SC-300 Implement and Manage User Identities Practice Question
Exhibit
{
"id": "8d88-f2-4e-9b",
"status": "enabled",
"operations": [
{
"action": "Microsoft.Directory/customSecurityAttributes/values/read",
"scope": "/"
}
],
"roleDefinitionId": "9b8f-4e-8d-8d88"
}Refer to the exhibit. You are reviewing a custom role definition intended for a security auditor. What is the specific effect of the permission defined in the 'operations' array?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role can read the actual values of custom security attributes assigned to users and other directory objects.
Custom security attributes in Microsoft Entra ID allow for the storage of sensitive metadata that is not visible to standard users or even Global Administrators by default. Understanding the specific RBAC actions required to read or write these attributes is essential for maintaining a secure environment where sensitive data like 'Salary Grade' or 'Clearance Level' is protected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The role can view the definitions and allowed values of all custom security attributes in the tenant.
Why it's wrong here
The permission for viewing definitions is 'Microsoft.Directory/customSecurityAttributes/definitions/read'. The permission in the exhibit specifically targets the 'values' of the attributes assigned to objects, not the administrative structure or the configuration of the attribute sets themselves, which requires a different set of directory-level permissions.
- ✓
The role can read the actual values of custom security attributes assigned to users and other directory objects.
Why this is correct
The 'values/read' action is the specific permission required to see the data stored within custom security attributes on Entra ID objects. Without this explicit permission, even users with high-level roles like Security Reader or Global Reader cannot see these sensitive fields, ensuring strict data privacy and access control.
- ✗
The role can assign new custom security attribute values to users but cannot modify existing ones.
Why it's wrong here
Assignment or modification of attribute values requires the 'values/write' permission. A 'read' operation is strictly limited to viewing existing data and does not grant any authority to create, update, or delete the information stored within those custom attributes, maintaining the integrity of the sensitive metadata.
- ✗
The role can only read custom security attributes if they are also a member of the Attribute Definition Administrator role.
Why it's wrong here
RBAC in Microsoft Entra ID is additive; having this specific permission in a custom role is sufficient to read values without needing membership in other built-in roles. The Attribute Definition Administrator role is actually focused on managing the schema rather than viewing the values assigned to specific users.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every SC-300 question from scratch — 17 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-300 exam.