SC-300 Plan and Implement Workload Identities Practice Test 2 — 15 Questions

Question 1

Your company has a high-security requirement for its automated deployment pipelines. You must ensure that service principals used by these pipelines can only authenticate from specific corporate IP ranges. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Conditional Access policy targeting 'Workload identities'.. Conditional Access for workload identities is a premium feature that extends security policies to non-human identities. By applying location-based restrictions to service principals, you ensure that even if a secret is compromised, the identity cannot be used by an attacker outside of the approved corporate network environment, significantly hardening the identity.

Answer

A Microsoft Entra ID Protection risk-based policy for users.

Answer

An Azure Virtual Network service endpoint for Microsoft Entra ID.

Answer

A Microsoft Entra security group containing the service principals.

Question 2

A developer is choosing between using a Managed Identity and a Service Principal with a client secret for a new application. Which TWO benefits are unique to using Managed Identities? (Choose two)

Accepted Answer

Managed identities do not require the developer to manage or rotate secrets.. Managed identities provide specific security and operational advantages that service principals with secrets lack. They eliminate the need for developers to handle sensitive credentials and automate the lifecycle management of the identity. Understanding these differences is crucial for implementing secure workload identities according to Microsoft best practices.

Answer

Managed identities can be used to access resources outside of Azure via SAML.

Answer

Managed identities support the use of client certificates for authentication.

Answer

Managed identities allow for the assignment of Application permissions to Microsoft Graph.

Question 3

Refer to the exhibit. You are configuring Workload Identity Federation for a GitHub Actions workflow. What is the purpose of the 'subject' field in this configuration?

Accepted Answer

It identifies the specific external workload that is authorized to use the federated identity.. Workload Identity Federation relies on trust relationships between Microsoft Entra ID and external identity providers. The 'subject' field is critical because it defines the specific criteria an external token must meet to be swapped for an Entra ID token. Correctly scoping this ensures only specific workflows can access Azure resources.

Answer

It specifies the display name of the service principal in the Entra ID tenant.

Answer

It defines the URL of the GitHub repository where the workflow is hosted.

Answer

It lists the Azure resources that the GitHub workflow is permitted to manage.

Question 4

You need to implement a process to periodically verify that service principals still require their assigned permissions to Microsoft Graph. What should you use to automate this process?

Accepted Answer

Microsoft Entra Access Reviews.. Access reviews are a core component of Identity Governance. While often used for human users, they can also be applied to service principals that have been assigned high-privilege roles or application permissions. This ensures that workload identities do not retain permissions indefinitely, supporting the principle of least privilege.

Answer

Microsoft Entra ID Protection alerts.

Answer

Azure Monitor Log Analytics alerts.

Answer

Privileged Identity Management (PIM) for groups.

Question 5

You are planning to migrate an application running on Azure Kubernetes Service (AKS) from using secret-based service principals to Azure AD Workload Identity. Which THREE steps are required to configure this? (Choose three)

Accepted Answer

Enable the OIDC Issuer on the AKS cluster.. Azure AD Workload Identity for Kubernetes uses a sidecar-less approach that relies on OIDC federation. Implementing this requires configuring the AKS cluster, the Microsoft Entra application, and the Kubernetes service account. Understanding the interaction between these components is essential for modern, secret-less Kubernetes security in Azure.

Answer

Create a Kubernetes Secret containing the client secret of the service principal.

Answer

Install the Azure Key Vault secrets provider add-on for AKS.

Question 6

You have an application that runs on multiple Azure Virtual Machines. You want to use a single managed identity for all these VMs to access a shared database. Which type of identity should you use?

Accepted Answer

User-assigned managed identity.. Choosing between system-assigned and user-assigned managed identities depends on the scale and lifecycle requirements of the application. User-assigned identities are standalone resources that can be associated with multiple Azure resources, making them ideal for applications distributed across several virtual machines or services.

Answer

System-assigned managed identity.

Answer

Service principal with a certificate.

Answer

Azure AD Application Proxy.

Question 7

Refer to the exhibit. An administrator runs the command shown. What is the result of this command regarding workload identity management?

Accepted Answer

It creates a service principal and assigns it a password-based secret by default.. The 'az ad sp create-for-rbac' command is a common way to create a service principal and assign it permissions in one step. Understanding the output and the impact on security (such as the default creation of a password) is essential for administrators who must secure these identities later.

Answer

It creates a system-assigned managed identity for a resource named 'myApp'.

Answer

It creates a service principal that can only be used with certificate-based authentication.

Answer

It grants the service principal access to the entire Microsoft Entra tenant.

Question 8

You are using Microsoft Entra ID Protection to secure workload identities. Which TWO types of risk detections are specifically available for service principals with a Workload ID Premium license? (Choose two)

Accepted Answer

Leaked credentials for the service principal.. Microsoft Entra ID Protection for workload identities provides specialized risk detection that differs from human user risk. These detections focus on patterns indicative of compromised service accounts or misused credentials. Knowing these specific detections helps administrators respond to threats targeting automated systems.

Answer

Atypical travel for the service principal.

Answer

Malware linked IP address for the user.

Answer

Browser-based man-in-the-middle attacks.

Question 9

An application requires the 'User.Read.All' permission to Microsoft Graph to sync user data. You want to ensure the application can only read data and not modify it. Which type of permission should you assign?

Accepted Answer

Application permission with administrative consent.. Understanding the difference between Application permissions and Delegated permissions is fundamental for SC-300. Application permissions allow a service to run without a signed-in user, which is typical for background services or daemons, while Delegated permissions act on behalf of a user.

Answer

Delegated permission with administrative consent.

Answer

Managed identity with the Global Reader role.

Answer

Service principal with the 'User.ReadWrite.All' permission.

Question 10

You are configuring Workload Identity Federation for an application hosted on an on-premises Kubernetes cluster. What is the primary benefit of this configuration over using a standard service principal with a secret?

Accepted Answer

It eliminates the need to store and rotate Azure secrets in the on-premises cluster.. Workload Identity Federation allows external workloads to access Azure resources without needing to manage secrets in the external environment. This is a significant security improvement for hybrid and multi-cloud scenarios, as it leverages the identity provider of the external platform to establish trust with Microsoft Entra ID.

Answer

It allows the on-premises cluster to bypass Microsoft Entra authentication entirely.

Answer

It automatically synchronizes on-premises service accounts to Microsoft Entra ID.

Answer

It provides a faster network connection between on-premises and Azure services.

Question 11

You delete an Azure Logic App that was configured with a system-assigned managed identity. What happens to the managed identity in Microsoft Entra ID?

Accepted Answer

The identity is automatically deleted from Microsoft Entra ID.. The lifecycle management of system-assigned managed identities is one of their primary administrative benefits. Unlike service principals or user-assigned identities, they do not require manual cleanup, which helps maintain a clean and secure identity environment by preventing the existence of orphaned identities.

Answer

The identity remains in the tenant and must be manually deleted.

Answer

The identity is disabled for 30 days before being permanently deleted.

Answer

The identity is converted into a standard service principal.

Question 12

Refer to the exhibit. Which scenario describes the effect of this Conditional Access policy configuration?

Accepted Answer

It blocks the specified service principal from accessing all Office 365 services.. The JSON exhibit shows a Conditional Access policy targeting a specific service principal. This is part of the Workload ID Premium features. Understanding how to read these policies is vital for administrators to ensure that security controls are being applied to the correct identities and resources.

Answer

It requires multi-factor authentication for the specified service principal.

Answer

It restricts the service principal to only being able to sign in from managed devices.

Answer

It allows the service principal access to Office 365 only if the risk level is low.

Question 13

You are managing several service principals that use client secrets for authentication. Which TWO actions represent security best practices for managing these secrets? (Choose two)

Accepted Answer

Rotate secrets regularly and immediately after any suspected compromise.. When managed identities cannot be used, securing service principal secrets is critical. Best practices focus on reducing the lifespan of secrets and ensuring they are not exposed. This minimizes the impact of a potential credential compromise and aligns with the Zero Trust security model.

Answer

Set secret expiration to the maximum allowed (99 years) to prevent service outages.

Answer

Store the client secrets in a public GitHub repository for easy developer access.

Answer

Share a single client secret across multiple different service principals.

Question 14

You are configuring a Managed Identity for an Azure Virtual Machine. You need to ensure that the identity can access an Azure Key Vault secret. What is the most secure way to grant this access while adhering to the principle of least privilege?

Accepted Answer

Assign the Key Vault Secrets User role to the Managed Identity at the Key Vault scope.. Using Azure RBAC for Key Vault data plane access is the recommended approach for managing managed identities. By assigning a specific role like 'Key Vault Secrets User' at the scope of the individual secret or the vault itself, you restrict permissions to only what is necessary, effectively preventing unauthorized access and reducing the attack surface compared to legacy access policies which lack granular control.

Answer

Assign the Contributor role to the Managed Identity at the subscription scope.

Answer

Add the Managed Identity to the Key Vault access policies.

Answer

Store the Client ID and Client Secret in the application configuration file.

Question 15

Refer to the exhibit. You are configuring Workload Identity Federation for a GitHub Action to access Azure resources. Based on the provided token claims, what is the correct subject identifier format for the federation credential?

Accepted Answer

repo:organization/repository:environment:production. Workload Identity Federation requires specific subject (sub) identifiers that map the federated identity provider to the Azure AD application. The format 'repo:organization/repository:environment:production' correctly maps a GitHub environment to the Azure service principal. This configuration ensures that only the authorized CI/CD pipeline can exchange its GitHub token for an Azure AD access token, preventing unauthorized access from other repositories or environments.

Answer

repo:organization/repository:ref:refs/heads/main

Answer

app:organization/repository:environment:production

Answer

organization/repository:environment:production