SC-300 Plan and Implement Workload Identities — 20 Questions

Question 1

Your organization uses Azure Kubernetes Service (AKS). You need to allow a pod to access an Azure Key Vault secret without using Kubernetes secrets or managed identity credentials stored in the pod configuration. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Azure AD Workload Identity and create a federated identity credential.. Workload Identity Federation for Kubernetes allows pods to authenticate with Azure AD using their native service account tokens. By establishing a trust relationship between the Kubernetes cluster's OIDC issuer and an Azure User Assigned Managed Identity, the pod can exchange its short-lived token for an Azure AD token. This eliminates the need for managing static credentials or long-lived secrets within the cluster environment.

Answer

Enable Azure AD pod-managed identity for the cluster.

Answer

Assign a system-assigned managed identity to the AKS node pool.

Answer

Install the Key Vault CSI driver and store the secret as a K8s secret.

Question 2

You are managing service principals for an application that spans multiple environments. You need to ensure that credentials for these principals are rotated securely. Which TWO actions should you perform? (Choose two)

Accepted Answer

Store all service principal secrets in Azure Key Vault and configure automated rotation.. Managing service principal secrets requires a proactive lifecycle strategy. Azure Key Vault provides a centralized, secure location to store secrets and automate their rotation using Logic Apps or Function Apps. Additionally, migrating to certificate-based authentication or Workload Identity Federation significantly reduces the risk associated with static password leakage and simplifies the maintenance overhead of manual rotation cycles.

Answer

Use the Azure AD portal to manually update secrets every 30 days.

Answer

Enable password writeback in Azure AD Connect to force rotation.

Answer

Configure the service principal to rotate its own password every hour.

Question 3

Refer to the exhibit. You are setting up Workload Identity Federation for a GitHub Actions workflow. The deployment keeps failing with an 'AADSTS70021' error during token exchange. What is the most likely cause?

Accepted Answer

The audience claim in the GitHub token does not match the configured audience.. The exhibit displays a configuration for a federated identity credential. The AADSTS70021 error (No matching federated identity record found) typically occurs when the audience or subject claims defined in the request do not match the configuration on the Azure side. In this context, ensure the GitHub OIDC provider is correctly linked and that the audience matches the expected Azure AD application registration settings exactly.

Answer

The GitHub Action is attempting to authenticate with the wrong Tenant ID.

Answer

The service principal has not been granted the 'Owner' role on the subscription.

Answer

The GitHub repository is private and cannot communicate with Azure AD.

Question 4

Which object type in Azure AD should you create to represent an application that needs to access Azure resources, ensuring that the application can authenticate using a client secret or certificate?

Accepted Answer

Application Registration. In Microsoft Entra ID, an 'Application Registration' is used to define the identity and configuration of an application. When an application needs to act as itself—without a user present—you use a service principal, which is an instance of the application object within your tenant. This allows for the configuration of authentication methods like secrets and certificates.

Answer

Managed Identity

Answer

Enterprise Application

Answer

Group-based access package

Question 5

You are auditing your environment for security risks related to workload identities. Which THREE conditions should you flag as high-security risks? (Choose three)

Accepted Answer

Service principals with client secrets that have no expiration date.. Workload identity security is critical for preventing unauthorized access to cloud resources. Flagging credentials that lack expiration, shared secrets across multiple applications, and identities with overly permissive roles is a standard best practice. These scenarios provide attackers with persistence and excessive lateral movement capabilities if a single credential is compromised, making remediation and monitoring of these specific patterns a top priority for security administrators.

Answer

Managed identities assigned to multiple virtual machines.

Answer

Service principals that use certificate-based authentication.

Question 6

Refer to the exhibit. What is the primary security implication of running this command as written?

Accepted Answer

The client secret is displayed in plain text, exposing it to potential theft.. The command creates a service principal with 'Contributor' access to an entire resource group. While this is common, the implication is that the resulting credential, if leaked, provides full control over all resources within that group. The command output will display the client secret in plain text, which is an immediate security risk if captured in logs, CI/CD history, or terminal buffers.

Answer

The command fails because the scope is too narrow.

Answer

The service principal is not assigned any authentication method by default.

Answer

The service principal is created with Owner permissions instead of Contributor.

Question 7

You need to automate the rotation of a certificate used for service principal authentication. Which tool should you use to store the private key and manage the rotation lifecycle?

Accepted Answer

Azure Key Vault. Azure Key Vault is the industry-standard service for managing cryptographic keys and secrets. For service principal certificates, the Key Vault can store the certificate, and integrated automation (such as Logic Apps) can trigger renewal and updates to the Azure AD application registration, ensuring the identity remains secure without manual intervention.

Answer

Azure Storage Account

Answer

Azure App Configuration

Answer

Azure DevOps Secret Variables

Question 8

An application running on an Azure Virtual Machine needs to access data in an Azure SQL Database. You want to ensure the connection is secure without using hard-coded connection strings containing passwords. What should you do?

Accepted Answer

Enable a system-assigned managed identity on the VM and assign it SQL permissions.. Using a system-assigned managed identity on the virtual machine is the most secure approach. By enabling the identity on the VM, Azure provides an automatically managed service principal. You can then grant this identity the appropriate SQL database role (like db_datareader), allowing the application to authenticate using Azure AD instead of SQL credentials.

Answer

Create an Azure AD user and store their credentials in the VM config.

Answer

Use a service principal with a client secret stored in a local file.

Answer

Enable SQL Server Authentication and use a firewall rule to restrict IPs.

Question 9

Which of the following scenarios is the primary use case for utilizing an Azure AD Service Principal over a Managed Identity?

Accepted Answer

When the application runs on-premises and needs to access Azure APIs.. Managed identities are limited to Azure-hosted resources. When your application runs on-premises, in another cloud, or on a local machine, you cannot use a managed identity. In these cases, you must register an application in Azure AD and use a service principal with either a certificate or a client secret to establish the required trust and authentication.

Answer

When the application runs on an Azure Virtual Machine.

Answer

When the application requires access to multiple Azure subscriptions.

Answer

When you need to provide administrative access to the entire tenant.

Question 10

You are configuring Workload Identity Federation for a CI/CD pipeline running on an external CI/CD provider. Which THREE pieces of information are required to create the federated identity credential? (Choose three)

Accepted Answer

The Issuer URL of the external OIDC provider.. To successfully federate an external workload with Azure AD, you must map the identity of the external provider to an Azure AD application. This requires the Issuer URL (to identify the provider), the Subject identifier (to restrict the specific project or branch), and the Audience (to ensure the token is intended for Azure). These three components form the trust policy that Azure AD evaluates.

Answer

The Client Secret of the service principal.

Answer

The Tenant ID of the external provider.

Question 11

You have an application that uses a client secret for authentication. You want to audit when this secret is used. Which log should you examine in Azure Monitor?

Accepted Answer

ServicePrincipalSignInLogs. The 'SignInLogs' in Azure AD contain logs for all interactive and non-interactive sign-ins. Specifically, the 'ServicePrincipalSignInLogs' category is dedicated to logging authentication requests made by applications using service principals. This is the primary source for monitoring when, how, and by whom (or what) a service principal's secret is being utilized.

Answer

AuditLogs

Answer

AzureActivity

Answer

AppServiceHTTPLogs

Question 12

When configuring an Azure AD application for a multi-tenant environment, what is the impact of changing the 'Supported account types' to 'Accounts in any organizational directory'?

Accepted Answer

The application can accept authentication from any Azure AD tenant.. Changing the support level to multi-tenant allows users and service principals from other Azure AD tenants to authenticate against your application. This is a significant security configuration change, as it expands the attack surface. You must implement strict validation of the 'tid' (tenant ID) claim in your application to ensure that you are only accepting tokens from authorized tenants.

Answer

The application can only be used by users within your home tenant.

Answer

The application becomes a public application and ignores authentication.

Answer

The application is automatically deleted and must be re-registered.

Question 13

Refer to the exhibit. You are reviewing the configuration of an application registration. What is the most significant security risk present in this configuration?

Accepted Answer

The Directory.Read.All permission is too broad.. The inclusion of 'Directory.Read.All' is a high-risk application permission. This permission allows the service principal to read the entire directory, including sensitive user profile information, groups, and directory metadata. Such a broad scope is rarely necessary for most applications and, if compromised, allows an attacker to perform extensive reconnaissance on the entire organization's identity structure.

Answer

The use of ClientSecret as an authentication method.

Answer

The application ID is too short.

Answer

The expiry date is in the past.

Question 14

Which Azure AD feature allows you to manage the lifecycle of an application's service principal, including conditional access policies and user assignment, in a centralized manner?

Accepted Answer

Enterprise Application. Enterprise Applications in Azure AD provide the management plane for service principals. This is where you configure SSO, conditional access policies (like requiring MFA), assignment/access control for users, and auditing. While the application registration defines the app globally, the enterprise application is the instance where you enforce security policies at the tenant level.

Answer

Application Registration

Answer

Managed Identity

Answer

Azure Policy

Question 15

An organization needs to allow an Azure Function to access secrets in an Azure Key Vault without storing any credentials in the Function's configuration files. Which solution should you implement to satisfy this requirement with the least administrative effort?

Accepted Answer

Configure a system-assigned managed identity for the Azure Function.. Managing workload identities requires understanding how to minimize the attack surface by eliminating secrets. Using a system-assigned managed identity allows the Azure Function to authenticate directly to Key Vault without storing credentials in code or configuration. This approach reduces the risk of credential leakage and simplifies the development lifecycle by offloading credential management to Microsoft Entra ID.

Answer

Create a service principal and store the client secret in the Function app settings.

Answer

Use a shared access signature (SAS) token with a five-year expiration date.

Answer

Register a new application in Microsoft Entra ID and grant it Key Vault Secrets Officer permissions.

Question 16

Your company has a high-security requirement for its automated deployment pipelines. You must ensure that service principals used by these pipelines can only authenticate from specific corporate IP ranges. What should you configure?

Accepted Answer

A Conditional Access policy targeting 'Workload identities'.. Conditional Access for workload identities is a premium feature that extends security policies to non-human identities. By applying location-based restrictions to service principals, you ensure that even if a secret is compromised, the identity cannot be used by an attacker outside of the approved corporate network environment, significantly hardening the identity.

Answer

A Microsoft Entra ID Protection risk-based policy for users.

Answer

An Azure Virtual Network service endpoint for Microsoft Entra ID.

Answer

A Microsoft Entra security group containing the service principals.

Question 17

A developer is choosing between using a Managed Identity and a Service Principal with a client secret for a new application. Which TWO benefits are unique to using Managed Identities? (Choose two)

Accepted Answer

Managed identities do not require the developer to manage or rotate secrets.. Managed identities provide specific security and operational advantages that service principals with secrets lack. They eliminate the need for developers to handle sensitive credentials and automate the lifecycle management of the identity. Understanding these differences is crucial for implementing secure workload identities according to Microsoft best practices.

Answer

Managed identities can be used to access resources outside of Azure via SAML.

Answer

Managed identities support the use of client certificates for authentication.

Answer

Managed identities allow for the assignment of Application permissions to Microsoft Graph.

Question 18

Refer to the exhibit. You are configuring Workload Identity Federation for a GitHub Actions workflow. What is the purpose of the 'subject' field in this configuration?

Accepted Answer

It identifies the specific external workload that is authorized to use the federated identity.. Workload Identity Federation relies on trust relationships between Microsoft Entra ID and external identity providers. The 'subject' field is critical because it defines the specific criteria an external token must meet to be swapped for an Entra ID token. Correctly scoping this ensures only specific workflows can access Azure resources.

Answer

It specifies the display name of the service principal in the Entra ID tenant.

Answer

It defines the URL of the GitHub repository where the workflow is hosted.

Answer

It lists the Azure resources that the GitHub workflow is permitted to manage.

Question 19

You need to implement a process to periodically verify that service principals still require their assigned permissions to Microsoft Graph. What should you use to automate this process?

Accepted Answer

Microsoft Entra Access Reviews.. Access reviews are a core component of Identity Governance. While often used for human users, they can also be applied to service principals that have been assigned high-privilege roles or application permissions. This ensures that workload identities do not retain permissions indefinitely, supporting the principle of least privilege.

Answer

Microsoft Entra ID Protection alerts.

Answer

Azure Monitor Log Analytics alerts.

Answer

Privileged Identity Management (PIM) for groups.

Question 20

You are planning to migrate an application running on Azure Kubernetes Service (AKS) from using secret-based service principals to Azure AD Workload Identity. Which THREE steps are required to configure this? (Choose three)

Accepted Answer

Enable the OIDC Issuer on the AKS cluster.. Azure AD Workload Identity for Kubernetes uses a sidecar-less approach that relies on OIDC federation. Implementing this requires configuring the AKS cluster, the Microsoft Entra application, and the Kubernetes service account. Understanding the interaction between these components is essential for modern, secret-less Kubernetes security in Azure.

Answer

Create a Kubernetes Secret containing the client secret of the service principal.

Answer

Install the Azure Key Vault secrets provider add-on for AKS.