How many Select Two (Multi-Select) Questions questions are on this page?

This page has 6 Select Two (Multi-Select) Questions scenario questions for the SC-300 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SC-300 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Identity and Access Administrator Associate questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Microsoft Identity and Access Administrator Associate practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SC-300

exam code

Microsoft

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

You need to store specialized metadata for users in Microsoft Entra ID that is not available in the standard user profile attributes. This metadata must be accessible via the Microsoft Graph API and must support fine-grained access control so only specific administrators can read or write the data. Which THREE steps are required to implement Custom Security Attributes?

A
Assign the Attribute Definition Administrator role
To create and manage the structure of custom security attributes, a user must have the Attribute Definition Administrator role. This role is distinct from Global Administrator, ensuring that attribute schema management is a delegated, specific task that follows the principle of least privilege within the Microsoft Entra ID environment.
B
Configure a new Schema Extension using the Azure AD Graph API
Why wrong: The Azure AD Graph API is deprecated and does not support the modern Custom Security Attributes feature. Furthermore, Schema Extensions are a different technology used for application-specific data and do not provide the built-in RBAC and administrative separation that is characteristic of the Custom Security Attributes management framework.
C
Define an Attribute Set
An Attribute Set is a mandatory grouping for custom security attributes. It serves as the container for related attributes and, more importantly, provides the boundary for assigning permissions. You cannot create an individual attribute without first defining the set it belongs to, which organizes the metadata logically.
D
Create a new Directory Extension in Microsoft Entra Connect
Why wrong: Directory extensions in Microsoft Entra Connect are used to sync custom attributes from an on-premises Active Directory to the cloud. While they extend the schema, they do not support the advanced RBAC features of Custom Security Attributes and are managed through the sync engine rather than the cloud-native attribute UI.
E
Add Attribute Definitions to the Attribute Set
After creating the set, you must define the specific attributes (definitions) that will store the data. This includes naming the attribute and selecting its data type (e.g., Boolean, Integer, or String). This step establishes the actual fields that will be available on the user objects for data entry.

Full breakdown with real-world context →

Question 2mediummulti select

Full question →

A company wants to implement advanced identity management features for their users. You are evaluating the differences between Microsoft Entra ID P1 and P2 licenses. Which TWO features are ONLY available with the Microsoft Entra ID P2 license?

A
Self-Service Password Reset (SSPR) for cloud users
Why wrong: Self-Service Password Reset for cloud-only users is available in the Free tier of Microsoft Entra ID. The P1 license adds the ability to write back passwords to on-premises Active Directory, but the basic functionality for cloud users does not require a P2 license for implementation in the tenant.
B
Conditional Access based on user location and device state
Why wrong: Conditional Access is a core feature of the Microsoft Entra ID P1 license. It allows administrators to create policies that evaluate signals like IP address, geographical location, and device compliance. While P2 adds risk-based signals, the base Conditional Access engine is fully functional within the P1 licensing tier.
C
Microsoft Entra ID Protection (Risk-based Conditional Access)
Identity Protection, which includes the ability to trigger policies based on 'User Risk' and 'Sign-in Risk' levels (High, Medium, Low), is a premium feature exclusive to the P2 license. It uses machine learning to detect compromised credentials and anomalous sign-in patterns to automatically protect the organization's identities.
D
Application Proxy for accessing on-premises web applications
Why wrong: The Application Proxy feature, which provides secure remote access to on-premises web applications without a VPN, is included in the Microsoft Entra ID P1 license. It is a powerful tool for hybrid environments, but it does not require the additional investment of a P2 license for deployment.
E
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is a P2-exclusive feature that allows for 'just-in-time' administrative access. It minimizes the risk of standing privileges by requiring administrators to request and justify the activation of their roles, often requiring MFA or approval before permissions are temporarily granted to their account.

Full breakdown with real-world context →

Question 3mediummulti select

Full question →

You are managing guest users in Microsoft Entra ID. Which TWO statements accurately describe the properties and behaviors of guest user accounts compared to member user accounts?

A
Guest users have the 'UserType' attribute set to 'Guest' by default.
The 'UserType' attribute is the primary way Microsoft Entra ID distinguishes between internal members and external guests. By default, any user invited through the B2B collaboration process is assigned the 'Guest' value, which triggers different default permission levels and access behaviors within the tenant.
B
Guest users always authenticate against the inviting tenant's identity provider.
Why wrong: Guest users actually authenticate against their own home identity provider, such as their organization's Entra ID, a Google account, or a personal Microsoft account. The inviting tenant simply trusts the authentication token provided by the home tenant, which is the core principle of B2B federation.
C
Guest users can be converted to members by changing their 'UserType' attribute.
An administrator can manually change the 'UserType' of a guest from 'Guest' to 'Member' using PowerShell or the Graph API. This is often done for long-term contractors who need the same directory visibility as regular employees while still authenticating with their original external credentials.
D
Guest users are automatically added to the 'All Users' dynamic group.
Why wrong: Whether a guest is included in an 'All Users' group depends entirely on how the dynamic membership rule for that group is written. If the rule is simply 'user.objectId -ne null', guests will be included; however, many organizations exclude guests by adding a 'user.userType -eq "Member"' condition.
E
Guest users cannot be assigned to Administrative Units.
Why wrong: Guest users can indeed be members of Administrative Units, allowing them to be managed by regional or departmental helpdesk administrators. This is useful in scenarios where external consultants are integrated into specific project teams that require delegated administrative oversight within a defined scope.

Full breakdown with real-world context →

Question 4hardmulti select

Full question →

You are configuring External Collaboration settings in Microsoft Entra ID. You want to ensure that only specific partner domains can be invited as guests, and that guest users have the most restricted access to the directory. Which THREE settings should you configure?

A
Set 'Guest user access is restricted to properties and memberships of their own directory objects'.
This setting provides the highest level of restriction for guest users, preventing them from searching the directory or viewing memberships of groups they do not belong to. It ensures that guests only see information relevant to their own account, significantly reducing the risk of internal directory harvesting.
B
Enable 'Allow invitations only to the specified domains (most restrictive)'.
By implementing an allowlist for domains, you ensure that employees can only invite guests from approved partner organizations. This prevents users from inviting individuals from personal email providers or unverified third parties, maintaining a strict boundary on who can enter the corporate identity environment.
C
Set 'Guest invite restrictions' to 'Only users assigned to specific admin roles can invite guest users'.
Restricting invitation capabilities to specific administrative roles ensures that guest creation is a controlled process. This prevents standard users from independently inviting external parties, ensuring that all guest accounts are vetted or created according to the organization's formal identity lifecycle and governance policies.
D
Disable the 'External user' account type in the User Settings blade.
Why wrong: There is no single toggle to 'disable' the external user account type in the User Settings blade that would achieve the desired restrictions. Managing external access is done through the External Collaboration settings and Cross-tenant access policies rather than a global account type disablement in user settings.
E
Enable 'Self-service sign-up via user flows' for all external users.
Why wrong: Enabling self-service sign-up is the opposite of a restrictive policy, as it allows external users to join the tenant without a direct invitation from an administrator. This is typically used for B2C scenarios or broad B2B applications and would undermine the goal of limiting access to specific partners.

Full breakdown with real-world context →

Question 5mediummulti select

Full question →

You want to allow external users to sign in to your Microsoft Entra tenant using their Google accounts. Which TWO steps are required to configure Google federation?

A
Create a Google Cloud Platform project and obtain a Client ID and Client Secret.
To enable federation, you must register your Entra ID tenant as an application within the Google Developers Console. This process generates the necessary OAuth 2.0 credentials (Client ID and Secret) that Entra ID uses to communicate with Google's identity services and verify the identity of the signing-in user.
B
Enable the 'Email one-time passcode for guests' setting in the Entra admin center.
Why wrong: Email one-time passcode (OTP) is a fallback mechanism for guests who do not have a Microsoft or federated account. While it is a useful feature for general B2B collaboration, it is distinct from Google federation and is not a prerequisite for setting up a dedicated social identity provider.
C
Configure Google as an identity provider in the 'External Identities' section of Entra ID.
Once you have the credentials from Google, you must input them into the Entra ID configuration. This step establishes the trust relationship and tells Entra ID to offer the 'Google' sign-in option to invited guest users whose email addresses correspond to the Google identity domain.
D
Assign a Microsoft Entra ID P2 license to every Google user who will sign in.
Why wrong: Licensing for external users is based on the Monthly Active Users (MAU) model, where the first 50,000 guests are typically free. You do not need to assign individual P2 licenses to every guest; the tenant's features (like MFA) are extended to guests based on the tenant's own licensing level.
E
Configure a custom domain in Entra ID that matches the @gmail.com suffix.
Why wrong: You cannot add '@gmail.com' as a custom domain in your Entra ID tenant because you do not own the DNS for it. Federation works by redirecting the user to Google for authentication, and it does not require the external domain to be verified or added to your own tenant's domain list.

Full breakdown with real-world context →

Question 6hardmulti select

Full question →

You need to configure B2B collaboration settings in Microsoft Entra ID to restrict external access. The solution must meet the following requirements: 1. Allow users to invite guests only from the domain 'fabrikam.com'. 2. Prevent guests from searching the directory for other users. Which TWO settings should you configure?

A
Set External user read permissions to 'Guest users are limited to properties and memberships of their own directory objects'.
This setting is the most restrictive level of directory visibility for external users in Entra ID. It prevents guests from browsing the full list of users, groups, or other directory objects, effectively isolating them to only the specific resources and profiles they are directly associated with for work.
B
Add 'fabrikam.com' to the Collaboration restrictions list and set the policy to 'Allow invitations only to the specified domains'.
Setting the collaboration restriction to an allow-list effectively blocks invitations to any domain not explicitly mentioned. This is a robust security measure that ensures users can only collaborate with approved partner organizations, preventing the accidental or malicious invitation of unauthorized personal or competitor email addresses to the tenant.
C
Configure a Cross-tenant access policy for 'fabrikam.com' with B2B direct connect enabled.
Why wrong: B2B direct connect is specifically designed for mutual collaboration in Teams Shared Channels and does not govern standard B2B guest invitations. While it facilitates collaboration, it does not address the requirement to restrict the search capabilities of guest users who are invited via the standard B2B flow.
D
Enable the 'Member users and users assigned to specific admin roles can invite guest users' setting.
Why wrong: This setting controls who inside your organization has the permission to initiate a guest invitation, but it does not restrict which external domains can be invited. It focuses on internal delegation of authority rather than the external domain filtering or directory visibility requirements specified in the scenario.
E
Create a Conditional Access policy that blocks all external users except those from 'fabrikam.com'.
Why wrong: Conditional Access policies evaluate signals at the time of sign-in but do not prevent the initial invitation or limit directory search behavior. While it can block access to applications, it is not the correct mechanism for managing invitation domain restrictions or the default directory-level permissions for guests.

Full breakdown with real-world context →

Study guide

SC-300 study guide

Read the full exam guide to reinforce the concepts behind these scenario questions.

Read now

Exam simulator

Take a full practice exam

75–120 questions · 120-min timer · PBQs first · Pearson VUE–style score (300–1000)

Start exam

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Implement and Manage User Identities Implement Authentication and Access Management Plan and Implement Workload Identities Plan and Automate Identity Governance

Practice by scenario

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Implement and Manage User Identities practice questions Implement Authentication and Access Management practice questions Plan and Implement Workload Identities practice questions Plan and Automate Identity Governance practice questions SC-300 fundamentals practice questions SC-300 scenario practice questions SC-300 troubleshooting practice questions

Common exam traps

•Answering from memory before reading the full scenario.
•Missing a constraint such as cost, availability, security, scope or command context.
•Choosing a broad answer when the question asks for the most specific fix.
•Ignoring why the wrong options are tempting.

Where to go next

Microsoft Identity and Access Administrator Associate exam guide All SC-300 questions All practice sets

These SC-300 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style SC-300 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related SC-300 topic practice pages

Implement and Manage User Identities practice questions

Implement Authentication and Access Management practice questions

Plan and Implement Workload Identities practice questions

Plan and Automate Identity Governance practice questions

SC-300 fundamentals practice questions

SC-300 scenario practice questions

SC-300 troubleshooting practice questions

Practice scenarios

A company wants to implement advanced identity management features for their users. You are evaluating the differences between Microsoft Entra ID P1 and P2 licenses. Which TWO features are ONLY available with the Microsoft Entra ID P2 license?

You are managing guest users in Microsoft Entra ID. Which TWO statements accurately describe the properties and behaviors of guest user accounts compared to member user accounts?

You are configuring External Collaboration settings in Microsoft Entra ID. You want to ensure that only specific partner domains can be invited as guests, and that guest users have the most restricted access to the directory. Which THREE settings should you configure?

You want to allow external users to sign in to your Microsoft Entra tenant using their Google accounts. Which TWO steps are required to configure Google federation?