Answer

When the application runs on an Azure Virtual Machine.

Answer

When the application requires access to multiple Azure subscriptions.

Answer

When you need to provide administrative access to the entire tenant.

Question 9

You are managing service principals for an application that spans multiple environments. You need to ensure that credentials for these principals are rotated securely. Which TWO actions should you perform? (Choose two)

Accepted Answer

Store all service principal secrets in Azure Key Vault and configure automated rotation.. Managing service principal secrets requires a proactive lifecycle strategy. Azure Key Vault provides a centralized, secure location to store secrets and automate their rotation using Logic Apps or Function Apps. Additionally, migrating to certificate-based authentication or Workload Identity Federation significantly reduces the risk associated with static password leakage and simplifies the maintenance overhead of manual rotation cycles.

Answer

Use the Azure AD portal to manually update secrets every 30 days.

Answer

Enable password writeback in Azure AD Connect to force rotation.

Answer

Configure the service principal to rotate its own password every hour.

Question 10

You are configuring a Managed Identity for an Azure Virtual Machine. You need to ensure that the identity can access an Azure Key Vault secret. What is the most secure way to grant this access while adhering to the principle of least privilege?

Accepted Answer

Assign the Key Vault Secrets User role to the Managed Identity at the Key Vault scope.. Using Azure RBAC for Key Vault data plane access is the recommended approach for managing managed identities. By assigning a specific role like 'Key Vault Secrets User' at the scope of the individual secret or the vault itself, you restrict permissions to only what is necessary, effectively preventing unauthorized access and reducing the attack surface compared to legacy access policies which lack granular control.

Answer

Assign the Contributor role to the Managed Identity at the subscription scope.

Answer

Add the Managed Identity to the Key Vault access policies.

Answer

Store the Client ID and Client Secret in the application configuration file.

Question 11

You need to automate the rotation of a certificate used for service principal authentication. Which tool should you use to store the private key and manage the rotation lifecycle?

Accepted Answer

Azure Key Vault. Azure Key Vault is the industry-standard service for managing cryptographic keys and secrets. For service principal certificates, the Key Vault can store the certificate, and integrated automation (such as Logic Apps) can trigger renewal and updates to the Azure AD application registration, ensuring the identity remains secure without manual intervention.

Answer

Azure Storage Account

Answer

Azure App Configuration

Answer

Azure DevOps Secret Variables

Question 12

A company uses a service principal for an automation script running on-premises. Security policy requires that the credentials for this service principal be rotated every 30 days. Which solution provides the most secure method for managing these credentials without requiring manual updates to the script's configuration?

Accepted Answer

Use Azure Key Vault with certificate-based authentication.. Rotating secrets for service principals is a critical security task. Using Azure Key Vault with certificates allows the automation script to authenticate securely without storing hardcoded secrets. This approach ensures that even if the script environment is compromised, the credential itself is managed within a secure vault and rotated according to policy requirements.

Answer

Store a client secret in a local environment variable.

Answer

Use a Managed Identity on the on-premises server.

Answer

Implement a Personal Access Token with auto-renewal.

Question 13

You are designing an access review program in Microsoft Entra ID. Which TWO factors must you consider to ensure the review remains effective and compliant? Select exactly two.

Accepted Answer

The frequency of the review cycle. Effective access reviews require defining both the scope of identities and the specific criteria for decision-making. By choosing the correct reviewers—usually resource owners or direct managers—and setting a clear duration, you ensure that decisions are informed and timely. This practice is essential for maintaining the principle of least privilege, as it forces periodic re-validation of permissions that often suffer from 'privilege creep' over time in large enterprise environments.

Answer

The maximum number of users per review

Answer

The use of self-service groups

Answer

The integration with external identity providers

Question 14

An organization needs to allow an Azure Function to access secrets in an Azure Key Vault without storing any credentials in the Function's configuration files. Which solution should you implement to satisfy this requirement with the least administrative effort?

Accepted Answer

Configure a system-assigned managed identity for the Azure Function.. Managing workload identities requires understanding how to minimize the attack surface by eliminating secrets. Using a system-assigned managed identity allows the Azure Function to authenticate directly to Key Vault without storing credentials in code or configuration. This approach reduces the risk of credential leakage and simplifies the development lifecycle by offloading credential management to Microsoft Entra ID.

Answer

Create a service principal and store the client secret in the Function app settings.

Answer

Use a shared access signature (SAS) token with a five-year expiration date.

Answer

Register a new application in Microsoft Entra ID and grant it Key Vault Secrets Officer permissions.

Question 15

You need to implement a process to periodically verify that service principals still require their assigned permissions to Microsoft Graph. What should you use to automate this process?

Accepted Answer

Microsoft Entra Access Reviews.. Access reviews are a core component of Identity Governance. While often used for human users, they can also be applied to service principals that have been assigned high-privilege roles or application permissions. This ensures that workload identities do not retain permissions indefinitely, supporting the principle of least privilege.

Answer

Microsoft Entra ID Protection alerts.

Answer

Azure Monitor Log Analytics alerts.

Answer

Privileged Identity Management (PIM) for groups.

Question 16

You are managing several service principals that use client secrets for authentication. Which TWO actions represent security best practices for managing these secrets? (Choose two)

Accepted Answer

Rotate secrets regularly and immediately after any suspected compromise.. When managed identities cannot be used, securing service principal secrets is critical. Best practices focus on reducing the lifespan of secrets and ensuring they are not exposed. This minimizes the impact of a potential credential compromise and aligns with the Zero Trust security model.

Answer

Set secret expiration to the maximum allowed (99 years) to prevent service outages.

Answer

Store the client secrets in a public GitHub repository for easy developer access.

Answer

Share a single client secret across multiple different service principals.

Question 17

Your company has a high-security requirement for its automated deployment pipelines. You must ensure that service principals used by these pipelines can only authenticate from specific corporate IP ranges. What should you configure?

Accepted Answer

A Conditional Access policy targeting 'Workload identities'.. Conditional Access for workload identities is a premium feature that extends security policies to non-human identities. By applying location-based restrictions to service principals, you ensure that even if a secret is compromised, the identity cannot be used by an attacker outside of the approved corporate network environment, significantly hardening the identity.

Answer

A Microsoft Entra ID Protection risk-based policy for users.

Answer

An Azure Virtual Network service endpoint for Microsoft Entra ID.

Answer

A Microsoft Entra security group containing the service principals.

Question 18

You delete an Azure Logic App that was configured with a system-assigned managed identity. What happens to the managed identity in Microsoft Entra ID?

Accepted Answer

The identity is automatically deleted from Microsoft Entra ID.. The lifecycle management of system-assigned managed identities is one of their primary administrative benefits. Unlike service principals or user-assigned identities, they do not require manual cleanup, which helps maintain a clean and secure identity environment by preventing the existence of orphaned identities.

Answer

The identity remains in the tenant and must be manually deleted.

Answer

The identity is disabled for 30 days before being permanently deleted.

Answer

The identity is converted into a standard service principal.

Question 19

Which type of identity should you use for an application running on an Azure Virtual Machine that needs to access Azure Storage without managing credentials?

Accepted Answer

System-assigned managed identity.. User-assigned or system-assigned managed identities are the industry standard for Azure VMs. They provide an identity in Azure AD that applications can use to authenticate to any service that supports AD authentication, such as Azure Storage. This approach removes the need to store sensitive credentials in code or configuration, significantly improving the security posture of the application and simplifying secret management.

Answer

Service Principal with a certificate.

Answer

Shared Access Signature (SAS) token.

Answer

Azure AD User account.

Question 20

Which Azure AD feature allows you to manage the lifecycle of an application's service principal, including conditional access policies and user assignment, in a centralized manner?

Accepted Answer

Enterprise Application. Enterprise Applications in Azure AD provide the management plane for service principals. This is where you configure SSO, conditional access policies (like requiring MFA), assignment/access control for users, and auditing. While the application registration defines the app globally, the enterprise application is the instance where you enforce security policies at the tenant level.

Answer

Application Registration

Answer

Managed Identity

Answer

Azure Policy