SC-300 Implement Authentication and Access Management — 10 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to ensure that guest users can only access specific applications and cannot browse the directory for other users. What should you configure?

Accepted Answer

Set Guest user access to 'Guest users have limited access to properties and memberships of directory objects'.. Restricting guest access in Entra ID is crucial for preventing information leakage regarding your internal directory structure. By configuring the External Collaboration Settings, you limit the visibility of guest users to only the objects they are assigned to, effectively hiding internal employee lists and organizational structures. This principle of least privilege ensures that external identities operate strictly within their defined scopes, minimizing the attack surface against social engineering or reconnaissance attempts.

Answer

Enable 'Restrict access to Microsoft Entra administration portal' for all guest accounts.

Answer

Create a Conditional Access policy that blocks guests from accessing the Microsoft Graph API.

Answer

Disable the 'Invite guests' setting in the External Collaboration settings menu.

Question 2

You are configuring Password Protection in Microsoft Entra ID. Which TWO actions must you take to ensure the custom banned password list is enforced effectively?

Accepted Answer

Enable 'Password protection' in the Entra admin center and add terms to the custom banned password list.. Implementing custom banned password lists is a proactive measure to prevent users from selecting weak, predictable, or leaked passwords. By combining the global banned list with organization-specific terms, you significantly increase the entropy of passwords across your tenant. Ensuring that the feature is enabled in the Microsoft Entra admin center and that agents are correctly deployed is essential for both cloud-only and hybrid environments to maintain consistent credential security policy enforcement.

Answer

Configure a Conditional Access policy to enforce password changes every 90 days.

Answer

Enable 'Self-service password reset' for all users in the tenant.

Answer

Set the Password Protection mode to 'Audit' mode permanently.

Question 3

Refer to the exhibit. You are reviewing a custom permission policy intended to allow an application to manage user profile photos. Why is this policy considered a security risk?

Accepted Answer

The permission level allows the application to modify sensitive user attributes beyond just photos.. The explanation incorrectly describes Microsoft Graph permissions as having a 'wildcard resource scope'. In Microsoft Graph, 'User.ReadWrite.All' is an application permission that grants the app the ability to read and write all user profiles in the directory. The security risk is that it is an 'All' permission, which is overly broad, rather than a resource-based wildcard issue.

Answer

The policy version is outdated and causes compatibility issues with modern Microsoft Graph endpoints.

Answer

The Action field lacks the required 'application:' prefix for service principals.

Answer

The Resource '*' is mandatory for all User permission scopes.

Question 4

You need to implement Authentication Strengths in Conditional Access to ensure that users access highly sensitive applications using only phishing-resistant MFA. Which method should you select?

Accepted Answer

FIDO2 Security Key. Authentication Strengths allow administrators to define exactly which MFA methods are acceptable for specific access scenarios. By mandating phishing-resistant methods like FIDO2 security keys or Windows Hello for Business, you mitigate the risk of credential theft via man-in-the-middle or phishing attacks. This is a critical control for securing high-value cloud resources against sophisticated threat actors who can bypass traditional SMS or push-based MFA methods through real-time proxying.

Answer

SMS-based authentication

Answer

Microsoft Authenticator push notification

Answer

Voice call authentication

Question 5

A user reports being unable to sign in to a SaaS application. You check the Microsoft Entra sign-in logs and see a 'Conditional Access policy failure' status. What is the first step you should take to troubleshoot?

Accepted Answer

Examine the 'Conditional Access' tab in the sign-in log entry for the specific failure.. Analyzing the sign-in logs is the primary mechanism for auditing access failures. By identifying which specific policy triggered the block, you can determine if the failure was due to device compliance, location, or MFA requirements. This systematic approach saves time by narrowing down the issue from a general authentication failure to a specific policy enforcement point, allowing for targeted remediation or policy adjustments to resolve the user's access impediment.

Answer

Reset the user's password.

Answer

Ask the user to clear their browser cache.

Answer

Disable all Conditional Access policies for the tenant.

Question 6

You are implementing Privileged Identity Management (PIM). Which TWO outcomes are achieved when you assign a user to an 'Eligible' role rather than a 'Permanent' role?

Accepted Answer

The user must request activation for the role, which can require multi-factor authentication.. PIM 'Eligible' assignments significantly reduce the risk of standing access. By requiring the user to perform an activation step, you add a layer of accountability, often including MFA and justification requirements. Permanent assignments are a major security risk because they provide persistent high-level access that can be abused if the account is compromised. Limiting standing access ensures that privileges are only active when they are absolutely necessary for the task at hand.

Answer

The user retains the permissions indefinitely without needing to take any further action.

Answer

The user is automatically notified via email whenever an administrative change occurs.

Answer

The user can bypass Conditional Access policies when activating the role.

Question 7

Your company requires all users to access Microsoft 365 from company-managed devices. How should you configure Conditional Access to enforce this?

Accepted Answer

Create a policy requiring 'Require device to be marked as compliant'.. Enforcing device compliance is a foundational element of a Zero Trust architecture. By creating a Conditional Access policy that requires devices to be marked as compliant with Intune or be Microsoft Entra hybrid joined, you ensure that only devices meeting your security baseline can access sensitive data. This prevents users from accessing corporate resources from personal, unmanaged devices that may lack adequate security controls, encryption, or antivirus protections.

Answer

Create a policy requiring 'Require approved client app'.

Answer

Configure an App Protection Policy in the Microsoft Entra portal.

Answer

Set the user session frequency to 1 hour.

Question 8

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

Accepted Answer

Create a Conditional Access policy with a Named Location and block access from 'Any location' except the trusted network.. Conditional Access is the correct tool for location-based access control. By defining 'Named Locations' based on IP ranges and then creating a policy that blocks access from all locations except those defined, you ensure that administrative portals are unreachable from outside the corporate network. This creates a powerful perimeter-based defense that prevents attackers from attempting to access administrative interfaces from known-bad or foreign regions.

Answer

Use the 'Country-based' location filter in the administrative portal settings.

Answer

Create a new security group for administrators and add an IP restriction to the group.

Answer

Configure 'Restrict access to Microsoft Entra administration portal' to 'No'.

Question 9

You are auditing sign-in logs and see many 'Interrupted' sign-ins. What does this typically indicate?

Accepted Answer

The user is being prompted to complete a required action like MFA registration.. An 'Interrupted' sign-in status in Entra ID occurs when the authentication process is paused because the user is required to complete an additional action, such as MFA registration, password reset, or terms of use acceptance. It is not an error, but a state where the identity provider is waiting for the user to fulfill a policy mandate before granting access to the requested application, which is crucial for compliant identity management.

Answer

The user entered an incorrect password multiple times.

Answer

The user's device is not compliant with company policy.

Answer

The service principal has an expired client secret.

Question 10

You need to ensure that your tenant is protected against common credential-based attacks. Which THREE features should you enable or configure?

Accepted Answer

Smart Lockout. A multi-layered defense is required to protect identities. Smart Lockout prevents brute-force attacks by tracking failed attempts, Security Defaults (or Conditional Access) provides baseline protection including MFA, and Password Protection prevents users from creating weak credentials. Together, these controls address the most common vectors for credential compromise, significantly hardening the identity perimeter against automated and manual attacks that target weak or re-used passwords across the enterprise.

Answer

Public Preview features for all users.

Answer

SMS as the only MFA method.