SC-300 Implement and Manage User Identities Practice Test 2 — 15 Questions

Question 1

Your company wants to use B2B Direct Connect to collaborate with a partner organization in a Microsoft Teams shared channel. Which of the following is a strict requirement for B2B Direct Connect to function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Both organizations must configure mutual trust in their Cross-tenant access settings.. B2B Direct Connect is a specialized form of collaboration that removes the need for guest accounts. It is built on mutual trust between two Microsoft Entra tenants. Understanding the specific configuration requirements, such as the need for both organizations to configure cross-tenant access settings, is vital for enabling seamless, high-performance collaboration in Teams.

Answer

The external users must be invited as guests to the host tenant first.

Answer

All users in the partner organization must have a Microsoft Entra ID P2 license.

Answer

The partner organization must use a third-party identity provider like Okta or Google.

Question 2

Your organization has a hybrid environment with Microsoft Entra Connect syncing on-premises Active Directory users to the cloud. You need to update the 'Department' attribute for a synchronized user. When you attempt to change this in the Microsoft Entra admin center, the field is grayed out. What is the most appropriate action to resolve this?

Accepted Answer

Modify the attribute in the on-premises Active Directory and wait for the next synchronization cycle.. Managing user identities in a hybrid environment requires understanding where the source of authority resides for specific objects. When accounts are synchronized from on-premises Active Directory to Microsoft Entra ID, most attributes cannot be modified directly in the cloud portal. This ensures data consistency across the hybrid identity infrastructure and prevents synchronization conflicts that could disrupt user access.

Answer

Assign the User Administrator role to your account to override the synchronization lock.

Answer

Disable the Microsoft Entra Connect sync temporarily to allow direct edits in the cloud portal.

Answer

Use the Microsoft Graph PowerShell module to force the attribute update in the cloud.

Question 3

You are configuring a dynamic group in Microsoft Entra ID to automatically include users from the 'Sales' and 'Marketing' departments who are also based in 'London'. Which membership rule syntax should you use to ensure the group updates correctly?

Accepted Answer

(user.department -eq "Sales" -or user.department -eq "Marketing") -and (user.city -eq "London"). Option B is correct because it uses the logical 'OR' operator to group the departments, ensuring a user in either Sales or Marketing is included, and the 'AND' operator to ensure they must also be in London. Option A is incorrect because a user cannot be in two departments simultaneously. Option C is syntactically invalid. Option D uses an unsupported syntax for the -in operator.

Answer

(user.department -eq "Sales" -and user.department -eq "Marketing") -and (user.city -eq "London")

Answer

user.department -contains "Sales" -or "Marketing" -and user.city -match "London"

Answer

user.department -in ["Sales", "Marketing"] -or user.city -eq "London"

Question 4

You need to perform a bulk upload of 500 new employees into Microsoft Entra ID using a CSV file. Which TWO columns are mandatory in the CSV file for the 'Bulk create users' operation to succeed?

Accepted Answer

User name [userName]. When performing a bulk create operation in Microsoft Entra ID, the CSV template requires the 'User name' (User principal name) to identify the account and the 'Initial password' to satisfy the security requirement for account creation. Other fields like Job title, Usage location, and Department are optional attributes.

Answer

Job title [jobTitle]

Answer

Usage location [usageLocation]

Answer

Department [department]

Question 5

A user is a member of two groups: 'Group A' has a Microsoft 365 E3 license assigned, and 'Group B' has a Microsoft 365 E5 license assigned. The user is currently only showing features for E3. What is the most likely reason for this behavior?

Accepted Answer

There is a license assignment error on the user object due to conflicting service plans.. Microsoft Entra ID group-based licensing allows for efficient management of service plans, but conflicts can arise when multiple licenses are assigned to the same user. Understanding how license stacking and service plan conflicts work is essential for troubleshooting access issues and ensuring that users have the correct tools for their job roles.

Answer

License assignments in Entra ID always prioritize the license that was assigned first chronologically.

Answer

The user has not yet signed out and signed back in to refresh their license token.

Answer

The E5 license requires a manual 'Usage Location' update that the E3 license does not.

Question 6

You need to enable Self-Service Password Reset (SSPR) for a pilot group of 50 users. You want to ensure they can reset their passwords from the Windows login screen. What is a prerequisite for this specific functionality?

Accepted Answer

The users' devices must be Microsoft Entra joined or Microsoft Entra hybrid joined.. SSPR is a powerful feature that reduces helpdesk costs by allowing users to manage their own credentials. However, extending this capability to the Windows login screen requires specific device-side configurations and network connectivity. Understanding these prerequisites is key to providing a seamless and secure user experience for password management.

Answer

Users must have at least three different authentication methods registered in their profile.

Answer

The 'Writeback passwords to on-premises AD' option must be disabled for the pilot group.

Answer

The pilot group users must be assigned the 'Password Administrator' role in Entra ID.

Question 7

An administrator accidentally deleted a cloud-only user account. You need to restore the user and their associated data. Within what maximum timeframe must you perform the restoration before the account is permanently deleted?

Accepted Answer

30 days. Microsoft Entra ID uses a 'soft-delete' state for deleted users, providing a safety net for accidental deletions. During this period, the user object and most of its associated data remain recoverable. Knowing this duration is critical for disaster recovery planning and ensuring that user productivity is restored quickly after an incident.

Answer

7 days

Answer

14 days

Answer

90 days

Question 8

A user wants to use their personal Windows 11 laptop to access corporate applications. They want the device to be managed by the company's Intune policies without fully joining the corporate domain. Which device identity state is most appropriate for this scenario?

Accepted Answer

Microsoft Entra registered. Microsoft Entra ID supports different levels of device registration and joining. For personal devices (BYOD), 'Microsoft Entra registered' is the standard approach, providing a balance between user privacy and corporate security. Understanding the difference between 'Registered', 'Joined', and 'Hybrid Joined' is fundamental to managing modern workplace identities.

Answer

Microsoft Entra joined

Answer

Microsoft Entra hybrid joined

Answer

Microsoft Entra invited

Question 9

You need to implement Custom Security Attributes in Microsoft Entra ID to store sensitive employee data that should not be visible to standard administrators. Which TWO requirements must be met to manage these attributes?

Accepted Answer

You must be assigned the Attribute Definition Administrator role.. Custom Security Attributes provide a way to store specialized metadata with enhanced access controls. Unlike standard directory attributes, they are not visible by default to Global Administrators. Implementing them correctly requires specific role assignments and an understanding of how attribute sets function to isolate sensitive information from unauthorized viewing.

Answer

The tenant must have at least a Microsoft Entra ID Free edition.

Answer

The attributes must be stored in the 'Default' attribute set.

Answer

Global Administrators can view all custom attributes by default.

Question 10

You want to delegate the ability for a local office manager to reset passwords for only the users in their specific branch. What is the most efficient way to implement this without granting the manager permissions over the entire tenant?

Accepted Answer

Create an Administrative Unit (AU), add the branch users to it, and assign the manager the Password Administrator role scoped to that AU.. Delegated administration is a core concept in Microsoft Entra ID that allows for regional or departmental management. By using Administrative Units, you can scope administrative permissions to a subset of users, ensuring the principle of least privilege is maintained while still empowering local staff to handle routine tasks like password resets.

Answer

Assign the manager the Helpdesk Administrator role at the tenant level.

Answer

Add the manager to a security group that has 'Full Control' over the branch users' OU in Active Directory.

Answer

Use a Dynamic Group to identify the branch users and grant the manager 'Owner' rights to the group.

Question 11

An organization wants to collaborate with an external partner. You need to allow the partner's employees to use their own Entra ID credentials to sign in to your applications, but you want to block all other external domains. Where should you configure this?

Accepted Answer

The 'External Identities' section under 'Cross-tenant access settings'.. While 'Cross-tenant access settings' is the correct location, the configuration requires setting the 'Default' inbound access settings to 'Block access' for all users/groups and applications, and then creating an 'Organizational setting' for the specific partner tenant to 'Allow access'. The current explanation does not mention the necessity of the default block policy.

Answer

The 'User Settings' blade in the Microsoft Entra admin center.

Answer

A Conditional Access policy targeting 'All Guest Users'.

Answer

The 'Identity Governance' dashboard under 'Entitlement Management'.

Question 12

Your company uses Microsoft Entra ID. You need to configure bulk user creation for 500 new employees. Which tool or method should you use to accomplish this task efficiently?

Accepted Answer

Upload a completed comma-separated values (CSV) bulk user creation template in the Microsoft Entra admin center.. Bulk user creation in Microsoft Entra ID requires utilizing a comma-separated values template file uploaded through the administrative portal. This method prevents manual entry errors and allows administrators to provision hundreds of identities with correct attributes simultaneously, ensuring operational efficiency and consistency across enterprise identity management structures.

Answer

Run the New-AzureADUser cmdlet within a custom PowerShell script containing a foreach loop.

Answer

Configure an inbound user provisioning job from an external LDAP directory using Microsoft Entra Connect Sync.

Answer

Send individual Graph API HTTP POST requests for each employee using Graph Explorer interactively.

Question 13

You manage a Microsoft Entra tenant. A user named User1 reports that their cloud account is compromised. You need to instantly revoke all refresh tokens and sessions for User1 without deleting the account. What should you do?

Accepted Answer

Run the Revoke-AzureADUserAllRefreshToken PowerShell cmdlet targeting the User1 object ID.. Revoking sessions forces all issued refresh tokens to become invalid immediately, requiring the affected user to reauthenticate across all devices and applications. This crucial administrative response mitigates active breaches and prevents unauthorized access while investigating compromised credentials without disrupting overall account provisioning status.

Answer

Disable the user account temporarily by setting AccountEnabled to false in Microsoft Entra ID.

Answer

Modify the user password to a temporary value and require password reset upon next sign-in.

Answer

Delete the user object from the directory and restore it from the deleted items container.

Question 14

You are planning the administrative role structure for your Microsoft Entra tenant. You need to assign an administrator who can manage all aspects of user and group properties, but must not have access to billing or security policies. Which role should you assign?

Accepted Answer

User Administrator. The User Administrator role grants permissions to manage all user and group properties, including password resets and account settings, without granting elevated privileges over sensitive security or financial functions. This follows the principle of least privilege, ensuring operational separation of duties within enterprise administration.

Answer

Global Administrator

Answer

Privileged Authentication Administrator

Answer

Helpdesk Administrator

Question 15

Your enterprise environment requires self-service password reset (SSPR) for all cloud users. You need to ensure that users can authenticate during SSPR using a mobile phone notification or verification code. Which authentication method must you enable in the Microsoft Entra authentication methods policy?

Accepted Answer

Mobile phone. Enabling the mobile phone authentication method allows Microsoft Entra ID to send SMS verification codes or place voice calls during self-service password reset workflows. This method provides a convenient out-of-band verification channel that enhances security posture while reducing helpdesk ticket volume for password resets.

Answer

Temporary Access Pass

Answer

FIDO2 security key

Answer

Windows Hello for Business