SC-300 Plan and Implement Workload Identities Practice Test 3 — 15 Questions

Question 1

Your company uses Azure Kubernetes Service (AKS). You want to implement workload identity to allow pods to access Azure resources without using static credentials. Which TWO steps must you perform to enable this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the OIDC issuer and workload identity on the existing AKS cluster.. To enable AKS workload identity, you must first enable the OIDC issuer and workload identity features on the AKS cluster. Once the cluster is prepared, you must create a managed identity and establish a federated identity credential that maps the Kubernetes Service Account to the Azure Managed Identity. These steps create the trust relationship necessary for pods to safely authenticate to Azure services using short-lived tokens.

Answer

Install the Azure AD Connect tool on every worker node in the cluster.

Answer

Generate a client secret for the Managed Identity and inject it as a Kubernetes Secret.

Answer

Assign the Global Administrator role to the AKS cluster service principal.

Question 2

Which type of identity should you use for an application running on an Azure Virtual Machine that needs to access Azure Storage without managing credentials?

Accepted Answer

System-assigned managed identity.. User-assigned or system-assigned managed identities are the industry standard for Azure VMs. They provide an identity in Azure AD that applications can use to authenticate to any service that supports AD authentication, such as Azure Storage. This approach removes the need to store sensitive credentials in code or configuration, significantly improving the security posture of the application and simplifying secret management.

Answer

Service Principal with a certificate.

Answer

Shared Access Signature (SAS) token.

Answer

Azure AD User account.

Question 3

What is the primary difference between a system-assigned and a user-assigned managed identity?

Accepted Answer

User-assigned identities can be shared across multiple Azure resources.. The primary distinction lies in their lifecycle and reusability. A system-assigned identity is bound to a single Azure resource and is deleted when that resource is removed. Conversely, a user-assigned identity is created as a standalone Azure resource, allowing it to be shared across multiple resources, such as several virtual machines or function apps, offering more flexibility for complex architectural patterns.

Answer

System-assigned identities support more Azure services than user-assigned identities.

Answer

System-assigned identities are standalone resources, while user-assigned are not.

Answer

System-assigned identities require manual secret rotation.

Question 4

Refer to the exhibit. You executed the command above to create a service principal for an application. What is a significant security risk associated with using the output of this command in a production environment?

Accepted Answer

The command grants excessive permissions and displays the client secret in plain text.. The command creates a service principal with the 'Contributor' role at the subscription level, which is overly permissive. Furthermore, the command output typically includes the client secret in plaintext. Storing this secret insecurely or using a broadly scoped service principal violates the principle of least privilege, exposing the entire subscription to potential compromise if the secret is leaked from the application configuration.

Answer

The service principal is not automatically deleted when the VM is shut down.

Answer

The command fails to create a federated identity credential.

Answer

The service principal name is not unique across the entire Azure platform.

Question 5

Which THREE conditions must be met to use Workload Identity Federation with a third-party identity provider like GitHub or GitLab?

Accepted Answer

The third-party provider must support OIDC token issuance.. To use Workload Identity Federation, you must establish a trust relationship by configuring a federated identity credential on the Azure AD application. This requires that the external provider issues OIDC-compliant tokens and that you accurately map claims like 'sub', 'aud', and 'iss' from the external token to your Azure application. This process ensures that Azure trusts the external tokens and maps them to the correct service principal.

Answer

The external identity must have an Azure AD Global Administrator role.

Answer

The Azure AD application must have a client secret configured.

Question 6

You are managing access to an Azure SQL Database using a user-assigned managed identity. The database is in a different subscription than the managed identity. What is the correct way to grant access?

Accepted Answer

Create a database user for the identity using the 'CREATE USER' command in SQL.. Cross-subscription access for managed identities is fully supported. You must add the managed identity as a user in the Azure SQL Database using the 'CREATE USER' SQL command, specifying the name of the managed identity. This maps the Azure AD identity to a database-level user, allowing the database engine to authorize connections based on the identity's token, regardless of which subscription the identity belongs to.

Answer

You cannot use managed identities across different subscriptions.

Answer

Create a service principal secret and use SQL authentication.

Answer

Assign the identity the 'Owner' role on the target subscription.

Question 7

Which Azure AD feature allows you to restrict the usage of a Managed Identity to specific environments or conditions?

Accepted Answer

Azure AD Conditional Access policies.. Conditional Access policies are the primary mechanism for enforcing access constraints. While managed identities typically bypass interactive MFA, they are subject to Conditional Access policies that can evaluate risks or enforce specific network locations. This ensures that even machine identities are governed by the organization's security posture, preventing them from being used in unauthorized or high-risk contexts that deviate from established operational baselines.

Answer

Azure AD Privileged Identity Management (PIM).

Answer

Managed Identity Lifecycle Policies.

Answer

Azure AD Identity Protection.

Question 8

When migrating an application from on-premises to Azure, you want to use Workload Identity Federation to access Azure resources. Which of the following is required for the on-premises application?

Accepted Answer

An OIDC-compliant token provider.. Workload Identity Federation requires that the identity providing the token supports OIDC and can reach the Azure AD issuer endpoint. For on-premises apps, this usually involves a trusted OIDC provider or a custom configuration that mimics the requirements of federation. The key is ensuring that the app can request a token from a trusted authority that Azure can then validate against the federated identity credential.

Answer

An Azure AD Connect synchronization server.

Answer

A client secret stored in the application environment.

Answer

A hardcoded Azure AD Tenant ID in the application code.

Question 9

Refer to the exhibit. An application using a service principal is failing to authenticate with the error shown. What is the most likely cause?

Accepted Answer

The client secret used by the application is invalid or expired.. This error specifically indicates that the client secret being used by the application has expired, is incorrect, or has been revoked. In the context of service principals, this is the most common failure point. To resolve this, you must generate a new secret in the Azure portal, update the application configuration, and ensure the change is propagated, which might take several minutes in some scenarios.

Answer

The service principal has been deleted from Azure AD.

Answer

The application lacks RBAC permissions to access the resource.

Answer

The user is required to perform Multi-Factor Authentication.

Question 10

Which of the following describes the correct process to rotate a client secret for a service principal?

Accepted Answer

Add a new secret, update the application, then remove the old secret.. To rotate a secret without downtime, you must add a new secret to the application, update the application code to use the new secret while keeping the old one temporarily valid, and then remove the old secret once the application is successfully using the new one. This phased approach, often called 'secret rollover', ensures that the application remains functional throughout the transition period, preventing authentication failures.

Answer

Delete the existing secret and generate a new one immediately.

Answer

Change the service principal display name in the portal.

Answer

Restart the Azure Virtual Machine hosting the application.

Question 11

You are implementing Workload Identity Federation for an application. Which TWO of the following are true regarding the trust relationship?

Accepted Answer

The subject identifier must be unique for each environment or workload.. The trust relationship is defined by the Federated Identity Credential, which links an external issuer to an Azure AD application. You must define the 'subject' claim, which acts as a unique identifier for the workload. This configuration allows Azure AD to trust tokens signed by the external provider, provided the claims match, thus enabling a passwordless authentication flow between the external CI/CD environment and Azure.

Answer

The trust is established at the tenant level for all applications.

Answer

The Azure AD application must be configured to use a certificate for trust.

Answer

The issuer URL can be any arbitrary string defined by the user.

Question 12

Which Azure feature is used to audit the usage of managed identities and service principals to detect suspicious activity?

Accepted Answer

Azure Monitor Log Analytics.. Azure AD Sign-in logs and Audit logs are the primary tools for monitoring identity usage. They provide detailed information about who (or what) accessed which resource, at what time, and from where. By configuring these logs to export to a Log Analytics workspace, you can create alerts for anomalous behavior, such as a service principal accessing resources outside of normal operational patterns, enabling quick incident response and security auditing.

Answer

Azure Advisor.

Answer

Azure Policy.

Answer

Azure Cost Management.

Question 13

An organization has an Azure Function app that needs to access secrets in Azure Key Vault. The developers want to avoid manual secret management for the application itself. What should be implemented to ensure the highest security while minimizing administrative overhead for secret rotation?

Accepted Answer

System-assigned managed identity. Managed identities eliminate the need for developers to manage credentials manually. By using a system-assigned identity, the identity is tied directly to the lifecycle of the Azure resource. This ensures that when the resource is deleted, the identity is also removed, providing a secure and automated way to handle authentication to services like Key Vault.

Answer

User-assigned managed identity

Answer

Service Principal with a client secret

Answer

Application Registration with a certificate

Question 14

A company uses a service principal for an automation script running on-premises. Security policy requires that the credentials for this service principal be rotated every 30 days. Which solution provides the most secure method for managing these credentials without requiring manual updates to the script's configuration?

Accepted Answer

Use Azure Key Vault with certificate-based authentication.. Rotating secrets for service principals is a critical security task. Using Azure Key Vault with certificates allows the automation script to authenticate securely without storing hardcoded secrets. This approach ensures that even if the script environment is compromised, the credential itself is managed within a secure vault and rotated according to policy requirements.

Answer

Store a client secret in a local environment variable.

Answer

Use a Managed Identity on the on-premises server.

Answer

Implement a Personal Access Token with auto-renewal.

Question 15

You are configuring Workload Identity Federation for a GitHub Actions workflow to deploy resources to Azure. Which TWO components are required to establish the trust relationship between GitHub and Microsoft Entra ID?

Accepted Answer

A Federated Identity Credential.. Workload Identity Federation allows you to trust an external identity provider like GitHub. To set this up, you must have an identity in Entra ID (Application or Managed Identity) and a Federated Identity Credential. This credential defines the trust by specifying the issuer and subject identifiers provided by the GitHub OIDC token.

Answer

A client secret with a 24-month expiration.

Answer

A Microsoft Entra ID P2 license for every developer.

Answer

An Azure Key Vault Access Policy.