SC-300 Plan and Automate Identity Governance — All Questions With Answers

Question 1mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your organization works with a external vendor, Fabrikam, which requires access to specific SharePoint sites and Teams for a six-month project. You need to ensure that Fabrikam employees can request access themselves, but their access must be automatically revoked when the project ends or if they no longer require it. Which Entitlement Management feature should you implement?

Question 2mediummulti select

Study the full multicast explanation →

You are configuring Privileged Identity Management (PIM) for Microsoft Entra roles. You want to ensure that whenever a user activates the Global Administrator role, specific security requirements are met to maintain a high security posture. Which TWO of the following settings can be enforced during the activation process?

Question 3hardmultiple choice

Read the full Plan and Automate Identity Governance explanation →

Refer to the exhibit. You are reviewing a Microsoft Entra Lifecycle Workflow. Based on the JSON configuration provided, when will the tasks in this workflow be executed for a new user?

Exhibit

{
  "displayName": "Onboard New Marketing Employee",
  "trigger": {
    "@odata.type": "#microsoft.graph.workflowTriggerTimeBasedAttribute",
    "attributeName": "employeeHireDate",
    "timeBasedAttributeOperator": "equalTo"
  },
  "tasks": [
    {
      "taskDefinitionId": "22c61175-70c1-4ca1-8334-8300ad92e964",
      "displayName": "Send welcome email",
      "arguments": []
    },
    {
      "taskDefinitionId": "898f8670-466d-473d-82d2-86111f18f673",
      "displayName": "Add to Marketing Group",
      "arguments": [
        { "name": "groupId", "value": "9f620853-2c13-4351-9e56-111111111111" }
      ]
    }
  ]
}

Question 4mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are setting up an Access Review for a security group that contains both internal employees and guest users. You want to ensure that if a reviewer does not respond within the 14-day window, the guest users' access is automatically removed, but internal users keep their access until a manual decision is made. How should you configure the 'Upon non-response' settings?

Question 5mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are designing a governance strategy for Entitlement Management. You need to create a new catalog to delegate the management of marketing-related resources. Which THREE of the following resource types can be added to a Microsoft Entra Entitlement Management catalog?

Question 6easymultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your company requires all users to acknowledge a new Remote Work Policy before they can access any cloud applications. You need to ensure that users are prompted to read and accept the policy every 90 days. Which tool should you use to meet this requirement?

Question 7mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are configuring a 'Leaver' Lifecycle Workflow for employees who are resigning. You need to ensure that their access is immediately disabled and their manager is notified. Which TWO tasks should you include in the workflow to achieve this according to Microsoft best practices?

Question 8mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are the Catalog Owner for the 'Finance' catalog in Entitlement Management. You need to allow a project lead to create access packages within this catalog, but you do not want them to have permissions to add new resources to the catalog itself. Which role should you assign to the project lead?

Question 9hardmultiple choice

Study the full multicast explanation →

Refer to the exhibit. An administrator is using the Microsoft Graph API to manage a PIM for Azure Resources assignment. Based on the JSON payload, what is the result of this operation?

Exhibit

{
  "roleDefinitionId": "9b8f6453-6238-469b-9860-29c91942d99d",
  "principalId": "4d222222-1111-1111-1111-333333333333",
  "action": "AdminAssign",
  "justification": "Deploying critical update to SQL clusters",
  "scheduleInfo": {
    "startDateTime": "2023-11-01T09:00:00Z",
    "expiration": {
      "type": "afterDuration",
      "duration": "PT4H"
    }
  }
}

Question 10mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are configuring an Access Review for a group that provides access to sensitive financial data. To comply with internal audits, you must ensure that the review occurs every quarter and that the 'User's manager' is always the primary reviewer. What should you do if some users in the group do not have a manager defined in Microsoft Entra ID?

Question 11hardmulti select

Read the full Plan and Automate Identity Governance explanation →

You are implementing Entitlement Management for a multinational company with multiple connected organizations. You need to create an access package that is available to users from any of your three primary partners (Contoso, Fabrikam, and Adatum). Which TWO steps must you take to ensure these external users can request the package?

Question 12mediummultiple choice

Study the full multicast explanation →

You are managing a highly sensitive Azure subscription. You have configured PIM to require approval for the 'Owner' role. A user requests activation of this role. As the designated approver, you are unavailable. You need to ensure that the request can still be processed. What is the best way to handle this during the PIM configuration phase?

Question 13mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your organization uses Lifecycle Workflows to manage employee departures. You want to ensure that 30 days after an employee's hire date, a workflow automatically sends a survey to the employee to check on their onboarding experience. Which trigger should you use for this workflow?

Question 14mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are configuring an Access Review for a group that contains 500 users. You want to reduce the manual effort for reviewers by providing them with system-generated insights. Which TWO features should you enable in the 'Reviewer decision helpers' section?

Question 15mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are creating an access package for the Sales department. You want the package to be discoverable by all internal employees, but you want to ensure that only employees with the 'Sales' attribute in their user profile are allowed to request it. How should you configure the policy?

Question 16mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your organization collaborates with an external partner on a project that requires access to a Microsoft Team and a SharePoint site. You need to ensure the partner's access is automatically revoked after 90 days and requires approval from their own manager. What should you configure?

Question 17hardmultiple choice

Study the full multicast explanation →

You are implementing Privileged Identity Management (PIM) for Groups to manage access to sensitive administrative tools. You need to ensure that when a user is assigned to a group, they do not have permanent access but must instead request to activate their membership for a maximum of 4 hours. Which group type and assignment type should you use?

Question 18mediummulti select

Read the full Plan and Automate Identity Governance explanation →

Your company is implementing Microsoft Entra Lifecycle Workflows to automate the onboarding of new employees. You need to select tasks that can be natively automated using the 'Onboard new hire' workflow template. Which TWO tasks should you choose?

Question 19hardmultiple choice

Read the full Plan and Automate Identity Governance explanation →

Refer to the exhibit. You are reviewing a JSON configuration for a Microsoft Entra access review. What is the expected outcome if the designated reviewer fails to respond to a review request for a specific guest user before the review period expires?

Exhibit

{
  "displayName": "Quarterly Guest Review",
  "reviewers": [{ "query": "/users/admin@contoso.com", "queryType": "MicrosoftGraph" }],
  "settings": {
    "autoApplyDecisionsEnabled": true,
    "defaultDecision": "Deny",
    "defaultDecisionEnabled": true,
    "justificationRequiredOnApproval": true
  }
}

Question 20mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You need to delegate the ability for a project lead to manage their own resources within Entitlement Management without granting them full Identity Governance Administrator permissions. What is the most restrictive role you should assign the project lead for a specific catalog?

Question 21mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are creating a Microsoft Entra Terms of Use (ToU) agreement for external consultants. Which THREE settings can you configure within a single ToU object?

Question 22mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your organization uses a third-party SaaS application that supports the System for Cross-domain Identity Management (SCIM) 2.0 protocol. You want to automate the creation and deletion of user accounts in this application based on their status in Microsoft Entra ID. What should you configure?

Question 23hardmulti select

Study the full multicast explanation →

You are configuring a new role in Privileged Identity Management (PIM) for the 'Exchange Administrator' role. You need to ensure that any user who activates this role is required to provide specific justifications. Which TWO settings should you modify in the PIM role settings?

Question 24hardmultiple choice

Read the full Plan and Automate Identity Governance explanation →

Refer to the exhibit. An administrator runs this Microsoft Graph PowerShell command to create a new access package assignment policy. What is the effect of the 'RequestorSettings' parameters in this script?

Exhibit

New-MgEntitlementManagementAccessPackageAssignmentPolicy `
  -AccessPackageId $apId `
  -DisplayName "Partner Policy" `
  -Description "Policy for external partners" `
  -RequestorSettings @{ `
    ScopeType = "SpecificConnectedOrganizationUsers"; `
    AcceptRequests = $true; `
    AllowedRequestors = @($org1, $org2) `
  }

Question 25mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are managing access packages for a Finance department. You need to prevent users who already have access to the 'Payroll Processing' access package from requesting the 'External Audit' access package to maintain separation of duties. What should you configure?

Question 26mediummulti select

Read the full Plan and Automate Identity Governance explanation →

When creating an Access Review for a Microsoft 365 group containing both internal employees and guest users, which THREE options are available for selecting reviewers?

Question 27mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are automating the offboarding process for employees using Lifecycle Workflows. You want to ensure that 30 days after an employee's departure date, their account is disabled and they are removed from all groups. Which workflow template should you use?

Question 28easymultiple choice

Read the full Plan and Automate Identity Governance explanation →

You need to allow users from a specific partner organization to request access packages in your directory. The partner uses their own Entra ID tenant. What must you create first in Entitlement Management?

Question 29mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

You are performing an access review for guest users who have been inactive for 30 days. You want to ensure that if a user's access is denied, they are not only removed from the resource but their account is also blocked from signing in for 30 days and then deleted. Which feature should you use?

Question 30mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are configuring an access package for the Marketing department. You need to define who is allowed to request this package. Which TWO options can be selected as requestors in an access package policy?

Question 31mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your organization needs to ensure that guest users from a specific partner automatically lose access to all resources in a project after 90 days, but they should be able to request an extension that requires approval from their internal project manager. Which configuration in an access package best meets this requirement?

Question 32hardmultiple choice

Study the full multicast explanation →

An administrator is configuring Privileged Identity Management (PIM) for Azure Resources. They want to ensure that when a user activates the 'Contributor' role on a production subscription, a ticket number is mandatory, and a second administrator must approve the request. Which PIM setting should be modified?

Question 33mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Refer to the exhibit. You are reviewing a Microsoft Entra Lifecycle Workflow configuration. Based on the provided JSON exhibit, when will the tasks associated with this workflow execute for a specific user?

Exhibit

{
  "category": "leaver",
  "displayName": "Employee Offboarding",
  "executionConditions": {
    "@odata.type": "#microsoft.graph.onPremisesPublishingOrganization",
    "trigger": {
      "@odata.type": "#microsoft.graph.timeBasedAttributeTrigger",
      "attributeName": "employeeLeaveDateTime",
      "offsetInDays": 0
    }
  }
}

Question 34hardmultiple choice

Read the full Plan and Automate Identity Governance explanation →

A developer needs access to a 'Critical Infrastructure' access package. The organization requires that the developer's manager must approve the request first, followed by a final approval from the IT Security team. If either party denies the request, access is not granted. How should this be configured?

Question 35mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are delegating administrative tasks in Microsoft Entra Entitlement Management. Which THREE roles are specifically designed to manage aspects of access packages and catalogs without requiring the Global Administrator role?

Question 36mediummultiple choice

Study the full multicast explanation →

Your security team is concerned about 'permanent' assignments for highly privileged roles. You decide to use PIM to monitor this. Which PIM feature or alert will help identify users who have a permanent assignment to a privileged role?

Question 37hardmultiple choice

Study the full multicast explanation →

Refer to the exhibit. An organization is enforcing PIM for the Contributor role. Based on the JSON configuration for the role setting, what is the maximum amount of time a user can have the role active after their request is approved?

Exhibit

{
  "roleSetting": {
    "id": "12345",
    "roleDefinitionId": "Contributor",
    "isExpirationRequired": true,
    "maxExpirationDuration": "PT8H",
    "requireApproval": true
  }
}

Question 38mediummulti select

Read the full Plan and Automate Identity Governance explanation →

You are implementing Lifecycle Workflows to automate the 'Joiner' process for new employees. Which TWO conditions can be used as triggers to start a workflow for a new hire?

Question 39mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

An organization has an access review for a security group that grants access to financial data. The administrator wants to ensure that if a reviewer fails to respond to the review request within the 14-day window, the user's access is automatically removed to maintain a 'secure by default' posture. How should this be configured?

Question 40easymultiple choice

Read the full Plan and Automate Identity Governance explanation →

In Microsoft Entra Entitlement Management, what is the primary purpose of a 'Catalog'?

Question 41hardmulti select

Read the full Plan and Automate Identity Governance explanation →

Which TWO settings must be configured in an access package to allow users from a specific external partner organization to request access while ensuring all other external users are blocked?

Question 42mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

A company wants to extend their Lifecycle Workflows to trigger a custom script in an on-premises environment whenever a new user is onboarded. Which feature should be used to integrate the workflow with the custom script?

Question 43mediummultiple choice

Study the full multicast explanation →

You are implementing 'PIM for Groups' to manage access to a sensitive project. You want to ensure that users can only activate their membership in the 'Project-Admins' group for a maximum of 4 hours and must use MFA. Where is this configuration performed?

Question 44mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Your organization uses Microsoft Entra ID Governance. You need to ensure that guest users who have not accessed resources in the last 90 days are automatically removed from your tenant. Which feature should you implement?

Question 45hardmulti select

Read the full Plan and Automate Identity Governance explanation →

You are designing an access review program in Microsoft Entra ID. Which TWO factors must you consider to ensure the review remains effective and compliant? Select exactly two.

Question 46mediummultiple choice

Read the full Plan and Automate Identity Governance explanation →

Refer to the exhibit. You are configuring an Access Package in Entra Entitlement Management. What is the impact of the configuration shown in the exhibit?

Exhibit

{
  "displayName": "Contractor Access",
  "description": "Policy for contractors",
  "isApprovalRequired": true,
  "approvalSettings": {
    "approvalMode": "TwoStage",
    "approvalStages": [
      {
        "approvalStageType": "Manager",
        "isApproverJustificationRequired": true
      },
      {
        "approvalStageType": "ResourceOwner",
        "isApproverJustificationRequired": true
      }
    ]
  }
}

Question 47hardmultiple choice

Study the full multicast explanation →

You are managing Privileged Identity Management (PIM) for Azure resources. You need to ensure that when a user activates a role, they are required to provide a support ticket number. Which PIM setting must you modify?

{ "displayName": "Onboard New Marketing Employee", "trigger": { "@odata.type": "#microsoft.graph.workflowTriggerTimeBasedAttribute", "attributeName": "employeeHireDate", "timeBasedAttributeOperator": "equalTo" }, "tasks": [ { "taskDefinitionId": "22c61175-70c1-4ca1-8334-8300ad92e964", "displayName": "Send welcome email", "arguments": [] }, { "taskDefinitionId": "898f8670-466d-473d-82d2-86111f18f673", "displayName": "Add to Marketing Group", "arguments": [ { "name": "groupId", "value": "9f620853-2c13-4351-9e56-111111111111" } ] } ] }

{ "roleDefinitionId": "9b8f6453-6238-469b-9860-29c91942d99d", "principalId": "4d222222-1111-1111-1111-333333333333", "action": "AdminAssign", "justification": "Deploying critical update to SQL clusters", "scheduleInfo": { "startDateTime": "2023-11-01T09:00:00Z", "expiration": { "type": "afterDuration", "duration": "PT4H" } } }

{ "displayName": "Quarterly Guest Review", "reviewers": [{ "query": "/users/admin@contoso.com", "queryType": "MicrosoftGraph" }], "settings": { "autoApplyDecisionsEnabled": true, "defaultDecision": "Deny", "defaultDecisionEnabled": true, "justificationRequiredOnApproval": true } }

New-MgEntitlementManagementAccessPackageAssignmentPolicy ` -AccessPackageId $apId ` -DisplayName "Partner Policy" ` -Description "Policy for external partners" ` -RequestorSettings @{ ` ScopeType = "SpecificConnectedOrganizationUsers"; ` AcceptRequests = $true; ` AllowedRequestors = @($org1, $org2) ` }

{ "category": "leaver", "displayName": "Employee Offboarding", "executionConditions": { "@odata.type": "#microsoft.graph.onPremisesPublishingOrganization", "trigger": { "@odata.type": "#microsoft.graph.timeBasedAttributeTrigger", "attributeName": "employeeLeaveDateTime", "offsetInDays": 0 } } }

{ "displayName": "Contractor Access", "description": "Policy for contractors", "isApprovalRequired": true, "approvalSettings": { "approvalMode": "TwoStage", "approvalStages": [ { "approvalStageType": "Manager", "isApproverJustificationRequired": true }, { "approvalStageType": "ResourceOwner", "isApproverJustificationRequired": true } ] } }