SC-300 Implement and Manage User Identities Practice Test 3 — 15 Questions

Question 1

An organization uses Microsoft Entra ID and needs to create external user accounts for contractors. The contractors should be invited by a select group of non-administrator employees without granting them full User Administrator privileges. Which administrative role should you assign to these employees?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Guest Inviter. Assigning the Guest Inviter role allows designated non-administrator employees to securely invite external B2B collaboration users without escalating their privileges to full User Administrator. This implements the principle of least privilege while enabling decentralized partner onboarding, reducing administrative overhead for core IT teams in enterprise environments.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Directory Readers

Question 2

Your company, Fabrikam, Inc., has acquired another firm. You need to invite 500 external contractors to your Microsoft Entra ID tenant to access specific applications. You want to ensure that these users are categorized as guests and cannot browse the full directory. Which feature should you configure first to enforce these restrictions tenant-wide?

Accepted Answer

Guest user access restrictions. External collaboration settings within Microsoft Entra ID allow administrators to define the level of access guest users have to the directory. By default, guests have limited permissions, but these can be further restricted to prevent them from seeing any directory information outside of their own profile. This ensures data privacy and limits the potential for internal discovery by external entities.

Answer

Administrative Units

Answer

Conditional Access policies

Answer

Entitlement Management

Question 3

You have a large Microsoft Entra ID tenant with 10,000 users. You need to delegate the ability to reset passwords for users in the 'Seattle' office to a local IT lead, without granting them administrative rights over users in other offices. What should you create?

Accepted Answer

An Administrative Unit containing the Seattle users. Administrative Units (AUs) provide a way to define a boundary within a Microsoft Entra ID tenant for the purpose of delegating administrative permissions. This is essential for large organizations that need to distribute IT tasks to local administrators while maintaining the principle of least privilege across the entire global directory.

Answer

A new Custom Role with a scope of the entire directory

Answer

A Dynamic Security Group containing the Seattle users

Answer

A Conditional Access policy targeting the Seattle location

Question 4

You need to store specialized metadata for users in Microsoft Entra ID that is not available in the standard user profile attributes. This metadata must be accessible via the Microsoft Graph API and must support fine-grained access control so only specific administrators can read or write the data. Which THREE steps are required to implement Custom Security Attributes?

Accepted Answer

Assign the Attribute Definition Administrator role. Custom security attributes offer a way to extend the user schema with highly secure, controlled data. Unlike extension attributes, these support RBAC for the attributes themselves. This allows sensitive data, like employee IDs or clearance levels, to be stored on the user object while strictly limiting who can interact with that specific metadata.

Answer

Configure a new Schema Extension using the Azure AD Graph API

Answer

Create a new Directory Extension in Microsoft Entra Connect

Question 5

A company wants to implement advanced identity management features for their users. You are evaluating the differences between Microsoft Entra ID P1 and P2 licenses. Which TWO features are ONLY available with the Microsoft Entra ID P2 license?

Accepted Answer

Microsoft Entra ID Protection (Risk-based Conditional Access). Microsoft Entra ID P2 includes all P1 features plus advanced identity protection and governance capabilities. Understanding these differences is crucial for administrators to ensure they have the necessary licensing for high-security environments, specifically regarding automated risk detection and administrative access control through Privileged Identity Management.

Answer

Self-Service Password Reset (SSPR) for cloud users

Answer

Conditional Access based on user location and device state

Answer

Application Proxy for accessing on-premises web applications

Question 6

You accidentally delete a cloud-only user account from the Microsoft Entra admin center. You need to restore the user and their associated group memberships. Within how many days must you perform the restoration before the user is permanently deleted?

Accepted Answer

30 days. Microsoft Entra ID implements a 'soft-delete' state for user accounts to protect against accidental data loss. During this period, the user object and most of its properties, including group memberships, can be fully recovered. Once this window expires, the data is purged from the system and cannot be retrieved.

Answer

14 days

Answer

60 days

Answer

90 days

Question 7

You are creating a dynamic user group in Microsoft Entra ID to automatically include all users from the Marketing department who are located in either London or Paris. Which syntax should you use for the membership rule?

Accepted Answer

(user.department -eq "Marketing") -and (user.city -in ["London", "Paris"]). Dynamic groups use a rule-based system to manage membership automatically, which is essential for scaling identity management in large organizations. Mastering the syntax for these rules allows administrators to ensure that users receive the correct access to resources and applications based on their current attributes without manual intervention by the IT staff.

Answer

(user.department -match "Marketing") -or (user.city -eq "London") -or (user.city -eq "Paris")

Answer

user.department -eq "Marketing" -and user.city -eq "London" -and user.city -eq "Paris"

Answer

user.department -contains "Marketing" -and user.city -contains "London, Paris"

Question 8

You need to configure B2B collaboration settings in Microsoft Entra ID to restrict external access. The solution must meet the following requirements:
1. Allow users to invite guests only from the domain 'fabrikam.com'.
2. Prevent guests from searching the directory for other users.
Which TWO settings should you configure?

Accepted Answer

Set External user read permissions to 'Guest users are limited to properties and memberships of their own directory objects'.. B2B collaboration settings provide granular control over how external users interact with your directory. Restricting invitations to specific domains is a common security requirement for sensitive environments. Similarly, limiting directory search capabilities for guests prevents data harvesting and ensures that external users can only interact with the specific people or resources they have been assigned.

Answer

Configure a Cross-tenant access policy for 'fabrikam.com' with B2B direct connect enabled.

Answer

Enable the 'Member users and users assigned to specific admin roles can invite guest users' setting.

Answer

Create a Conditional Access policy that blocks all external users except those from 'fabrikam.com'.

Question 9

Refer to the exhibit. You are reviewing a custom role definition intended for a security auditor. What is the specific effect of the permission defined in the 'operations' array?

Accepted Answer

The role can read the actual values of custom security attributes assigned to users and other directory objects.. Custom security attributes in Microsoft Entra ID allow for the storage of sensitive metadata that is not visible to standard users or even Global Administrators by default. Understanding the specific RBAC actions required to read or write these attributes is essential for maintaining a secure environment where sensitive data like 'Salary Grade' or 'Clearance Level' is protected.

Answer

The role can view the definitions and allowed values of all custom security attributes in the tenant.

Answer

The role can assign new custom security attribute values to users but cannot modify existing ones.

Answer

The role can only read custom security attributes if they are also a member of the Attribute Definition Administrator role.

Question 10

You need to perform a bulk invite of 50 guest users from a partner company using a CSV file in the Microsoft Entra admin center. Which column is mandatory in the CSV file for the bulk invitation process to succeed?

Accepted Answer

Email address to invite. Bulk operations are a key skill for identity administrators to handle large-scale changes efficiently. For B2B invitations, Entra ID requires specific identifiers to send the invitation emails and create the guest user objects. Knowing the required schema for these CSV files prevents upload errors and ensures a smooth onboarding experience for external partners.

Answer

First name

Answer

Redirect URL

Answer

User principal name

Question 11

Your company uses Microsoft Entra Connect to sync identities from an on-premises Active Directory. You have a user named 'User1' who exists in both environments, but they are not currently linked. You need to perform a 'soft-match' to link them. Which attribute must be identical on both the on-premises and cloud objects?

Accepted Answer

proxyAddresses. Soft-matching is a critical process for merging existing cloud identities with on-premises accounts during the initial setup of directory synchronization. It prevents the creation of duplicate accounts and ensures that users maintain their existing cloud data and permissions while transitioning to a synchronized identity model managed from the local Active Directory environment.

Answer

ObjectGUID

Answer

DisplayName

Answer

EmployeeID

Question 12

You want to allow external users to sign in to your Microsoft Entra tenant using their Google accounts. Which TWO steps are required to configure Google federation?

Accepted Answer

Create a Google Cloud Platform project and obtain a Client ID and Client Secret.. Federating with social identity providers like Google improves the onboarding experience for B2B guests by allowing them to use familiar credentials. This reduces the need for them to manage a separate password for your tenant and leverages the security features of their existing identity provider, such as Google's own multi-factor authentication.

Answer

Enable the 'Email one-time passcode for guests' setting in the Entra admin center.

Answer

Assign a Microsoft Entra ID P2 license to every Google user who will sign in.

Answer

Configure a custom domain in Entra ID that matches the @gmail.com suffix.

Question 13

You need to delegate the ability to reset passwords for users in the 'Sales' department to a local helpdesk lead. You want to ensure the helpdesk lead cannot manage users in any other department. What should you create?

Accepted Answer

An Administrative Unit (AU) and add the Sales users to it.. Administrative Units (AUs) provide a way to define a boundary for administrative delegation within a Microsoft Entra tenant. This is vital for large organizations that need to distribute management tasks to regional or departmental IT staff without granting them broad permissions across the entire directory, adhering to the principle of least privilege.

Answer

A dynamic security group containing all Sales users.

Answer

A Custom Role with the 'microsoft.directory/users/password/update' permission.

Answer

An Access Package in Entra ID Governance.

Question 14

You are managing a hybrid environment with Microsoft Entra Connect. You need to ensure that when a user's account is disabled in the on-premises Active Directory, the corresponding cloud account is also disabled immediately. What is the default behavior of Entra Connect regarding account status?

Accepted Answer

The cloud account is disabled during the next delta synchronization cycle.. Synchronizing account status is a critical security control. If an employee leaves the company, their access must be revoked across all systems. Microsoft Entra Connect handles this by mapping the 'userAccountControl' attribute from on-premises to the 'accountEnabled' property in the cloud, ensuring that the cloud identity reflects the local administrative state.

Answer

The cloud account remains enabled until the administrator manually runs a full synchronization.

Answer

The cloud account is immediately disabled via a real-time webhook call to Entra ID.

Answer

The cloud account is deleted rather than disabled to save on license costs.

Question 15

You are configuring External Collaboration settings in Microsoft Entra ID. You want to ensure that only specific partner domains can be invited as guests, and that guest users have the most restricted access to the directory. Which THREE settings should you configure?

Accepted Answer

Set 'Guest user access is restricted to properties and memberships of their own directory objects'.. Securing external identities involves a multi-layered approach that controls both who can be invited and what those individuals can see once they are in the tenant. These settings are found in the External Collaboration settings and are vital for preventing data leakage and ensuring that guest access aligns with organizational security policies.

Answer

Disable the 'External user' account type in the User Settings blade.

Answer

Enable 'Self-service sign-up via user flows' for all external users.