SC-300 Implement and Manage User Identities Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  (user.department -eq "Marketing") -and (user.city -in ["London", "Paris"])

  Why this is correct

  The '-in' operator is the most efficient way to match a property against a specific list of multiple values within Entra ID dynamic membership rules. Combining this with the '-and' operator ensures that only users who meet both the department and city criteria are included in the group.

• ✗

  (user.department -match "Marketing") -or (user.city -eq "London") -or (user.city -eq "Paris")

  Why it's wrong here

  Using the '-or' operator between the department and city attributes would incorrectly include every person in London or Paris, regardless of their department. Additionally, the '-match' operator is generally used for regex patterns and is less performant than the standard equality operator for simple string comparisons.

• ✗

  user.department -eq "Marketing" -and user.city -eq "London" -and user.city -eq "Paris"

  Why it's wrong here

  This rule logic is flawed because a single user's city attribute cannot be both 'London' and 'Paris' simultaneously. The query would return zero results because the conditions are mutually exclusive, demonstrating why logical grouping and the correct selection of operators are vital for functional dynamic group rules.

• ✗

  user.department -contains "Marketing" -and user.city -contains "London, Paris"

  Why it's wrong here

  The '-contains' operator is intended for multi-value collection properties, such as group memberships, rather than single-string attributes like department or city. Furthermore, passing a comma-separated string to this operator will not search for individual cities, resulting in a failed rule that does not populate members.