SC-300 Implement Authentication and Access Management — All Questions With Answers

Question 1

Your organization uses Microsoft Entra ID. You need to ensure that guest users can only access specific applications and cannot browse the directory for other users. What should you configure?

Accepted Answer

Set Guest user access to 'Guest users have limited access to properties and memberships of directory objects'.. Restricting guest access in Entra ID is crucial for preventing information leakage regarding your internal directory structure. By configuring the External Collaboration Settings, you limit the visibility of guest users to only the objects they are assigned to, effectively hiding internal employee lists and organizational structures. This principle of least privilege ensures that external identities operate strictly within their defined scopes, minimizing the attack surface against social engineering or reconnaissance attempts.

Answer

Enable 'Restrict access to Microsoft Entra administration portal' for all guest accounts.

Answer

Create a Conditional Access policy that blocks guests from accessing the Microsoft Graph API.

Answer

Disable the 'Invite guests' setting in the External Collaboration settings menu.

Question 2

You are configuring Password Protection in Microsoft Entra ID. Which TWO actions must you take to ensure the custom banned password list is enforced effectively?

Accepted Answer

Enable 'Password protection' in the Entra admin center and add terms to the custom banned password list.. Implementing custom banned password lists is a proactive measure to prevent users from selecting weak, predictable, or leaked passwords. By combining the global banned list with organization-specific terms, you significantly increase the entropy of passwords across your tenant. Ensuring that the feature is enabled in the Microsoft Entra admin center and that agents are correctly deployed is essential for both cloud-only and hybrid environments to maintain consistent credential security policy enforcement.

Answer

Configure a Conditional Access policy to enforce password changes every 90 days.

Answer

Enable 'Self-service password reset' for all users in the tenant.

Answer

Set the Password Protection mode to 'Audit' mode permanently.

Question 3

Refer to the exhibit. You are reviewing a custom permission policy intended to allow an application to manage user profile photos. Why is this policy considered a security risk?

Accepted Answer

The permission level allows the application to modify sensitive user attributes beyond just photos.. The explanation incorrectly describes Microsoft Graph permissions as having a 'wildcard resource scope'. In Microsoft Graph, 'User.ReadWrite.All' is an application permission that grants the app the ability to read and write all user profiles in the directory. The security risk is that it is an 'All' permission, which is overly broad, rather than a resource-based wildcard issue.

Answer

The policy version is outdated and causes compatibility issues with modern Microsoft Graph endpoints.

Answer

The Action field lacks the required 'application:' prefix for service principals.

Answer

The Resource '*' is mandatory for all User permission scopes.

Question 4

You need to implement Authentication Strengths in Conditional Access to ensure that users access highly sensitive applications using only phishing-resistant MFA. Which method should you select?

Accepted Answer

FIDO2 Security Key. Authentication Strengths allow administrators to define exactly which MFA methods are acceptable for specific access scenarios. By mandating phishing-resistant methods like FIDO2 security keys or Windows Hello for Business, you mitigate the risk of credential theft via man-in-the-middle or phishing attacks. This is a critical control for securing high-value cloud resources against sophisticated threat actors who can bypass traditional SMS or push-based MFA methods through real-time proxying.

Answer

SMS-based authentication

Answer

Microsoft Authenticator push notification

Answer

Voice call authentication

Question 5

A user reports being unable to sign in to a SaaS application. You check the Microsoft Entra sign-in logs and see a 'Conditional Access policy failure' status. What is the first step you should take to troubleshoot?

Accepted Answer

Examine the 'Conditional Access' tab in the sign-in log entry for the specific failure.. Analyzing the sign-in logs is the primary mechanism for auditing access failures. By identifying which specific policy triggered the block, you can determine if the failure was due to device compliance, location, or MFA requirements. This systematic approach saves time by narrowing down the issue from a general authentication failure to a specific policy enforcement point, allowing for targeted remediation or policy adjustments to resolve the user's access impediment.

Answer

Reset the user's password.

Answer

Ask the user to clear their browser cache.

Answer

Disable all Conditional Access policies for the tenant.

Question 6

You are implementing Privileged Identity Management (PIM). Which TWO outcomes are achieved when you assign a user to an 'Eligible' role rather than a 'Permanent' role?

Accepted Answer

The user must request activation for the role, which can require multi-factor authentication.. PIM 'Eligible' assignments significantly reduce the risk of standing access. By requiring the user to perform an activation step, you add a layer of accountability, often including MFA and justification requirements. Permanent assignments are a major security risk because they provide persistent high-level access that can be abused if the account is compromised. Limiting standing access ensures that privileges are only active when they are absolutely necessary for the task at hand.

Answer

The user retains the permissions indefinitely without needing to take any further action.

Answer

The user is automatically notified via email whenever an administrative change occurs.

Answer

The user can bypass Conditional Access policies when activating the role.

Question 7

Your company requires all users to access Microsoft 365 from company-managed devices. How should you configure Conditional Access to enforce this?

Accepted Answer

Create a policy requiring 'Require device to be marked as compliant'.. Enforcing device compliance is a foundational element of a Zero Trust architecture. By creating a Conditional Access policy that requires devices to be marked as compliant with Intune or be Microsoft Entra hybrid joined, you ensure that only devices meeting your security baseline can access sensitive data. This prevents users from accessing corporate resources from personal, unmanaged devices that may lack adequate security controls, encryption, or antivirus protections.

Answer

Create a policy requiring 'Require approved client app'.

Answer

Configure an App Protection Policy in the Microsoft Entra portal.

Answer

Set the user session frequency to 1 hour.

Question 8

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

Accepted Answer

Create a Conditional Access policy with a Named Location and block access from 'Any location' except the trusted network.. Conditional Access is the correct tool for location-based access control. By defining 'Named Locations' based on IP ranges and then creating a policy that blocks access from all locations except those defined, you ensure that administrative portals are unreachable from outside the corporate network. This creates a powerful perimeter-based defense that prevents attackers from attempting to access administrative interfaces from known-bad or foreign regions.

Answer

Use the 'Country-based' location filter in the administrative portal settings.

Answer

Create a new security group for administrators and add an IP restriction to the group.

Answer

Configure 'Restrict access to Microsoft Entra administration portal' to 'No'.

Question 9

You are auditing sign-in logs and see many 'Interrupted' sign-ins. What does this typically indicate?

Accepted Answer

The user is being prompted to complete a required action like MFA registration.. An 'Interrupted' sign-in status in Entra ID occurs when the authentication process is paused because the user is required to complete an additional action, such as MFA registration, password reset, or terms of use acceptance. It is not an error, but a state where the identity provider is waiting for the user to fulfill a policy mandate before granting access to the requested application, which is crucial for compliant identity management.

Answer

The user entered an incorrect password multiple times.

Answer

The user's device is not compliant with company policy.

Answer

The service principal has an expired client secret.

Question 10

You need to ensure that your tenant is protected against common credential-based attacks. Which THREE features should you enable or configure?

Accepted Answer

Smart Lockout. A multi-layered defense is required to protect identities. Smart Lockout prevents brute-force attacks by tracking failed attempts, Security Defaults (or Conditional Access) provides baseline protection including MFA, and Password Protection prevents users from creating weak credentials. Together, these controls address the most common vectors for credential compromise, significantly hardening the identity perimeter against automated and manual attacks that target weak or re-used passwords across the enterprise.

Answer

Public Preview features for all users.

Answer

SMS as the only MFA method.

Question 11

Refer to the exhibit. What is the most likely cause of this sign-in failure for the web application?

Accepted Answer

The redirect URI is missing from the App Registration configuration.. Error 50011 is a classic configuration mismatch between the application's authentication request and the registered settings in Entra ID. The application is sending a redirect URI that is not present in the 'Redirect URIs' list of the App Registration. This is a common deployment issue that occurs when the developer updates the application URL or callback path but fails to synchronize those changes in the Microsoft Entra identity configuration.

Answer

The user does not have sufficient permissions to access the application.

Answer

The client secret has expired.

Answer

The user is using an unsupported browser.

Question 12

You are managing access to a sensitive application. You want to ensure that if a user's risk level changes to 'High', they are immediately prompted for a password change. How do you implement this?

Accepted Answer

Configure a user risk policy in Entra ID Protection to require a password change.. Using Entra ID Protection in conjunction with Conditional Access policies allows for real-time, risk-based access remediation. By configuring a policy that requires a password change upon a 'High' risk event, you automate the response to potential compromises. This reduces the dwell time of an attacker by forcing an immediate credential reset, which invalidates the existing session and prevents further unauthorized access without requiring manual administrative intervention for every detected high-risk event.

Answer

Configure a sign-in risk policy.

Answer

Manually reset the user's password in the admin center.

Answer

Create a Conditional Access policy that blocks the user's IP.

Question 13

You need to provide temporary access to an external contractor. What is the most secure way to manage this using Microsoft Entra ID?

Accepted Answer

Use Microsoft Entra B2B collaboration and configure an access review.. Microsoft Entra B2B collaboration with access reviews is the recommended approach for managing external identities. It allows you to invite guests while maintaining governance through automated reviews, ensuring that external access is revoked once the contractor's engagement ends. This minimizes the risk of 'guest creep', where contractors retain access long after they have completed their projects, which is a major security risk in modern, highly connected organizational environments.

Answer

Create a local user account in the tenant.

Answer

Create a shared mailbox for the contractor.

Answer

Share your own administrative credentials with the contractor.

Question 14

Which MFA method is considered the most secure because it provides a hardware-bound cryptographic proof?

Accepted Answer

FIDO2 Security Key. FIDO2 security keys offer the highest level of security for MFA. Because the private key never leaves the hardware device, it is impossible to phish, intercept, or replicate via software. This provides a level of assurance that cannot be matched by software-based MFA, such as TOTP or push notifications, making it the ideal choice for highly sensitive accounts or environments where the threat of sophisticated phishing is high.

Answer

Authenticator App (TOTP)

Answer

Windows Hello for Business

Answer

OATH hardware tokens

Question 15

What is the primary benefit of enabling 'Security Defaults' in a new Microsoft Entra tenant?

Accepted Answer

It enforces mandatory MFA for all users and blocks legacy authentication.. Security Defaults offer an automated, baseline security posture by enforcing MFA for all users, blocking legacy authentication protocols, and protecting administrative portals. This is invaluable for organizations that may not have the capacity to manage complex Conditional Access policies immediately. It ensures that basic, essential protections are applied instantly, closing the most common security gaps that lead to successful account compromise in newly provisioned cloud environments.

Answer

It allows granular exclusion of specific users from MFA requirements.

Answer

It provides advanced threat protection for cloud-based virtual machines.

Answer

It automatically upgrades the tenant to a Premium P2 license.

Question 16

Your organization wants to prevent users from using legacy authentication protocols, such as POP3 and IMAP4, to access Microsoft 365 services. You need to implement a solution that blocks these protocols while allowing modern authentication. What is the most effective way to achieve this using Conditional Access?

Accepted Answer

Create a Conditional Access policy, select All Cloud Apps, and under Client Apps, select only Legacy Authentication clients with a Block grant.. Enforcing modern authentication through Conditional Access is critical because legacy protocols lack the capability to handle multi-factor authentication challenges. By explicitly blocking these protocols, organizations mitigate risk against automated attacks. This configuration aligns with Zero Trust principles by verifying every access attempt using modern standards. It ensures that the environment remains secure against credential harvesting and unauthorized access through older, less secure interfaces.

Answer

Disable the POP3 and IMAP4 services at the tenant level within the Microsoft 365 Admin Center for every individual user mailbox.

Answer

Enable Security Defaults in the Microsoft Entra admin center to automatically manage all authentication and security settings for the tenant.

Answer

Update the default Authentication Policy in Exchange Online to set the AllowBasicAuth setting to false for all available mail protocols.

Question 17

An organization is implementing Entra ID Protection to enhance their security posture. You need to configure policies that automatically respond to detected identity risks. Which TWO policies should you implement to meet this requirement?

Accepted Answer

User risk policy. Identity Protection allows organizations to automate the detection and remediation of identity-based risks. User risk policies focus on the long-term behavior of an account, while sign-in risk policies evaluate the probability that a specific authentication request is unauthorized. Implementing both ensures that compromised accounts are forced to change passwords and suspicious logins are challenged with MFA, providing layered security for the tenant.

Answer

MFA registration policy

Answer

App protection policy

Answer

Device compliance policy

Question 18

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Entra Conditional Access policy. Based on this configuration, what is the effect of the policy?

Accepted Answer

Access is blocked for all users except those located within the US_Named_Location.. Understanding the logic of 'Include' and 'Exclude' in Conditional Access is vital for preventing accidental lockouts and ensuring correct policy application. This policy uses a 'Block' control, which is the most restrictive action available. By including 'All' and excluding a specific location, the policy creates a geofence that prevents any access attempt originating from outside the defined trusted geographic boundary.

Answer

Access is granted only to users within the US_Named_Location if they pass MFA.

Answer

Access is blocked for all users regardless of their current geographic location.

Answer

Access is granted to all users as long as they are not in the US_Named_Location.

Question 19

You are configuring Self-Service Password Reset (SSPR) for your organization. You need to ensure that users are prompted to verify their contact information periodically to maintain the accuracy of recovery data. Which setting should you configure?

Accepted Answer

Number of days before users are asked to re-confirm their authentication information.. Data accuracy in SSPR is essential for the reliability of the password recovery process. If recovery information like phone numbers or email addresses becomes outdated, users will be unable to reset their passwords, leading to increased help desk calls. Microsoft Entra ID provides a built-in mechanism to periodically force users to confirm their registered security info, ensuring the system remains functional.

Answer

The registration policy in Microsoft Entra ID Protection for MFA enrollment.

Answer

The password expiration policy within the Microsoft 365 Admin Center settings.

Answer

The 'Notify users on password resets' toggle in the SSPR notification settings.

Question 20

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication is a cornerstone of modern identity security, as it prevents attackers from using stolen credentials or intercepting MFA codes. These methods rely on cryptographic keys bound to the hardware or the device, making it impossible for a user to accidentally provide their credentials to a malicious site. Implementing these methods significantly reduces the risk of account takeovers for high-profile users.

Answer

Microsoft Authenticator push notifications

Answer

SMS-based authentication codes

SC-300 Implement Authentication and Access Management — All Questions With Answers

Your organization uses Microsoft Entra ID. You need to ensure that guest users can only access specific applications and cannot browse the directory for other users. What should you configure?

You are configuring Password Protection in Microsoft Entra ID. Which TWO actions must you take to ensure the custom banned password list is enforced effectively?

Refer to the exhibit. You are reviewing a custom permission policy intended to allow an application to manage user profile photos. Why is this policy considered a security risk?

Exhibit

You need to implement Authentication Strengths in Conditional Access to ensure that users access highly sensitive applications using only phishing-resistant MFA. Which method should you select?

A user reports being unable to sign in to a SaaS application. You check the Microsoft Entra sign-in logs and see a 'Conditional Access policy failure' status. What is the first step you should take to troubleshoot?

You are implementing Privileged Identity Management (PIM). Which TWO outcomes are achieved when you assign a user to an 'Eligible' role rather than a 'Permanent' role?

Your company requires all users to access Microsoft 365 from company-managed devices. How should you configure Conditional Access to enforce this?

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

You are auditing sign-in logs and see many 'Interrupted' sign-ins. What does this typically indicate?

You need to ensure that your tenant is protected against common credential-based attacks. Which THREE features should you enable or configure?

Refer to the exhibit. What is the most likely cause of this sign-in failure for the web application?

Exhibit

You are managing access to a sensitive application. You want to ensure that if a user's risk level changes to 'High', they are immediately prompted for a password change. How do you implement this?

You need to provide temporary access to an external contractor. What is the most secure way to manage this using Microsoft Entra ID?

Which MFA method is considered the most secure because it provides a hardware-bound cryptographic proof?

What is the primary benefit of enabling 'Security Defaults' in a new Microsoft Entra tenant?

An organization is implementing Entra ID Protection to enhance their security posture. You need to configure policies that automatically respond to detected identity risks. Which TWO policies should you implement to meet this requirement?

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Entra Conditional Access policy. Based on this configuration, what is the effect of the policy?

Exhibit

You are configuring Self-Service Password Reset (SSPR) for your organization. You need to ensure that users are prompted to verify their contact information periodically to maintain the accuracy of recovery data. Which setting should you configure?

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

A user is unable to sign in because they have lost their primary MFA device and do not have a backup method registered. You need to provide them with a short-term, high-assurance method to bypass MFA and register a new device. What should you generate for the user?

You are implementing Microsoft Entra Password Protection for your on-premises Active Directory domain. You want to ensure that users cannot use passwords that contain the name of your company or the local sports team. Which feature should you configure?

Refer to the exhibit. This Conditional Access policy uses a specific Authentication Strength. If the ID shown corresponds to the 'Phishing-resistant MFA' built-in strength, which authentication method will NOT satisfy the policy?

Exhibit

You are configuring Conditional Access session controls to manage how users interact with Microsoft 365 services. Which TWO actions can you perform using session controls?

You need to ensure that all global administrators in your tenant are using the most secure authentication methods available. Which TWO methods are recommended by Microsoft as the most secure for administrative accounts?

You are managing the authentication methods for a tenant. You want to ensure that users are only able to register for MFA using methods that are approved by the IT department. Which TWO steps are necessary to restrict user registration of MFA methods?

An administrator wants to ensure that users are not prompted for MFA when they are working from the corporate headquarters. What should be configured in Microsoft Entra ID to define the corporate network's public IP ranges as a trusted location?

Your organization requires that all guest users accessing a specific SharePoint site must re-authenticate every 24 hours. Which feature should you configure to enforce this requirement?

You are configuring Entra ID PIM for a group of administrators. You need to ensure that when they activate a privileged role, they provide a justification and perform MFA. Which TWO settings should you configure?

Refer to the exhibit. A user with a 'High' risk level attempts to sign in. Based on the provided policy JSON, what is the expected outcome?

Exhibit

You need to prevent users from registering their devices for Azure AD Join if they are connecting from non-compliant locations. Which tool should you use?

Your company uses B2B collaboration. You need to ensure that guest users can only access applications if they use their home directory credentials. Which feature should you implement?

Which THREE conditions can you use in a Conditional Access policy to restrict access to sensitive applications?

You need to reduce the attack surface by ensuring that only compliant devices can access Microsoft 365. What should you configure?

Refer to the exhibit. A user reports they cannot access an app. The error code 50072 appears. What is the most likely cause?

Exhibit

You need to ensure that administrative accounts are protected by requiring hardware-based MFA. Which feature supports this?

What is the recommended approach for managing emergency access accounts to ensure they are not locked out?

Which entity should you use to apply a Conditional Access policy to all cloud apps except for a specific legacy application?

You are auditing sign-in logs to identify failed authentication attempts. Which TWO fields provide the most relevant information for troubleshooting conditional access failures?

You have a hybrid environment. You need to ensure that only devices that are Hybrid Azure AD joined can access sensitive data. What should you configure?

Refer to the exhibit. What is the impact of this command on the user experience?

Exhibit

You want to ensure that access to a specific application is only permitted from managed devices. Which condition should you configure in the Conditional Access policy?

Refer to the exhibit. An administrator has configured a Conditional Access policy using the Microsoft Graph API. Based on the JSON configuration provided, which statement accurately describes the access requirements for users?

Exhibit

You are configuring Self-Service Password Reset (SSPR) for your organization. You need to ensure that users can reset their passwords using the most secure methods available while meeting the minimum requirements for a two-gate reset. Which TWO authentication methods should you enable?

A company wants to implement a passwordless strategy for its administrative accounts. The administrators work from shared workstations that do not have built-in biometric hardware. Which authentication method should you recommend to provide the highest level of security?

You are designing an Entitlement Management solution to automate access for external partners. You need to create an access package that includes access to a SharePoint Online site and a specific Microsoft Team. Which THREE components are essential to include in the access package configuration?

Your organization uses Microsoft Entra ID Protection. You observe that several users are being blocked because their 'User Risk' level is High. You need to allow these users to self-remediate their risk and regain access without administrative intervention. What should you do?

You are implementing Continuous Access Evaluation (CAE) in your tenant. A user's account is disabled by an administrator. How does CAE affect the user's active session with Exchange Online?

You need to implement Authentication Strengths in Microsoft Entra ID to enforce phishing-resistant MFA for your IT administrators. Which TWO authentication methods are considered phishing-resistant by the built-in 'Phishing-resistant MFA' strength?

An administrator wants to prevent brute-force attacks on user passwords by locking out accounts after several failed attempts. They want to ensure that legitimate users are not locked out by attackers from different geographical locations. Which feature should they configure?

Refer to the exhibit. An administrator is running a Microsoft Graph PowerShell command. What is the primary purpose of this specific command within the context of authentication management?

Exhibit

You are implementing Privileged Identity Management (PIM) for Entra ID roles. You need to configure the 'Global Administrator' role to ensure that when a user activates the role, it is done securely and with oversight. Which TWO settings should you configure in the role's activation policy?

Your company frequently collaborates with a partner organization. You want to allow the partner's users to access your resources using their own corporate credentials, but you want to enforce your own MFA requirements when they access sensitive data. Which feature should you use?

An organization is moving toward a highly secure environment and wants to implement Certificate-Based Authentication (CBA) as a primary authentication method. What is a required step to enable CBA in Microsoft Entra ID?

SC-300 Implement Authentication and Access Management — All Questions With Answers

Your organization uses Microsoft Entra ID. You need to ensure that guest users can only access specific applications and cannot browse the directory for other users. What should you configure?

You are configuring Password Protection in Microsoft Entra ID. Which TWO actions must you take to ensure the custom banned password list is enforced effectively?

Refer to the exhibit. You are reviewing a custom permission policy intended to allow an application to manage user profile photos. Why is this policy considered a security risk?

Exhibit

You need to implement Authentication Strengths in Conditional Access to ensure that users access highly sensitive applications using only phishing-resistant MFA. Which method should you select?

A user reports being unable to sign in to a SaaS application. You check the Microsoft Entra sign-in logs and see a 'Conditional Access policy failure' status. What is the first step you should take to troubleshoot?

You are implementing Privileged Identity Management (PIM). Which TWO outcomes are achieved when you assign a user to an 'Eligible' role rather than a 'Permanent' role?

Your company requires all users to access Microsoft 365 from company-managed devices. How should you configure Conditional Access to enforce this?

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

You are auditing sign-in logs and see many 'Interrupted' sign-ins. What does this typically indicate?

You need to ensure that your tenant is protected against common credential-based attacks. Which THREE features should you enable or configure?

Refer to the exhibit. What is the most likely cause of this sign-in failure for the web application?

Exhibit

You are managing access to a sensitive application. You want to ensure that if a user's risk level changes to 'High', they are immediately prompted for a password change. How do you implement this?

You need to provide temporary access to an external contractor. What is the most secure way to manage this using Microsoft Entra ID?

Which MFA method is considered the most secure because it provides a hardware-bound cryptographic proof?