You are implementing Privileged Identity Management (PIM) for Groups to manage access to sensitive administrative tools. You need to ensure that when a user is assigned to a group, they do not have permanent access but must instead request to activate their membership for a maximum of 4 hours. Which group type and assignment type should you use?

A role-assignable security group with an Eligible assignment.

A standard Microsoft 365 group with an Active assignment.

A dynamic membership security group with an Eligible assignment.

A role-assignable security group with an Active assignment.

Your company is implementing Microsoft Entra Lifecycle Workflows to automate the onboarding of new employees. You need to select tasks that can be natively automated using the 'Onboard new hire' workflow template. Which TWO tasks should you choose?

Send a 'Welcome' email to the new hire.

Assign a Microsoft 365 E5 license to the user.

Create a new user account in an on-premises Active Directory.

Add the user to a specific set of security groups.

Provision the user into a third-party SaaS application.

Refer to the exhibit. You are reviewing a JSON configuration for a Microsoft Entra access review. What is the expected outcome if the designated reviewer fails to respond to a review request for a specific guest user before the review period expires?

The guest user will retain access until the next review cycle begins.

The guest user's access to the resource will be automatically revoked.

An alert will be sent to the Global Administrator to make a manual decision.

The review period will be extended by 7 days automatically.

You need to delegate the ability for a project lead to manage their own resources within Entitlement Management without granting them full Identity Governance Administrator permissions. What is the most restrictive role you should assign the project lead for a specific catalog?

Identity Governance Administrator

You are creating a Microsoft Entra Terms of Use (ToU) agreement for external consultants. Which THREE settings can you configure within a single ToU object?

A custom HTML landing page for the agreement.

A requirement for users to expand the terms before accepting.

A frequency for how often users must re-accept the terms.

The ability to block access if the user is on an unmanaged device.

A setting to require acceptance on every device.

Your organization uses a third-party SaaS application that supports the System for Cross-domain Identity Management (SCIM) 2.0 protocol. You want to automate the creation and deletion of user accounts in this application based on their status in Microsoft Entra ID. What should you configure?

A Lifecycle Workflow with a custom extension.

Application provisioning in the Enterprise Applications blade.

An access package with a resource for the SaaS application.

A Conditional Access policy with an App Control session.

You are configuring a new role in Privileged Identity Management (PIM) for the 'Exchange Administrator' role. You need to ensure that any user who activates this role is required to provide specific justifications. Which TWO settings should you modify in the PIM role settings?

The 'Allow permanent eligible assignment' setting.

The 'Require justification on activation' setting.

The 'Require Multi-Factor Authentication on active assignment' setting.

The 'Require approval to activate' setting.

The 'Require ticket information on activation' setting.

Refer to the exhibit. An administrator runs this Microsoft Graph PowerShell command to create a new access package assignment policy. What is the effect of the 'RequestorSettings' parameters in this script?

Only users within the local Entra ID tenant can request the access package.

Any guest user from any organization can request access to the resources.

Only users from the two specified connected organizations can request access.

The policy allows access to any user who has the script's ID values.

You are managing access packages for a Finance department. You need to prevent users who already have access to the 'Payroll Processing' access package from requesting the 'External Audit' access package to maintain separation of duties. What should you configure?

Mark the access packages as incompatible with each other.

Create a Conditional Access policy to block the specific users.

Assign a 'Deny' permission to the Audit group for Payroll users.

Configure an access review to remove users with both packages.

When creating an Access Review for a Microsoft 365 group containing both internal employees and guest users, which THREE options are available for selecting reviewers?

Users review their own access (Self-review)

You are automating the offboarding process for employees using Lifecycle Workflows. You want to ensure that 30 days after an employee's departure date, their account is disabled and they are removed from all groups. Which workflow template should you use?

Post-offboarding of an employee

You need to allow users from a specific partner organization to request access packages in your directory. The partner uses their own Entra ID tenant. What must you create first in Entitlement Management?

A new guest user account for every partner employee.

A cross-tenant access policy in the External Identities blade.

A dynamic group that includes all external users.

You are performing an access review for guest users who have been inactive for 30 days. You want to ensure that if a user's access is denied, they are not only removed from the resource but their account is also blocked from signing in for 30 days and then deleted. Which feature should you use?

Lifecycle Workflows with a custom 'Leaver' task.

Access review 'Advanced settings' for guest user lifecycle.

A Conditional Access policy with a block control.

A PIM alert that triggers a PowerShell script.

You are configuring an access package for the Marketing department. You need to define who is allowed to request this package. Which TWO options can be selected as requestors in an access package policy?

Any user with a valid LinkedIn account

Only users who have already been assigned a P1 license

Anonymous users via a public URL

Courseiva

Knowledge + Practice

← Plan and Automate Identity Governance practice sets

SC-300 Plan and Automate Identity Governance • Set 2

SC-300 Plan and Automate Identity Governance Practice Test 2 — 15 Questions

SC-300 Plan and Automate Identity Governance Practice Test 2 — 15 questions with explanations. Free, no signup.

Questions

Free

No signup

SC-300Practice

1 / 157%

Plan and Automate Identity Governancemedium

Your organization collaborates with an external partner on a project that requires access to a Microsoft Team and a SharePoint site. You need to ensure the partner's access is automatically revoked after 90 days and requires approval from their own manager. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

15 questions · instant feedback and full explanations after every question.