SC-300 Practice Test 3 — 25 Questions

Question 1

You need to implement a process to periodically verify that service principals still require their assigned permissions to Microsoft Graph. What should you use to automate this process?

Accepted Answer

Microsoft Entra Access Reviews.. Access reviews are a core component of Identity Governance. While often used for human users, they can also be applied to service principals that have been assigned high-privilege roles or application permissions. This ensures that workload identities do not retain permissions indefinitely, supporting the principle of least privilege.

Answer

Microsoft Entra ID Protection alerts.

Answer

Azure Monitor Log Analytics alerts.

Answer

Privileged Identity Management (PIM) for groups.

Question 2

You are managing several service principals that use client secrets for authentication. Which TWO actions represent security best practices for managing these secrets? (Choose two)

Accepted Answer

Rotate secrets regularly and immediately after any suspected compromise.. When managed identities cannot be used, securing service principal secrets is critical. Best practices focus on reducing the lifespan of secrets and ensuring they are not exposed. This minimizes the impact of a potential credential compromise and aligns with the Zero Trust security model.

Answer

Set secret expiration to the maximum allowed (99 years) to prevent service outages.

Answer

Store the client secrets in a public GitHub repository for easy developer access.

Answer

Share a single client secret across multiple different service principals.

Question 3

Your company has a high-security requirement for its automated deployment pipelines. You must ensure that service principals used by these pipelines can only authenticate from specific corporate IP ranges. What should you configure?

Accepted Answer

A Conditional Access policy targeting 'Workload identities'.. Conditional Access for workload identities is a premium feature that extends security policies to non-human identities. By applying location-based restrictions to service principals, you ensure that even if a secret is compromised, the identity cannot be used by an attacker outside of the approved corporate network environment, significantly hardening the identity.

Answer

A Microsoft Entra ID Protection risk-based policy for users.

Answer

An Azure Virtual Network service endpoint for Microsoft Entra ID.

Answer

A Microsoft Entra security group containing the service principals.

Question 4

You delete an Azure Logic App that was configured with a system-assigned managed identity. What happens to the managed identity in Microsoft Entra ID?

Accepted Answer

The identity is automatically deleted from Microsoft Entra ID.. The lifecycle management of system-assigned managed identities is one of their primary administrative benefits. Unlike service principals or user-assigned identities, they do not require manual cleanup, which helps maintain a clean and secure identity environment by preventing the existence of orphaned identities.

Answer

The identity remains in the tenant and must be manually deleted.

Answer

The identity is disabled for 30 days before being permanently deleted.

Answer

The identity is converted into a standard service principal.

Question 5

Which type of identity should you use for an application running on an Azure Virtual Machine that needs to access Azure Storage without managing credentials?

Accepted Answer

System-assigned managed identity.. User-assigned or system-assigned managed identities are the industry standard for Azure VMs. They provide an identity in Azure AD that applications can use to authenticate to any service that supports AD authentication, such as Azure Storage. This approach removes the need to store sensitive credentials in code or configuration, significantly improving the security posture of the application and simplifying secret management.

Answer

Service Principal with a certificate.

Answer

Shared Access Signature (SAS) token.

Answer

Azure AD User account.

Question 6

Which Azure AD feature allows you to manage the lifecycle of an application's service principal, including conditional access policies and user assignment, in a centralized manner?

Accepted Answer

Enterprise Application. Enterprise Applications in Azure AD provide the management plane for service principals. This is where you configure SSO, conditional access policies (like requiring MFA), assignment/access control for users, and auditing. While the application registration defines the app globally, the enterprise application is the instance where you enforce security policies at the tenant level.

Answer

Application Registration

Answer

Managed Identity

Answer

Azure Policy

Question 7

Refer to the exhibit. You are configuring Workload Identity Federation for a GitHub Actions workflow. What is the purpose of the 'subject' field in this configuration?

Accepted Answer

It identifies the specific external workload that is authorized to use the federated identity.. Workload Identity Federation relies on trust relationships between Microsoft Entra ID and external identity providers. The 'subject' field is critical because it defines the specific criteria an external token must meet to be swapped for an Entra ID token. Correctly scoping this ensures only specific workflows can access Azure resources.

Answer

It specifies the display name of the service principal in the Entra ID tenant.

Answer

It defines the URL of the GitHub repository where the workflow is hosted.

Answer

It lists the Azure resources that the GitHub workflow is permitted to manage.

Question 8

Refer to the exhibit. An administrator runs the command shown. What is the result of this command regarding workload identity management?

Accepted Answer

It creates a service principal and assigns it a password-based secret by default.. The 'az ad sp create-for-rbac' command is a common way to create a service principal and assign it permissions in one step. Understanding the output and the impact on security (such as the default creation of a password) is essential for administrators who must secure these identities later.

Answer

It creates a system-assigned managed identity for a resource named 'myApp'.

Answer

It creates a service principal that can only be used with certificate-based authentication.

Answer

It grants the service principal access to the entire Microsoft Entra tenant.

Question 9

An application requires the 'User.Read.All' permission to Microsoft Graph to sync user data. You want to ensure the application can only read data and not modify it. Which type of permission should you assign?

Accepted Answer

Application permission with administrative consent.. Understanding the difference between Application permissions and Delegated permissions is fundamental for SC-300. Application permissions allow a service to run without a signed-in user, which is typical for background services or daemons, while Delegated permissions act on behalf of a user.

Answer

Delegated permission with administrative consent.

Answer

Managed identity with the Global Reader role.

Answer

Service principal with the 'User.ReadWrite.All' permission.

Question 10

Your company uses Azure Kubernetes Service (AKS). You want to implement workload identity to allow pods to access Azure resources without using static credentials. Which TWO steps must you perform to enable this?

Accepted Answer

Enable the OIDC issuer and workload identity on the existing AKS cluster.. To enable AKS workload identity, you must first enable the OIDC issuer and workload identity features on the AKS cluster. Once the cluster is prepared, you must create a managed identity and establish a federated identity credential that maps the Kubernetes Service Account to the Azure Managed Identity. These steps create the trust relationship necessary for pods to safely authenticate to Azure services using short-lived tokens.

Answer

Install the Azure AD Connect tool on every worker node in the cluster.

Answer

Generate a client secret for the Managed Identity and inject it as a Kubernetes Secret.

Answer

Assign the Global Administrator role to the AKS cluster service principal.

Question 11

Refer to the exhibit. An application using a service principal is failing to authenticate with the error shown. What is the most likely cause?

Accepted Answer

The client secret used by the application is invalid or expired.. This error specifically indicates that the client secret being used by the application has expired, is incorrect, or has been revoked. In the context of service principals, this is the most common failure point. To resolve this, you must generate a new secret in the Azure portal, update the application configuration, and ensure the change is propagated, which might take several minutes in some scenarios.

Answer

The service principal has been deleted from Azure AD.

Answer

The application lacks RBAC permissions to access the resource.

Answer

The user is required to perform Multi-Factor Authentication.

Question 12

You are configuring an Access Review for a group that provides access to sensitive financial data. To comply with internal audits, you must ensure that the review occurs every quarter and that the 'User's manager' is always the primary reviewer. What should you do if some users in the group do not have a manager defined in Microsoft Entra ID?

Accepted Answer

Specify a fallback reviewer in the Access Review settings.. When 'Manager' is selected as the reviewer in an Access Review, Microsoft Entra ID relies on the 'manager' attribute of the user object. If this attribute is empty, the review for that specific user cannot be completed by a manager. You must configure a fallback reviewer to ensure no users are skipped during the audit.

Answer

The review will automatically skip users without a manager.

Answer

The Global Administrator will receive all reviews for users without managers.

Answer

Users without a manager will be prompted to review their own access.

Question 13

You are automating the offboarding process for employees using Lifecycle Workflows. You want to ensure that 30 days after an employee's departure date, their account is disabled and they are removed from all groups. Which workflow template should you use?

Accepted Answer

Post-offboarding of an employee. Lifecycle workflows support 'scheduled' tasks that can be triggered relative to a user's departure date. The 'Post-offboarding' template is specifically designed for these delayed cleanup tasks, allowing organizations to maintain access for a short period (e.g., for data recovery) before finally securing the environment by disabling the account.

Answer

Onboard pre-hire employee

Answer

Real-time termination

Answer

Mover workflow

Question 14

You need to delegate the ability for a project lead to manage their own resources within Entitlement Management without granting them full Identity Governance Administrator permissions. What is the most restrictive role you should assign the project lead for a specific catalog?

Accepted Answer

Catalog Owner. The Catalog Owner role is the correct and most restrictive role that allows a user to manage resources and access packages within a specific catalog without requiring global Identity Governance permissions.

Answer

Access Package Manager

Answer

Identity Governance Administrator

Answer

User Administrator

Question 15

What is the primary difference between a system-assigned and a user-assigned managed identity?

Accepted Answer

User-assigned identities can be shared across multiple Azure resources.. The primary distinction lies in their lifecycle and reusability. A system-assigned identity is bound to a single Azure resource and is deleted when that resource is removed. Conversely, a user-assigned identity is created as a standalone Azure resource, allowing it to be shared across multiple resources, such as several virtual machines or function apps, offering more flexibility for complex architectural patterns.

Answer

System-assigned identities support more Azure services than user-assigned identities.

Answer

System-assigned identities are standalone resources, while user-assigned are not.

Answer

System-assigned identities require manual secret rotation.

Question 16

Your organization works with a external vendor, Fabrikam, which requires access to specific SharePoint sites and Teams for a six-month project. You need to ensure that Fabrikam employees can request access themselves, but their access must be automatically revoked when the project ends or if they no longer require it. Which Entitlement Management feature should you implement?

Accepted Answer

Access packages with a linked connected organization.. Access packages in Entitlement Management allow you to bundle resources like SharePoint sites and Teams into a single unit for assignment. By defining a lifecycle with an expiration date and requiring periodic access reviews, you ensure that external users only maintain access as long as necessary. This automation reduces the risk of orphaned accounts and simplifies the offboarding process for temporary project staff.

Answer

Privileged Identity Management (PIM) for Azure Resources.

Answer

Manual Guest User invitation via the Microsoft Entra admin center.

Answer

Conditional Access policies with Session Control.

Question 17

You are implementing Entitlement Management for a multinational company with multiple connected organizations. You need to create an access package that is available to users from any of your three primary partners (Contoso, Fabrikam, and Adatum). Which TWO steps must you take to ensure these external users can request the package?

Accepted Answer

Add Contoso, Fabrikam, and Adatum as Connected Organizations.. To allow external users from specific partners to request access, you must first establish a trust relationship by adding them as connected organizations. Once established, you must create a policy within an access package that explicitly targets these organizations. This ensures that only users from verified partners can see and request the resources.

Answer

Enable the 'Allow All Users' setting in the External Identities provider.

Answer

Assign the 'Guest Inviter' role to the users in the external organizations.

Answer

Set the access package visibility to 'Public'.

Question 18

Which Azure feature is used to audit the usage of managed identities and service principals to detect suspicious activity?

Accepted Answer

Azure Monitor Log Analytics.. Azure AD Sign-in logs and Audit logs are the primary tools for monitoring identity usage. They provide detailed information about who (or what) accessed which resource, at what time, and from where. By configuring these logs to export to a Log Analytics workspace, you can create alerts for anomalous behavior, such as a service principal accessing resources outside of normal operational patterns, enabling quick incident response and security auditing.

Answer

Azure Advisor.

Answer

Azure Policy.

Answer

Azure Cost Management.

Question 19

You are configuring Workload Identity Federation for a GitHub Actions workflow to deploy resources to Azure. Which TWO components are required to establish the trust relationship between GitHub and Microsoft Entra ID?

Accepted Answer

A Federated Identity Credential.. Workload Identity Federation allows you to trust an external identity provider like GitHub. To set this up, you must have an identity in Entra ID (Application or Managed Identity) and a Federated Identity Credential. This credential defines the trust by specifying the issuer and subject identifiers provided by the GitHub OIDC token.

Answer

A client secret with a 24-month expiration.

Answer

A Microsoft Entra ID P2 license for every developer.

Answer

An Azure Key Vault Access Policy.

Question 20

Refer to the exhibit. This JSON represents a Microsoft Entra Conditional Access policy. What is the primary effect of this policy configuration?

Accepted Answer

It blocks high-risk service principals from accessing Office 365.. This JSON configuration defines a Conditional Access policy that triggers when a service principal is identified as having a high risk level. By blocking access to Office 365 services for high-risk service principals, the organization can prevent automated attacks or compromised identities from accessing sensitive cloud data while investigations occur.

Answer

It requires multi-factor authentication for all service principals.

Answer

It disables all service principals that have not signed in recently.

Answer

It limits service principal access to trusted IP locations only.