SC-300 Plan and Automate Identity Governance — 25 Questions

Question 1

Your organization works with a external vendor, Fabrikam, which requires access to specific SharePoint sites and Teams for a six-month project. You need to ensure that Fabrikam employees can request access themselves, but their access must be automatically revoked when the project ends or if they no longer require it. Which Entitlement Management feature should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access packages with a linked connected organization.. Access packages in Entitlement Management allow you to bundle resources like SharePoint sites and Teams into a single unit for assignment. By defining a lifecycle with an expiration date and requiring periodic access reviews, you ensure that external users only maintain access as long as necessary. This automation reduces the risk of orphaned accounts and simplifies the offboarding process for temporary project staff.

Answer

Privileged Identity Management (PIM) for Azure Resources.

Answer

Manual Guest User invitation via the Microsoft Entra admin center.

Answer

Conditional Access policies with Session Control.

Question 2

You are configuring Privileged Identity Management (PIM) for Microsoft Entra roles. You want to ensure that whenever a user activates the Global Administrator role, specific security requirements are met to maintain a high security posture. Which TWO of the following settings can be enforced during the activation process?

Accepted Answer

Require Multi-Factor Authentication (MFA) on activation.. PIM role settings allow administrators to enforce strict requirements before a user can assume a highly privileged role. This ensures that the activation is legitimate, documented, and secured by additional factors. These controls are essential for meeting compliance standards and protecting the environment from unauthorized administrative access by requiring justification and strong authentication.

Answer

Require Azure Backup for all associated resources.

Answer

Require a Windows 11 Enterprise license.

Answer

Require the user to be in a specific physical location.

Question 3

Refer to the exhibit. You are reviewing a Microsoft Entra Lifecycle Workflow. Based on the JSON configuration provided, when will the tasks in this workflow be executed for a new user?

Accepted Answer

On the exact date specified in the employeeHireDate attribute.. Lifecycle Workflows use triggers based on user attributes to automate tasks. In this JSON, the trigger is tied to the 'employeeHireDate' attribute with the operator 'equalTo'. This means the workflow will run precisely on the date specified in the user's hire date field, ensuring that onboarding tasks like group membership and communications occur exactly when the employee starts.

Answer

Seven days before the user's hire date.

Answer

Immediately when the user account is created in Entra ID.

Answer

Every time the user's department is updated to 'Marketing'.

Question 4

You are setting up an Access Review for a security group that contains both internal employees and guest users. You want to ensure that if a reviewer does not respond within the 14-day window, the guest users' access is automatically removed, but internal users keep their access until a manual decision is made. How should you configure the 'Upon non-response' settings?

Accepted Answer

Create two separate access reviews: one for internal users and one for guests.. Access reviews allow for granular control over what happens when reviewers are inactive. While you can set a global action for non-responders, the most effective way to handle mixed populations with different risk profiles is to use the 'Take recommendations' or 'Remove access' features specifically for guests, or to run separate reviews. Microsoft Entra allows you to target reviews specifically to guests.

Answer

Set 'Upon non-response' to 'Remove access' for the entire review.

Answer

Enable 'Decision helpers' and set 'Take recommendations'.

Answer

Set 'Upon non-response' to 'Approve access' and use a Logic App.

Question 5

You are designing a governance strategy for Entitlement Management. You need to create a new catalog to delegate the management of marketing-related resources. Which THREE of the following resource types can be added to a Microsoft Entra Entitlement Management catalog?

Accepted Answer

Microsoft 365 Groups.. Catalogs serve as containers for resources and access packages. To delegate effectively, you must understand which objects can be governed. Entitlement Management supports the most common identity-based resources in Microsoft 365 and Azure, allowing catalog owners to manage access to groups, applications, and collaborative sites within their specific business domain.

Answer

Azure Key Vault secrets.

Answer

Individual user mailboxes.

Question 6

Your company requires all users to acknowledge a new Remote Work Policy before they can access any cloud applications. You need to ensure that users are prompted to read and accept the policy every 90 days. Which tool should you use to meet this requirement?

Accepted Answer

Microsoft Entra Terms of Use.. Terms of Use (ToU) in Microsoft Entra ID provides a way for organizations to present information to end-users and ensure they consent to policies. By integrating ToU with Conditional Access, you can enforce that consent is a prerequisite for access. The recurring consent feature ensures that users re-acknowledge the policy at set intervals.

Answer

Privileged Identity Management (PIM).

Answer

Azure Information Protection (AIP) labels.

Answer

Access Reviews.

Question 7

You are configuring a 'Leaver' Lifecycle Workflow for employees who are resigning. You need to ensure that their access is immediately disabled and their manager is notified. Which TWO tasks should you include in the workflow to achieve this according to Microsoft best practices?

Accepted Answer

Disable user account.. Lifecycle Workflows automate the offboarding process, which is critical for security. When an employee leaves, the primary goals are to revoke their ability to sign in and inform their supervisor. This prevents unauthorized access to corporate data and ensures that the manager is aware that the offboarding process has been initiated.

Answer

Delete user account.

Answer

Remove user from all SharePoint sites.

Answer

Reset user password.

Question 8

You are the Catalog Owner for the 'Finance' catalog in Entitlement Management. You need to allow a project lead to create access packages within this catalog, but you do not want them to have permissions to add new resources to the catalog itself. Which role should you assign to the project lead?

Accepted Answer

Access Package Manager.. Entitlement Management uses a delegated administration model. The 'Access Package Manager' role is specifically designed for users who need to create and maintain access packages using resources that are already present in the catalog. This separation of duties prevents package creators from adding unauthorized resources to the catalog container.

Answer

Catalog Owner.

Answer

Access Package Assignment Manager.

Answer

User Administrator.

Question 9

Refer to the exhibit. An administrator is using the Microsoft Graph API to manage a PIM for Azure Resources assignment. Based on the JSON payload, what is the result of this operation?

Accepted Answer

The user is granted active access to the role for exactly four hours.. The JSON exhibit describes a 'roleAssignmentScheduleRequest'. The 'action' is 'AdminAssign', and the 'scheduleInfo' defines a duration of 'PT4H' (4 hours). This indicates an administrative assignment where a specific user is given active access to a role for a limited window of time, rather than making them eligible to request it themselves.

Answer

The user is made eligible for the role indefinitely.

Answer

A request is created that requires approval from a second administrator.

Answer

The user is permanently assigned to the role with no expiration.

Question 10

You are configuring an Access Review for a group that provides access to sensitive financial data. To comply with internal audits, you must ensure that the review occurs every quarter and that the 'User's manager' is always the primary reviewer. What should you do if some users in the group do not have a manager defined in Microsoft Entra ID?

Accepted Answer

Specify a fallback reviewer in the Access Review settings.. When 'Manager' is selected as the reviewer in an Access Review, Microsoft Entra ID relies on the 'manager' attribute of the user object. If this attribute is empty, the review for that specific user cannot be completed by a manager. You must configure a fallback reviewer to ensure no users are skipped during the audit.

Answer

The review will automatically skip users without a manager.

Answer

The Global Administrator will receive all reviews for users without managers.

Answer

Users without a manager will be prompted to review their own access.

Question 11

You are implementing Entitlement Management for a multinational company with multiple connected organizations. You need to create an access package that is available to users from any of your three primary partners (Contoso, Fabrikam, and Adatum). Which TWO steps must you take to ensure these external users can request the package?

Accepted Answer

Add Contoso, Fabrikam, and Adatum as Connected Organizations.. To allow external users from specific partners to request access, you must first establish a trust relationship by adding them as connected organizations. Once established, you must create a policy within an access package that explicitly targets these organizations. This ensures that only users from verified partners can see and request the resources.

Answer

Enable the 'Allow All Users' setting in the External Identities provider.

Answer

Assign the 'Guest Inviter' role to the users in the external organizations.

Answer

Set the access package visibility to 'Public'.

Question 12

You are managing a highly sensitive Azure subscription. You have configured PIM to require approval for the 'Owner' role. A user requests activation of this role. As the designated approver, you are unavailable. You need to ensure that the request can still be processed. What is the best way to handle this during the PIM configuration phase?

Accepted Answer

Configure a group as the approver for the role in PIM settings.. Approval workflows in PIM are critical for security but can become bottlenecks if not designed for high availability. By designating multiple approvers, you ensure that requests can be reviewed even if one individual is out of the office. This maintains both security and operational efficiency for critical administrative tasks.

Answer

Assign the 'Global Administrator' role to the requesting user permanently.

Answer

Set the activation duration to 24 hours to reduce the number of requests.

Answer

Disable the 'Require approval' setting and use 'Require MFA' only.

Question 13

Your organization uses Lifecycle Workflows to manage employee departures. You want to ensure that 30 days after an employee's hire date, a workflow automatically sends a survey to the employee to check on their onboarding experience. Which trigger should you use for this workflow?

Accepted Answer

A trigger based on the 'employeeHireDate' attribute with an 'offsetAfter' of 30 days.. Lifecycle Workflows provide triggers based on time offsets from specific user attributes. To target a date after an event, you use the 'offsetAfter' operator. This allows you to schedule tasks, such as follow-up emails or training reminders, to occur automatically a certain number of days after the employee's start date.

Answer

A trigger based on the 'createdDateTime' attribute with an 'equalTo' operator.

Answer

A trigger based on the 'lastSignInDateTime' attribute.

Answer

A manual trigger initiated by the HR Manager.

Question 14

You are configuring an Access Review for a group that contains 500 users. You want to reduce the manual effort for reviewers by providing them with system-generated insights. Which TWO features should you enable in the 'Reviewer decision helpers' section?

Accepted Answer

No info on last sign-in within 30 days.. Decision helpers assist reviewers by providing data-driven recommendations. This is especially useful in large groups where reviewers may not be familiar with every user's activity. By surfacing sign-in data and 'no-interaction' flags, the system helps reviewers make faster, more accurate decisions about who truly needs to retain access.

Answer

Auto-apply results to resource.

Answer

Multi-Factor Authentication status.

Answer

Conditional Access policy count.

Question 15

You are creating an access package for the Sales department. You want the package to be discoverable by all internal employees, but you want to ensure that only employees with the 'Sales' attribute in their user profile are allowed to request it. How should you configure the policy?

Accepted Answer

Create a dynamic group for Sales employees and scope the policy to that group.. Entitlement Management allows you to scope policies to specific sets of users. While you can make a package visible to all internal users, you can use 'Targeted' policies or group-based requirements to limit who can actually submit a request. This ensures that only relevant staff can obtain access to department-specific resources.

Answer

Create a policy for 'All users (All members)' and add an approval step.

Answer

Set the 'Hidden' property of the access package to 'Yes'.

Answer

Use a Conditional Access policy to block non-Sales users from the MyAccess portal.

Question 16

Your organization collaborates with an external partner on a project that requires access to a Microsoft Team and a SharePoint site. You need to ensure the partner's access is automatically revoked after 90 days and requires approval from their own manager. What should you configure?

Answer

A Conditional Access policy with session frequency controls.

Answer

A guest user account with a manual expiration date in Entra ID.

Answer

An access package in Entitlement Management with a lifecycle policy.

Answer

A periodic access review for the Microsoft Team and SharePoint site.

Question 17

You are implementing Privileged Identity Management (PIM) for Groups to manage access to sensitive administrative tools. You need to ensure that when a user is assigned to a group, they do not have permanent access but must instead request to activate their membership for a maximum of 4 hours. Which group type and assignment type should you use?

Answer

A role-assignable security group with an Eligible assignment.

Answer

A standard Microsoft 365 group with an Active assignment.

Answer

A dynamic membership security group with an Eligible assignment.

Answer

A role-assignable security group with an Active assignment.

Question 18

Your company is implementing Microsoft Entra Lifecycle Workflows to automate the onboarding of new employees. You need to select tasks that can be natively automated using the 'Onboard new hire' workflow template. Which TWO tasks should you choose?

Answer

Send a 'Welcome' email to the new hire.

Answer

Assign a Microsoft 365 E5 license to the user.

Answer

Create a new user account in an on-premises Active Directory.

Answer

Add the user to a specific set of security groups.

Answer

Provision the user into a third-party SaaS application.

Question 19

Refer to the exhibit. You are reviewing a JSON configuration for a Microsoft Entra access review. What is the expected outcome if the designated reviewer fails to respond to a review request for a specific guest user before the review period expires?

Answer

The guest user will retain access until the next review cycle begins.

Answer

The guest user's access to the resource will be automatically revoked.

Answer

An alert will be sent to the Global Administrator to make a manual decision.

Answer

The review period will be extended by 7 days automatically.

Question 20

You need to delegate the ability for a project lead to manage their own resources within Entitlement Management without granting them full Identity Governance Administrator permissions. What is the most restrictive role you should assign the project lead for a specific catalog?

Answer

Access Package Manager

Answer

Identity Governance Administrator

Answer

User Administrator

Answer

Catalog Owner