SC-300 Plan and Automate Identity Governance Practice Test 3 — 15 Questions

Question 1

Your organization needs to ensure that guest users from a specific partner automatically lose access to all resources in a project after 90 days, but they should be able to request an extension that requires approval from their internal project manager. Which configuration in an access package best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the lifecycle expiration to 90 days and enable the option for users to request extensions with manager approval.. Entitlement management provides the necessary lifecycle controls for external users through access packages. Setting an expiration policy ensures that access does not persist indefinitely, which is a key security principle. By requiring approval for extensions, the organization maintains oversight while allowing business continuity. This approach automates the removal process while providing a governed path for continued collaboration when necessary.

Answer

Use a conditional access policy to block access after 90 days based on the account creation date attribute.

Answer

Configure an access review to occur every 90 days and set the action for non-response to 'Remove access'.

Answer

Create a lifecycle workflow that deletes the guest account exactly 90 days after the account was first invited.

Question 2

An administrator is configuring Privileged Identity Management (PIM) for Azure Resources. They want to ensure that when a user activates the 'Contributor' role on a production subscription, a ticket number is mandatory, and a second administrator must approve the request. Which PIM setting should be modified?

Accepted Answer

Adjust the 'Role settings' for the Contributor role within the specific Azure subscription in PIM.. PIM for Azure Resources allows for granular control over how roles are activated. By requiring specific justifications like ticket numbers and implementing multi-party approval, organizations can enforce a 'least privilege' model with strict oversight. These settings are configured at the role level within the PIM interface for the specific Azure resource or subscription being managed.

Answer

Modify the 'Activation' settings in the Microsoft Entra ID roles section of the PIM dashboard.

Answer

Update the 'Privileged Access' settings for the group that contains the users requiring the Contributor role.

Answer

Create a new Conditional Access policy that targets the 'Azure Management' cloud app with MFA requirements.

Question 3

Refer to the exhibit. You are reviewing a Microsoft Entra Lifecycle Workflow configuration. Based on the provided JSON exhibit, when will the tasks associated with this workflow execute for a specific user?

Accepted Answer

The workflow will execute on the exact date and time specified in the user's employeeLeaveDateTime attribute.. Lifecycle Workflows use specific triggers to automate identity tasks during joiner, mover, or leaver events. This exhibit demonstrates a time-based trigger targeting the employeeLeaveDateTime attribute. Understanding how offsets and attributes interact is crucial for ensuring that accounts are disabled or removed exactly when intended, preventing security gaps during employee departures and maintaining compliance with organizational exit policies.

Answer

The workflow will trigger 30 days after the employeeLeaveDateTime to allow for a grace period.

Answer

The workflow will run 24 hours before the date specified in the employeeLeaveDateTime attribute.

Answer

The workflow will execute whenever the employeeLeaveDateTime attribute is manually updated by an administrator.

Question 4

A developer needs access to a 'Critical Infrastructure' access package. The organization requires that the developer's manager must approve the request first, followed by a final approval from the IT Security team. If either party denies the request, access is not granted. How should this be configured?

Accepted Answer

Configure a multi-stage approval policy within the access package with two distinct stages.. Multi-stage approval in Entitlement Management allows for complex governance workflows. By defining multiple steps, organizations can ensure that both business relevance (manager) and security compliance (IT Security) are verified. This tiered approach minimizes the risk of unauthorized access to highly sensitive resources by requiring consensus from multiple stakeholders before access is provisioned.

Answer

Create two separate access packages and require the user to request both in a specific sequence.

Answer

Set up a Logic App that triggers on an access package request to handle the complex approval logic.

Answer

Assign the IT Security team as the only approver and instruct them to check if the manager has approved via email.

Question 5

You are delegating administrative tasks in Microsoft Entra Entitlement Management. Which THREE roles are specifically designed to manage aspects of access packages and catalogs without requiring the Global Administrator role?

Accepted Answer

Catalog owner. Least privilege is a core tenet of identity governance. Microsoft Entra provides specific administrative roles that allow users to manage the lifecycle of access without having full control over the directory. Understanding these roles is essential for delegating responsibility to department leads or project managers while maintaining a secure administrative environment.

Answer

Billing Administrator

Answer

User Administrator

Question 6

Your security team is concerned about 'permanent' assignments for highly privileged roles. You decide to use PIM to monitor this. Which PIM feature or alert will help identify users who have a permanent assignment to a privileged role?

Accepted Answer

The 'Roles don't require multi-factor authentication for activation' and 'Permanent assignments' alerts.. Privileged Identity Management (PIM) provides security alerts to help administrators identify and remediate risks. One of the most critical alerts is the identification of permanent assignments. By converting these to 'eligible' assignments, organizations ensure that users only have privileged access when needed, reducing the blast radius of a potential account compromise.

Answer

The 'Roles not requiring MFA for activation' alert.

Answer

The 'Potential stale accounts' alert in the identity governance dashboard.

Answer

The 'Activation' history log filtered by the 'Permanent' status code.

Question 7

Refer to the exhibit. An organization is enforcing PIM for the Contributor role. Based on the JSON configuration for the role setting, what is the maximum amount of time a user can have the role active after their request is approved?

Accepted Answer

The user can remain active in the role for a maximum of 8 hours.. Role settings in PIM define the constraints for activation. The maxExpirationDuration attribute uses the ISO 8601 duration format. Understanding this format is essential for administrators to correctly interpret and audit the time-based restrictions placed on privileged access, ensuring that access is automatically revoked after the shortest practical time window.

Answer

The user can remain active in the role for a maximum of 8 days.

Answer

The user's role will never expire as long as they are signed in.

Answer

The user must renew their activation every 8 minutes to keep the role.

Question 8

You are implementing Lifecycle Workflows to automate the 'Joiner' process for new employees. Which TWO conditions can be used as triggers to start a workflow for a new hire?

Accepted Answer

A specific number of days before the 'employeeHireDate' attribute.. Lifecycle Workflows automate the management of users as they enter, move through, or leave an organization. Choosing the right trigger is vital for ensuring that accounts are provisioned and configured at the correct moment. Triggers can be based on specific date attributes or manual execution, allowing for flexibility in how onboarding is handled.

Answer

When a user is added to a specific 'Onboarding' security group.

Answer

Immediately when a user's 'Job Title' attribute is updated in Entra ID.

Answer

When a user signs in for the first time using Multi-Factor Authentication.

Question 9

An organization has an access review for a security group that grants access to financial data. The administrator wants to ensure that if a reviewer fails to respond to the review request within the 14-day window, the user's access is automatically removed to maintain a 'secure by default' posture. How should this be configured?

Accepted Answer

Set the 'Action on non-response' to 'Remove access'.. Configuring 'If reviewers don't respond' settings is a vital part of hardening identity governance. In high-risk scenarios, like access to financial data, an 'Apply recommendations' or 'Take no action' approach might leave unauthorized access in place. A 'Remove access' policy ensures that access must be actively justified to persist.

Answer

Set the 'Action on non-response' to 'Approve access' to prevent business disruption.

Answer

Set the 'Action on non-response' to 'Take recommendations'.

Answer

Enable 'Decision helpers' and set the default action to 'Notify Global Admin'.

Question 10

In Microsoft Entra Entitlement Management, what is the primary purpose of a 'Catalog'?

Accepted Answer

To group related resources and access packages for delegated management.. Catalogs serve as the foundational organizational unit in Entitlement Management. They allow for the grouping of related resources (groups, applications, and SharePoint sites) and the delegation of administrative tasks. By using catalogs, organizations can decentralize management, allowing department heads to oversee their own resources while maintaining a structured governance framework.

Answer

To store backup copies of all user identities in the directory.

Answer

To provide a public list of all applications available to guest users.

Answer

To synchronize on-premises Active Directory objects to the cloud.

Question 11

Which TWO settings must be configured in an access package to allow users from a specific external partner organization to request access while ensuring all other external users are blocked?

Accepted Answer

Add the partner's domain to the 'Connected Organizations' list in Entitlement Management.. Governing external access requires a combination of 'Connected Organizations' and specific access package policies. Connected Organizations define the trust relationship at the domain level, while the policy determines who from those organizations can actually see and request the package. This dual-layer approach ensures precise control over external collaboration.

Answer

Create a Conditional Access policy that excludes the partner's IP address range.

Answer

Enable the 'Allow all external users' setting in the External Identities provider settings.

Answer

Set the access package 'Hidden' attribute to 'No' so it is visible in the MyAccess portal.

Question 12

A company wants to extend their Lifecycle Workflows to trigger a custom script in an on-premises environment whenever a new user is onboarded. Which feature should be used to integrate the workflow with the custom script?

Accepted Answer

Create a 'Custom Task Extension' that calls an Azure Logic App.. Lifecycle Workflows can be extended using 'Custom Task Extensions'. These extensions use Azure Logic Apps as a bridge between the cloud-native workflow and other systems. By calling a Logic App, the workflow can trigger various actions, including running scripts on-premises via a hybrid runbook worker or calling external APIs.

Answer

Use a Microsoft Graph API call directly from the workflow tasks list.

Answer

Configure a dynamic group that triggers a PowerShell script when a user joins.

Answer

Set up a Conditional Access 'Custom Authentication Extension'.

Question 13

You are implementing 'PIM for Groups' to manage access to a sensitive project. You want to ensure that users can only activate their membership in the 'Project-Admins' group for a maximum of 4 hours and must use MFA. Where is this configuration performed?

Accepted Answer

In the PIM for Groups 'Settings' menu for the specific group.. PIM for Groups (formerly Privileged Access Groups) allows you to apply PIM features like just-in-time activation and approval to group memberships. The configuration for activation duration and MFA requirements is managed within the 'Role settings' specifically for the 'Member' or 'Owner' roles of the group in PIM.

Answer

In the 'Properties' tab of the group within the Microsoft Entra ID 'Groups' blade.

Answer

Through a Conditional Access policy targeting the 'Project-Admins' group.

Answer

By modifying the 'Identity Governance' global settings for the entire tenant.

Question 14

Your organization uses Microsoft Entra ID Governance. You need to ensure that guest users who have not accessed resources in the last 90 days are automatically removed from your tenant. Which feature should you implement?

Accepted Answer

Lifecycle Workflows. Entra ID lifecycle workflows allow administrators to automate user management processes, including offboarding inactive guests. By using the 'Delete guest user' task within a lifecycle workflow, you reduce the attack surface and maintain compliance by ensuring stale guest accounts are purged. This is a critical governance requirement for organizations managing high volumes of external collaborators, ensuring that identity lifecycles align with security best practices for access reviews and data privacy.

Answer

Access Reviews

Answer

Entitlement Management

Answer

Conditional Access policies

Question 15

You are designing an access review program in Microsoft Entra ID. Which TWO factors must you consider to ensure the review remains effective and compliant? Select exactly two.

Accepted Answer

The frequency of the review cycle. Effective access reviews require defining both the scope of identities and the specific criteria for decision-making. By choosing the correct reviewers—usually resource owners or direct managers—and setting a clear duration, you ensure that decisions are informed and timely. This practice is essential for maintaining the principle of least privilege, as it forces periodic re-validation of permissions that often suffer from 'privilege creep' over time in large enterprise environments.

Answer

The maximum number of users per review

Answer

The use of self-service groups

Answer

The integration with external identity providers