SC-300 Practice Test 4 — 25 Questions

Question 1

You are implementing Privileged Identity Management (PIM) for Groups to manage access to sensitive administrative tools. You need to ensure that when a user is assigned to a group, they do not have permanent access but must instead request to activate their membership for a maximum of 4 hours. Which group type and assignment type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A role-assignable security group with an Eligible assignment.. PIM for Groups requires the group to be a 'role-assignable' group. To enforce activation and time limits, the assignment must be 'Eligible'. Option A is actually the correct configuration, but it was marked as [wrong] in the provided text. The explanation correctly identifies that a role-assignable group with an Eligible assignment is required.

Answer

A standard Microsoft 365 group with an Active assignment.

Answer

A dynamic membership security group with an Eligible assignment.

Answer

A role-assignable security group with an Active assignment.

Question 2

You are implementing Lifecycle Workflows to automate the 'Joiner' process for new employees. Which TWO conditions can be used as triggers to start a workflow for a new hire?

Accepted Answer

A specific number of days before the 'employeeHireDate' attribute.. Lifecycle Workflows automate the management of users as they enter, move through, or leave an organization. Choosing the right trigger is vital for ensuring that accounts are provisioned and configured at the correct moment. Triggers can be based on specific date attributes or manual execution, allowing for flexibility in how onboarding is handled.

Answer

When a user is added to a specific 'Onboarding' security group.

Answer

Immediately when a user's 'Job Title' attribute is updated in Entra ID.

Answer

When a user signs in for the first time using Multi-Factor Authentication.

Question 3

You are configuring an access package for the Marketing department. You need to define who is allowed to request this package. Which TWO options can be selected as requestors in an access package policy?

Accepted Answer

Users in your directory. In Microsoft Entra entitlement management, the requestor settings in an access package policy determine who can request the access package. The standard options available are 'For users in your directory', 'For users not in your directory' (connected organizations), and 'None (administrator direct assignments only)'.

Answer

Any user with a valid LinkedIn account

Answer

Only users who have already been assigned a P1 license

Answer

Anonymous users via a public URL

Question 4

You are delegating administrative tasks in Microsoft Entra Entitlement Management. Which THREE roles are specifically designed to manage aspects of access packages and catalogs without requiring the Global Administrator role?

Accepted Answer

Catalog owner. Least privilege is a core tenet of identity governance. Microsoft Entra provides specific administrative roles that allow users to manage the lifecycle of access without having full control over the directory. Understanding these roles is essential for delegating responsibility to department leads or project managers while maintaining a secure administrative environment.

Answer

Billing Administrator

Answer

User Administrator

Question 5

An organization has an access review for a security group that grants access to financial data. The administrator wants to ensure that if a reviewer fails to respond to the review request within the 14-day window, the user's access is automatically removed to maintain a 'secure by default' posture. How should this be configured?

Accepted Answer

Set the 'Action on non-response' to 'Remove access'.. Configuring 'If reviewers don't respond' settings is a vital part of hardening identity governance. In high-risk scenarios, like access to financial data, an 'Apply recommendations' or 'Take no action' approach might leave unauthorized access in place. A 'Remove access' policy ensures that access must be actively justified to persist.

Answer

Set the 'Action on non-response' to 'Approve access' to prevent business disruption.

Answer

Set the 'Action on non-response' to 'Take recommendations'.

Answer

Enable 'Decision helpers' and set the default action to 'Notify Global Admin'.

Question 6

Your security team is concerned about 'permanent' assignments for highly privileged roles. You decide to use PIM to monitor this. Which PIM feature or alert will help identify users who have a permanent assignment to a privileged role?

Accepted Answer

The 'Roles don't require multi-factor authentication for activation' and 'Permanent assignments' alerts.. Privileged Identity Management (PIM) provides security alerts to help administrators identify and remediate risks. One of the most critical alerts is the identification of permanent assignments. By converting these to 'eligible' assignments, organizations ensure that users only have privileged access when needed, reducing the blast radius of a potential account compromise.

Answer

The 'Roles not requiring MFA for activation' alert.

Answer

The 'Potential stale accounts' alert in the identity governance dashboard.

Answer

The 'Activation' history log filtered by the 'Permanent' status code.

Question 7

Refer to the exhibit. An organization is enforcing PIM for the Contributor role. Based on the JSON configuration for the role setting, what is the maximum amount of time a user can have the role active after their request is approved?

Accepted Answer

The user can remain active in the role for a maximum of 8 hours.. The maxExpirationDuration attribute in the provided JSON configuration is set to 'PT8H'. In ISO 8601 duration format, 'PT8H' represents a period of 8 hours. Therefore, the maximum activation duration for the Contributor role is 8 hours.

Answer

The user can remain active in the role for a maximum of 8 days.

Answer

The user's role will never expire as long as they are signed in.

Answer

The user must renew their activation every 8 minutes to keep the role.

Question 8

In Microsoft Entra Entitlement Management, what is the primary purpose of a 'Catalog'?

Accepted Answer

To group related resources and access packages for delegated management.. Catalogs serve as the foundational organizational unit in Entitlement Management. They allow for the grouping of related resources (groups, applications, and SharePoint sites) and the delegation of administrative tasks. By using catalogs, organizations can decentralize management, allowing department heads to oversee their own resources while maintaining a structured governance framework.

Answer

To store backup copies of all user identities in the directory.

Answer

To provide a public list of all applications available to guest users.

Answer

To synchronize on-premises Active Directory objects to the cloud.

Question 9

You are managing Privileged Identity Management (PIM) for Azure resources. You need to ensure that when a user activates a role, they are required to provide a support ticket number. Which PIM setting must you modify?

Accepted Answer

Role Assignment Settings. PIM role settings allow administrators to enforce specific requirements upon activation, such as requiring MFA or providing justification. By configuring the 'Require ticket number' option in the role activation settings, you ensure that every privileged action is linked to an external tracking system. This practice is vital for compliance audits, as it maps elevated permissions to specific authorized business activities, preventing anonymous or undocumented escalations in a production environment.

Answer

Conditional Access Policies

Answer

Privileged Access Groups

Answer

User Access Administrator role

Question 10

You need to configure B2B collaboration settings in Microsoft Entra ID to restrict external access. The solution must meet the following requirements:
1. Allow users to invite guests only from the domain 'fabrikam.com'.
2. Prevent guests from searching the directory for other users.
Which TWO settings should you configure?

Accepted Answer

Set External user read permissions to 'Guest users are limited to properties and memberships of their own directory objects'.. B2B collaboration settings provide granular control over how external users interact with your directory. Restricting invitations to specific domains is a common security requirement for sensitive environments. Similarly, limiting directory search capabilities for guests prevents data harvesting and ensures that external users can only interact with the specific people or resources they have been assigned.

Answer

Configure a Cross-tenant access policy for 'fabrikam.com' with B2B direct connect enabled.

Answer

Enable the 'Member users and users assigned to specific admin roles can invite guest users' setting.

Answer

Create a Conditional Access policy that blocks all external users except those from 'fabrikam.com'.

Question 11

You accidentally delete a cloud-only user account from the Microsoft Entra admin center. You need to restore the user and their associated group memberships. Within how many days must you perform the restoration before the user is permanently deleted?

Accepted Answer

30 days. Microsoft Entra ID implements a 'soft-delete' state for user accounts to protect against accidental data loss. During this period, the user object and most of its properties, including group memberships, can be fully recovered. Once this window expires, the data is purged from the system and cannot be retrieved.

Answer

14 days

Answer

60 days

Answer

90 days

Question 12

You need to perform a bulk invite of 50 guest users from a partner company using a CSV file in the Microsoft Entra admin center. Which column is mandatory in the CSV file for the bulk invitation process to succeed?

Accepted Answer

Email address to invite. Bulk operations are a key skill for identity administrators to handle large-scale changes efficiently. For B2B invitations, Entra ID requires specific identifiers to send the invitation emails and create the guest user objects. Knowing the required schema for these CSV files prevents upload errors and ensures a smooth onboarding experience for external partners.

Answer

First name

Answer

Redirect URL

Answer

User principal name

Question 13

You are managing a hybrid environment with Microsoft Entra Connect. You need to ensure that when a user's account is disabled in the on-premises Active Directory, the corresponding cloud account is also disabled immediately. What is the default behavior of Entra Connect regarding account status?

Accepted Answer

The cloud account is disabled during the next delta synchronization cycle.. Synchronizing account status is a critical security control. If an employee leaves the company, their access must be revoked across all systems. Microsoft Entra Connect handles this by mapping the 'userAccountControl' attribute from on-premises to the 'accountEnabled' property in the cloud, ensuring that the cloud identity reflects the local administrative state.

Answer

The cloud account remains enabled until the administrator manually runs a full synchronization.

Answer

The cloud account is immediately disabled via a real-time webhook call to Entra ID.

Answer

The cloud account is deleted rather than disabled to save on license costs.

Question 14

Your company uses Microsoft Entra Connect to sync identities from an on-premises Active Directory. You have a user named 'User1' who exists in both environments, but they are not currently linked. You need to perform a 'soft-match' to link them. Which attribute must be identical on both the on-premises and cloud objects?

Accepted Answer

proxyAddresses. Soft-matching is a critical process for merging existing cloud identities with on-premises accounts during the initial setup of directory synchronization. It prevents the creation of duplicate accounts and ensures that users maintain their existing cloud data and permissions while transitioning to a synchronized identity model managed from the local Active Directory environment.

Answer

ObjectGUID

Answer

DisplayName

Answer

EmployeeID

Question 15

Your company wants to use B2B Direct Connect to collaborate with a partner organization in a Microsoft Teams shared channel. Which of the following is a strict requirement for B2B Direct Connect to function?

Accepted Answer

Both organizations must configure mutual trust in their Cross-tenant access settings.. B2B Direct Connect is a specialized form of collaboration that removes the need for guest accounts. It is built on mutual trust between two Microsoft Entra tenants. Understanding the specific configuration requirements, such as the need for both organizations to configure cross-tenant access settings, is vital for enabling seamless, high-performance collaboration in Teams.

Answer

The external users must be invited as guests to the host tenant first.

Answer

All users in the partner organization must have a Microsoft Entra ID P2 license.

Answer

The partner organization must use a third-party identity provider like Okta or Google.

Question 16

Refer to the exhibit. An administrator is using the Microsoft Graph PowerShell SDK to create a new user. Which additional step must be taken if the administrator wants this user to be prompted to change their password at the first sign-in?

Accepted Answer

Set the 'ForceChangePasswordNextSignIn' property to true within the $passwordProfile object.. To force a password change at first sign-in using the Microsoft Graph PowerShell SDK, you must define a PasswordProfile object using New-MgObjectPasswordProfile and set the ForceChangePasswordNextSignIn property to $true, then pass this object to the -PasswordProfile parameter of the New-MgUser command.

Answer

Add the parameter -ForceChangePasswordNextSignIn $true to the New-MgUser command.

Answer

Run the command Set-MgUserPassword -UserId "tuser@contoso.com" -ForceChange $true after creation.

Answer

The user will automatically be prompted to change their password because 'AccountEnabled' is set to true.

Question 17

You want to delegate the ability for a local office manager to reset passwords for only the users in their specific branch. What is the most efficient way to implement this without granting the manager permissions over the entire tenant?

Accepted Answer

Create an Administrative Unit (AU), add the branch users to it, and assign the manager the Password Administrator role scoped to that AU.. Delegated administration is a core concept in Microsoft Entra ID that allows for regional or departmental management. By using Administrative Units, you can scope administrative permissions to a subset of users, ensuring the principle of least privilege is maintained while still empowering local staff to handle routine tasks like password resets.

Answer

Assign the manager the Helpdesk Administrator role at the tenant level.

Answer

Add the manager to a security group that has 'Full Control' over the branch users' OU in Active Directory.

Answer

Use a Dynamic Group to identify the branch users and grant the manager 'Owner' rights to the group.

Question 18

A user reports being unable to sign in to a SaaS application. You check the Microsoft Entra sign-in logs and see a 'Conditional Access policy failure' status. What is the first step you should take to troubleshoot?

Accepted Answer

Examine the 'Conditional Access' tab in the sign-in log entry for the specific failure.. Analyzing the sign-in logs is the primary mechanism for auditing access failures. By identifying which specific policy triggered the block, you can determine if the failure was due to device compliance, location, or MFA requirements. This systematic approach saves time by narrowing down the issue from a general authentication failure to a specific policy enforcement point, allowing for targeted remediation or policy adjustments to resolve the user's access impediment.

Answer

Reset the user's password.

Answer

Ask the user to clear their browser cache.

Answer

Disable all Conditional Access policies for the tenant.

Question 19

A user is unable to sign in because they have lost their primary MFA device and do not have a backup method registered. You need to provide them with a short-term, high-assurance method to bypass MFA and register a new device. What should you generate for the user?

Accepted Answer

A Temporary Access Pass (TAP).. The Temporary Access Pass (TAP) is a time-limited passcode that acts as a strong authentication factor. It is specifically designed to facilitate the onboarding of new users or to assist users who have lost their authentication methods. TAPs allow users to satisfy MFA requirements during the sign-in process, enabling them to reach the security info page and update their permanent credentials.

Answer

A new App Password.

Answer

An SSPR recovery code.

Answer

A bypass code from the MFA Server.

Question 20

You need to perform a bulk upload of 500 new employees into Microsoft Entra ID using a CSV file. Which TWO columns are mandatory in the CSV file for the 'Bulk create users' operation to succeed?

Accepted Answer

User name [userName]. When performing a bulk create operation in Microsoft Entra ID, the CSV template requires the 'User name' (User principal name) to identify the account and the 'Initial password' to satisfy the security requirement for account creation. Other fields like Job title, Usage location, and Department are optional attributes.

Answer

Job title [jobTitle]

Answer

Usage location [usageLocation]

Answer

Department [department]