SC-300 Hard Questions — 25 Difficult Questions

Question 1

You need to store specialized metadata for users in Microsoft Entra ID that is not available in the standard user profile attributes. This metadata must be accessible via the Microsoft Graph API and must support fine-grained access control so only specific administrators can read or write the data. Which THREE steps are required to implement Custom Security Attributes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the Attribute Definition Administrator role. Custom security attributes offer a way to extend the user schema with highly secure, controlled data. Unlike extension attributes, these support RBAC for the attributes themselves. This allows sensitive data, like employee IDs or clearance levels, to be stored on the user object while strictly limiting who can interact with that specific metadata.

Answer

Configure a new Schema Extension using the Azure AD Graph API

Answer

Create a new Directory Extension in Microsoft Entra Connect

Question 2

Refer to the exhibit. You are reviewing a custom role definition intended for a security auditor. What is the specific effect of the permission defined in the 'operations' array?

Accepted Answer

The role can read the actual values of custom security attributes assigned to users and other directory objects.. Custom security attributes in Microsoft Entra ID allow for the storage of sensitive metadata that is not visible to standard users or even Global Administrators by default. Understanding the specific RBAC actions required to read or write these attributes is essential for maintaining a secure environment where sensitive data like 'Salary Grade' or 'Clearance Level' is protected.

Answer

The role can view the definitions and allowed values of all custom security attributes in the tenant.

Answer

The role can assign new custom security attribute values to users but cannot modify existing ones.

Answer

The role can only read custom security attributes if they are also a member of the Attribute Definition Administrator role.

Question 3

You are configuring External Collaboration settings in Microsoft Entra ID. You want to ensure that only specific partner domains can be invited as guests, and that guest users have the most restricted access to the directory. Which THREE settings should you configure?

Accepted Answer

Set 'Guest user access is restricted to properties and memberships of their own directory objects'.. Securing external identities involves a multi-layered approach that controls both who can be invited and what those individuals can see once they are in the tenant. These settings are found in the External Collaboration settings and are vital for preventing data leakage and ensuring that guest access aligns with organizational security policies.

Answer

Disable the 'External user' account type in the User Settings blade.

Answer

Enable 'Self-service sign-up via user flows' for all external users.

Question 4

You are implementing Entra ID Password Protection for your on-premises Active Directory Domain Services (AD DS) environment. Which TWO components must be installed on your on-premises servers?

Accepted Answer

Microsoft Entra ID Password Protection Proxy. Entra ID Password Protection extends the cloud-based banned password list to your local Active Directory. This ensures a consistent security policy across hybrid environments. Understanding the architecture, specifically the role of the Proxy and the DC Agent, is crucial for a successful deployment that protects local accounts from weak or compromised passwords.

Answer

Microsoft Entra Connect Sync Engine

Answer

Microsoft Entra Application Proxy Connector

Answer

Microsoft Entra Connect Health Agent

Question 5

Your company wants to use B2B Direct Connect to collaborate with a partner organization in a Microsoft Teams shared channel. Which of the following is a strict requirement for B2B Direct Connect to function?

Accepted Answer

Both organizations must configure mutual trust in their Cross-tenant access settings.. B2B Direct Connect is a specialized form of collaboration that removes the need for guest accounts. It is built on mutual trust between two Microsoft Entra tenants. Understanding the specific configuration requirements, such as the need for both organizations to configure cross-tenant access settings, is vital for enabling seamless, high-performance collaboration in Teams.

Answer

The external users must be invited as guests to the host tenant first.

Answer

All users in the partner organization must have a Microsoft Entra ID P2 license.

Answer

The partner organization must use a third-party identity provider like Okta or Google.

Question 6

You need to implement Custom Security Attributes in Microsoft Entra ID to store sensitive employee data that should not be visible to standard administrators. Which TWO requirements must be met to manage these attributes?

Accepted Answer

You must be assigned the Attribute Definition Administrator role.. Custom Security Attributes provide a way to store specialized metadata with enhanced access controls. Unlike standard directory attributes, they are not visible by default to Global Administrators. Implementing them correctly requires specific role assignments and an understanding of how attribute sets function to isolate sensitive information from unauthorized viewing.

Answer

The tenant must have at least a Microsoft Entra ID Free edition.

Answer

The attributes must be stored in the 'Default' attribute set.

Answer

Global Administrators can view all custom attributes by default.

Question 7

You manage a Microsoft Entra tenant. A user named User1 reports that their cloud account is compromised. You need to instantly revoke all refresh tokens and sessions for User1 without deleting the account. What should you do?

Accepted Answer

Run the Revoke-AzureADUserAllRefreshToken PowerShell cmdlet targeting the User1 object ID.. Revoking sessions forces all issued refresh tokens to become invalid immediately, requiring the affected user to reauthenticate across all devices and applications. This crucial administrative response mitigates active breaches and prevents unauthorized access while investigating compromised credentials without disrupting overall account provisioning status.

Answer

Disable the user account temporarily by setting AccountEnabled to false in Microsoft Entra ID.

Answer

Modify the user password to a temporary value and require password reset upon next sign-in.

Answer

Delete the user object from the directory and restore it from the deleted items container.

Question 8

You need to implement Authentication Strengths in Conditional Access to ensure that users access highly sensitive applications using only phishing-resistant MFA. Which method should you select?

Accepted Answer

FIDO2 Security Key. Authentication Strengths allow administrators to define exactly which MFA methods are acceptable for specific access scenarios. By mandating phishing-resistant methods like FIDO2 security keys or Windows Hello for Business, you mitigate the risk of credential theft via man-in-the-middle or phishing attacks. This is a critical control for securing high-value cloud resources against sophisticated threat actors who can bypass traditional SMS or push-based MFA methods through real-time proxying.

Answer

SMS-based authentication

Answer

Microsoft Authenticator push notification

Answer

Voice call authentication

Question 9

You need to ensure that your tenant is protected against common credential-based attacks. Which THREE features should you enable or configure?

Accepted Answer

Smart Lockout. A multi-layered defense is required to protect identities. Smart Lockout prevents brute-force attacks by tracking failed attempts, Security Defaults (or Conditional Access) provides baseline protection including MFA, and Password Protection prevents users from creating weak credentials. Together, these controls address the most common vectors for credential compromise, significantly hardening the identity perimeter against automated and manual attacks that target weak or re-used passwords across the enterprise.

Answer

Public Preview features for all users.

Answer

SMS as the only MFA method.

Question 10

You are configuring Password Protection in Microsoft Entra ID. Which TWO actions must you take to ensure the custom banned password list is enforced effectively?

Accepted Answer

Enable 'Password protection' in the Entra admin center and add terms to the custom banned password list.. Implementing custom banned password lists is a proactive measure to prevent users from selecting weak, predictable, or leaked passwords. By combining the global banned list with organization-specific terms, you significantly increase the entropy of passwords across your tenant. Ensuring that the feature is enabled in the Microsoft Entra admin center and that agents are correctly deployed is essential for both cloud-only and hybrid environments to maintain consistent credential security policy enforcement.

Answer

Configure a Conditional Access policy to enforce password changes every 90 days.

Answer

Enable 'Self-service password reset' for all users in the tenant.

Answer

Set the Password Protection mode to 'Audit' mode permanently.

Question 11

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

Accepted Answer

Create a Conditional Access policy with a Named Location and block access from 'Any location' except the trusted network.. Conditional Access is the correct tool for location-based access control. By defining 'Named Locations' based on IP ranges and then creating a policy that blocks access from all locations except those defined, you ensure that administrative portals are unreachable from outside the corporate network. This creates a powerful perimeter-based defense that prevents attackers from attempting to access administrative interfaces from known-bad or foreign regions.

Answer

Use the 'Country-based' location filter in the administrative portal settings.

Answer

Create a new security group for administrators and add an IP restriction to the group.

Answer

Configure 'Restrict access to Microsoft Entra administration portal' to 'No'.

Question 12

You are managing access to a sensitive application. You want to ensure that if a user's risk level changes to 'High', they are immediately prompted for a password change. How do you implement this?

Accepted Answer

Configure a user risk policy in Entra ID Protection to require a password change.. Using Entra ID Protection in conjunction with Conditional Access policies allows for real-time, risk-based access remediation. By configuring a policy that requires a password change upon a 'High' risk event, you automate the response to potential compromises. This reduces the dwell time of an attacker by forcing an immediate credential reset, which invalidates the existing session and prevents further unauthorized access without requiring manual administrative intervention for every detected high-risk event.

Answer

Configure a sign-in risk policy.

Answer

Manually reset the user's password in the admin center.

Answer

Create a Conditional Access policy that blocks the user's IP.

Question 13

You are configuring Entra ID PIM for a group of administrators. You need to ensure that when they activate a privileged role, they provide a justification and perform MFA. Which TWO settings should you configure?

Accepted Answer

Require Azure MFA on activation. Privileged Identity Management (PIM) settings allow administrators to enforce specific security requirements for role activations. By configuring the activation requirement for MFA, you ensure the identity is verified during the activation event. Requiring a justification provides an audit trail for why the privilege was elevated. These controls are foundational for the principle of least privilege, ensuring that high-level administrative access is not only transient but also properly documented and verified.

Answer

Require ticket number on activation

Answer

Require approval on activation

Answer

Enable persistent assignment

Question 14

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication is a cornerstone of modern identity security, as it prevents attackers from using stolen credentials or intercepting MFA codes. These methods rely on cryptographic keys bound to the hardware or the device, making it impossible for a user to accidentally provide their credentials to a malicious site. Implementing these methods significantly reduces the risk of account takeovers for high-profile users.

Answer

Microsoft Authenticator push notifications

Answer

SMS-based authentication codes

Question 15

Refer to the exhibit. This Conditional Access policy uses a specific Authentication Strength. If the ID shown corresponds to the 'Phishing-resistant MFA' built-in strength, which authentication method will NOT satisfy the policy?

Accepted Answer

Microsoft Authenticator push notification with number matching.. Authentication Strengths allow administrators to define exactly which combinations of authentication methods are acceptable for accessing specific resources. The 'Phishing-resistant MFA' strength is the most restrictive built-in option, requiring methods that cryptographically bind the user's identity to the device and the service. Understanding which methods meet this high bar is essential for securing sensitive administrative or financial applications.

Answer

Windows Hello for Business.

Answer

FIDO2 security key.

Answer

Microsoft Entra Certificate-based authentication (Multi-factor).

Question 16

Your organization is adopting Global Secure Access (Entra Internet Access) to protect web traffic. You want to apply a Conditional Access policy that requires MFA specifically when users attempt to access a specific set of high-risk external websites. How should you configure this in the Conditional Access policy?

Accepted Answer

Select the 'Internet Access' traffic profile in the Target Resources section.. Global Secure Access extends Microsoft Entra's identity-centric security to internet traffic. By routing traffic through the Global Secure Access service, administrators can treat web traffic similarly to cloud applications. This allows for the application of Conditional Access policies based on destination, enabling fine-grained control over how users access the open internet and protecting the organization from malicious or unapproved websites.

Answer

Add the external website URLs to the 'Cloud Apps' list as custom applications.

Answer

Configure a 'Named Location' for each high-risk website IP address.

Answer

Use a 'Microsoft 365' traffic profile and filter by URL category.

Question 17

Which THREE conditions can you use in a Conditional Access policy to restrict access to sensitive applications?

Accepted Answer

Device platform. Conditional Access provides several conditions to build granular security policies. Device platforms, locations, and client apps are standard conditions used to filter access. These are critical for enforcing Zero Trust principles, as they allow administrators to define 'where', 'how', and 'from what' users can connect, ensuring that access is granted only under verified and secure circumstances, minimizing the attack surface effectively.

Answer

User department

Answer

Password strength

Question 18

Refer to the exhibit. A user reports they cannot access an app. The error code 50072 appears. What is the most likely cause?

Accepted Answer

The user is not registered for MFA.. Error code 50072 specifically indicates that the user is required to enroll in MFA but has not yet completed the setup. This often happens when a new Conditional Access policy is enforced that mandates MFA, catching users off-guard. Identifying this error is essential for helpdesk support to quickly guide users through the registration process, ensuring they can gain access to applications without unnecessary downtime while maintaining security compliance.

Answer

The user's account is locked.

Answer

The user's password has expired.

Answer

The user is on an unauthorized network.

Question 19

Refer to the exhibit. An administrator is running a Microsoft Graph PowerShell command. What is the primary purpose of this specific command within the context of authentication management?

Answer

To register a new FIDO2 key for the user.

Answer

To change the label of an existing security key.

Answer

To disable FIDO2 authentication for the entire tenant.

Answer

To reset the user's primary password.

Question 20

Refer to the exhibit. What is the impact of this command on the user experience?

Accepted Answer

Session tokens expire after one hour.. The command creates a token lifetime policy that limits the single-factor session to one hour. This effectively forces re-authentication after one hour of idle or active time for non-MFA sessions. This is a legacy method of controlling token life; in modern implementations, this is superseded by Conditional Access sign-in frequency controls, which offer more flexibility and better alignment with modern security practices like continuous access evaluation.

Answer

Users must MFA every hour.

Answer

Users are blocked after one hour.

Answer

The policy forces MFA for every sign-in.