SC-300 Practice Test 2 — 30 Questions

Question 1

What is the recommended approach for managing emergency access accounts to ensure they are not locked out?

Accepted Answer

Exclude them from Conditional Access policies.. Emergency access accounts, or 'break-glass' accounts, must be excluded from Conditional Access policies that enforce MFA or device compliance. Since these accounts are designed for critical recovery when standard authentication flows fail (like an MFA provider outage), they must bypass these controls. This ensures that administrators can always regain access to the directory, preventing a catastrophic lockout scenario while keeping the accounts highly protected by long, complex passwords and monitoring.

Answer

Include them in all Conditional Access policies.

Answer

Apply a special MFA policy for them.

Answer

Store their passwords in a shared Excel file.

Question 2

A company wants to implement a passwordless strategy for its administrative accounts. The administrators work from shared workstations that do not have built-in biometric hardware. Which authentication method should you recommend to provide the highest level of security?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the most secure passwordless method for shared workstations because they are hardware-backed and phishing-resistant. Unlike Windows Hello for Business, which is tied to a specific device's TPM, FIDO2 keys are portable, making them ideal for administrators moving between different shared machines that lack biometric hardware.

Answer

Windows Hello for Business

Answer

Microsoft Authenticator (Phone Sign-in)

Answer

SMS-based authentication

Question 3

An administrator wants to prevent brute-force attacks on user passwords by locking out accounts after several failed attempts. They want to ensure that legitimate users are not locked out by attackers from different geographical locations. Which feature should they configure?

Answer

Active Directory Group Policy

Answer

Microsoft Entra Smart Lockout

Answer

Conditional Access Block Policy

Answer

Tenant Restrictions

Question 4

A developer is choosing between using a Managed Identity and a Service Principal with a client secret for a new application. Which TWO benefits are unique to using Managed Identities? (Choose two)

Accepted Answer

Managed identities do not require the developer to manage or rotate secrets.. Managed identities provide specific security and operational advantages that service principals with secrets lack. They eliminate the need for developers to handle sensitive credentials and automate the lifecycle management of the identity. Understanding these differences is crucial for implementing secure workload identities according to Microsoft best practices.

Answer

Managed identities can be used to access resources outside of Azure via SAML.

Answer

Managed identities support the use of client certificates for authentication.

Answer

Managed identities allow for the assignment of Application permissions to Microsoft Graph.

Question 5

You need to ensure that administrative accounts are protected by requiring hardware-based MFA. Which feature supports this?

Accepted Answer

Conditional Access Authentication Strength. Authentication Strength policies in Conditional Access allow administrators to define which specific MFA methods are acceptable for access. By selecting 'FIDO2 security keys' or other hardware-based options, you can mandate that administrative accounts use the highest level of protection available. This is crucial for securing high-privilege identities, as hardware-based factors are resistant to phishing and man-in-the-middle attacks, providing a superior security posture compared to SMS or app-based push notifications.

Answer

Identity Protection risk-based policy

Answer

Azure AD PIM role settings

Answer

Intune app protection policies

Question 6

Refer to the exhibit. A user reports they cannot access an app. The error code 50072 appears. What is the most likely cause?

Accepted Answer

The user is not registered for MFA.. Error code 50072 indicates that the user is required to enroll for MFA, but has not yet completed the registration process. This occurs when a Conditional Access policy requires MFA, but the user has not yet set up their authentication methods.

Answer

The user's account is locked.

Answer

The user's password has expired.

Answer

The user is on an unauthorized network.

Question 7

Your company frequently collaborates with a partner organization. You want to allow the partner's users to access your resources using their own corporate credentials, but you want to enforce your own MFA requirements when they access sensitive data. Which feature should you use?

Accepted Answer

Cross-tenant access settings. Cross-tenant access settings allow you to manage how you collaborate with other Microsoft Entra organizations. Within these settings, you can configure trust settings that allow you to either trust the MFA performed by the home tenant or, as required here, ignore their MFA and enforce your own tenant's Conditional Access MFA requirements.

Answer

B2C User Flows

Answer

Application Proxy

Answer

Direct Routing

Question 8

Which of the following scenarios is the primary use case for utilizing an Azure AD Service Principal over a Managed Identity?

Accepted Answer

When the application runs on-premises and needs to access Azure APIs.. Managed identities are limited to Azure-hosted resources. When your application runs on-premises, in another cloud, or on a local machine, you cannot use a managed identity. In these cases, you must register an application in Azure AD and use a service principal with either a certificate or a client secret to establish the required trust and authentication.

Answer

When the application runs on an Azure Virtual Machine.

Answer

When the application requires access to multiple Azure subscriptions.

Answer

When you need to provide administrative access to the entire tenant.

Question 9

You need to implement Authentication Strengths in Microsoft Entra ID to enforce phishing-resistant MFA for your IT administrators. Which TWO authentication methods are considered phishing-resistant by the built-in 'Phishing-resistant MFA' strength?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication methods rely on cryptographic hardware and the FIDO2 standard or certificate-based authentication to ensure that the authentication process cannot be intercepted or spoofed. The 'Phishing-resistant MFA' built-in strength specifically includes FIDO2 security keys and Windows Hello for Business, as both methods utilize device-bound keys and local gestures.

Answer

Microsoft Authenticator (Push)

Answer

Email OTP

Answer

Password + SMS

Question 10

Your organization has several financial applications that contain sensitive data. You need to ensure that users are prompted for multi-factor authentication only when they attempt to access these specific applications from outside the corporate network. Which feature should you implement to meet this requirement with the least amount of administrative effort?

Accepted Answer

Conditional Access policies. Conditional Access policies allow for granular control based on signals such as the specific application being accessed and the user's network location. By creating a policy that targets the financial applications and excludes the corporate network (Named Locations), you can enforce MFA only for external access, which is the most efficient way to meet the requirement.

Answer

Security Defaults

Answer

Microsoft Entra ID Protection

Answer

Authentication Methods Policy

Question 11

You are implementing Continuous Access Evaluation (CAE) in your tenant. A user's account is disabled by an administrator. How does CAE affect the user's active session with Exchange Online?

Accepted Answer

The session is revoked in near real-time.. Continuous Access Evaluation (CAE) is specifically designed to revoke access in near real-time when critical events occur, such as a user account being disabled. Therefore, option B is the correct answer.

Answer

The session remains active until the access token expires.

Answer

The user is prompted for MFA at the next sign-in.

Answer

The session is revoked only if the user's IP changes.

Question 12

You are implementing Privileged Identity Management (PIM) for Entra ID roles. You need to configure the 'Global Administrator' role to ensure that when a user activates the role, it is done securely and with oversight. Which TWO settings should you configure in the role's activation policy?

Accepted Answer

Require approval to activate. When configuring the activation settings for a highly privileged role like Global Administrator in Microsoft Entra ID PIM, you should configure 'Require approval to activate' to ensure oversight by designated approvers, and 'Maximum activation duration' to limit the exposure window.

Answer

Permanent eligibility

Answer

Require permanent assignment

Answer

Allow permanent activation

Question 13

You are managing service principals for an application that spans multiple environments. You need to ensure that credentials for these principals are rotated securely. Which TWO actions should you perform? (Choose two)

Accepted Answer

Store all service principal secrets in Azure Key Vault and configure automated rotation.. Managing service principal secrets requires a proactive lifecycle strategy. Azure Key Vault provides a centralized, secure location to store secrets and automate their rotation using Logic Apps or Function Apps. Additionally, migrating to certificate-based authentication or Workload Identity Federation significantly reduces the risk associated with static password leakage and simplifies the maintenance overhead of manual rotation cycles.

Answer

Use the Azure AD portal to manually update secrets every 30 days.

Answer

Enable password writeback in Azure AD Connect to force rotation.

Answer

Configure the service principal to rotate its own password every hour.

Question 14

You are configuring a Managed Identity for an Azure Virtual Machine. You need to ensure that the identity can access an Azure Key Vault secret. What is the most secure way to grant this access while adhering to the principle of least privilege?

Accepted Answer

Assign the Key Vault Secrets User role to the Managed Identity at the Key Vault scope.. Using Azure RBAC for Key Vault data plane access is the recommended approach for managing managed identities. By assigning a specific role like 'Key Vault Secrets User' at the scope of the individual secret or the vault itself, you restrict permissions to only what is necessary, effectively preventing unauthorized access and reducing the attack surface compared to legacy access policies which lack granular control.

Answer

Assign the Contributor role to the Managed Identity at the subscription scope.

Answer

Add the Managed Identity to the Key Vault access policies.

Answer

Store the Client ID and Client Secret in the application configuration file.

Question 15

You are auditing your environment for security risks related to workload identities. Which THREE conditions should you flag as high-security risks? (Choose three)

Accepted Answer

Service principals with client secrets that have no expiration date.. The selected options (A, C, D) are correct as they represent significant security risks (lack of credential rotation, credential reuse, and excessive privilege). The explanation is accurate.

Answer

Managed identities assigned to multiple virtual machines.

Answer

Service principals that use certificate-based authentication.

Question 16

You need to automate the rotation of a certificate used for service principal authentication. Which tool should you use to store the private key and manage the rotation lifecycle?

Accepted Answer

Azure Key Vault. Azure Key Vault is the industry-standard service for managing cryptographic keys and secrets. For service principal certificates, the Key Vault can store the certificate, and integrated automation (such as Logic Apps) can trigger renewal and updates to the Azure AD application registration, ensuring the identity remains secure without manual intervention.

Answer

Azure Storage Account

Answer

Azure App Configuration

Answer

Azure DevOps Secret Variables

Question 17

A company uses a service principal for an automation script running on-premises. Security policy requires that the credentials for this service principal be rotated every 30 days. Which solution provides the most secure method for managing these credentials without requiring manual updates to the script's configuration?

Accepted Answer

Use Azure Key Vault with certificate-based authentication.. Rotating secrets for service principals is a critical security task. Using Azure Key Vault with certificates allows the automation script to authenticate securely without storing hardcoded secrets. This approach ensures that even if the script environment is compromised, the credential itself is managed within a secure vault and rotated according to policy requirements.

Answer

Store a client secret in a local environment variable.

Answer

Use a Managed Identity on the on-premises server.

Answer

Implement a Personal Access Token with auto-renewal.

Question 18

You are designing an access review program in Microsoft Entra ID. Which TWO factors must you consider to ensure the review remains effective and compliant? Select exactly two.

Accepted Answer

The frequency of the review cycle. Effective access reviews require defining both the scope of identities and the specific criteria for decision-making. By choosing the correct reviewers—usually resource owners or direct managers—and setting a clear duration, you ensure that decisions are informed and timely. This practice is essential for maintaining the principle of least privilege, as it forces periodic re-validation of permissions that often suffer from 'privilege creep' over time in large enterprise environments.

Answer

The maximum number of users per review

Answer

The use of self-service groups

Answer

The integration with external identity providers

Question 19

You are managing a highly sensitive Azure subscription. You have configured PIM to require approval for the 'Owner' role. A user requests activation of this role. As the designated approver, you are unavailable. You need to ensure that the request can still be processed. What is the best way to handle this during the PIM configuration phase?

Accepted Answer

Configure a group as the approver for the role in PIM settings.. While the explanation mentions 'designating multiple approvers', it fails to explain that PIM allows assigning multiple users or groups as approvers. Using a group is the best practice for scalability and management, as it avoids the need to update PIM settings every time an individual approver changes roles or leaves the organization.

Answer

Assign the 'Global Administrator' role to the requesting user permanently.

Answer

Set the activation duration to 24 hours to reduce the number of requests.

Answer

Disable the 'Require approval' setting and use 'Require MFA' only.

Question 20

An organization needs to allow an Azure Function to access secrets in an Azure Key Vault without storing any credentials in the Function's configuration files. Which solution should you implement to satisfy this requirement with the least administrative effort?

Accepted Answer

Configure a system-assigned managed identity for the Azure Function.. Managing workload identities requires understanding how to minimize the attack surface by eliminating secrets. Using a system-assigned managed identity allows the Azure Function to authenticate directly to Key Vault without storing credentials in code or configuration. This approach reduces the risk of credential leakage and simplifies the development lifecycle by offloading credential management to Microsoft Entra ID.

Answer

Create a service principal and store the client secret in the Function app settings.

Answer

Use a shared access signature (SAS) token with a five-year expiration date.

Answer

Register a new application in Microsoft Entra ID and grant it Key Vault Secrets Officer permissions.