Free SC-300 Practice Questions

Question 1

A payroll sign-in matches three Conditional Access policies:

Access-1: On; require either multifactor authentication OR a compliant device.
Access-2: On; require a Microsoft Entra hybrid joined device.
Access-3: Report-only; block access.

The employee has completed MFA. The device is hybrid joined but is not compliant, and its device identity is available during policy evaluation. Application assignment is valid, and no other policy applies. How should this request be evaluated?

Accepted Answer

Allow access: both enforced policies are satisfied; the report-only block is not enforced.

Answer

Block access: the block control in Access-3 takes precedence over the two grant policies.

Answer

Allow access: satisfying Access-1 makes evaluation of the other matching policies unnecessary.

Answer

Block access: the noncompliant device fails Access-1 even though the employee has completed MFA.

Question 2

A regional support technician has User Administrator scoped only to the North administrative unit. That unit contains the North-Staff security group, but none of its user objects. The technician can change the group description but cannot update the department of a nonadministrator who belongs to the group. The user is cloud-only. What change restores the intended regional delegation without granting tenant-wide authority?

Accepted Answer

Add the North-Staff user objects directly to the North administrative unit.

Answer

Make the support technician an owner of the North-Staff security group.

Answer

Assign User Administrator to the technician at tenant scope for regional support.

Answer

Add the support technician as a member of the North administrative unit.

Question 3

An Azure workload runs on virtual machines that are deleted and recreated during deployments. Every replacement must use the same preauthorized identity. The application reads blobs from one container through Microsoft Entra authentication; it must not write blobs or manage the storage account. No application-managed secrets or certificates are permitted. Which identity and role assignment meet all of these requirements?

Accepted Answer

A user-assigned managed identity with Storage Blob Data Reader scoped to the container.

Answer

A user-assigned managed identity with Storage Blob Data Contributor scoped to the container.

Answer

A system-assigned managed identity with Storage Blob Data Reader scoped to the container.

Answer

A user-assigned managed identity with Reader scoped to the storage account.

Question 4

An access review denies a consultant's membership in a cloud-managed, assigned-membership group used by a procurement application. The review shows Result applied, and the consultant is no longer a group member. Nevertheless, a fresh sign-in still reaches the application. Its enterprise application has Assignment required set to Yes; the consultant's only assignment paths were that group and a separate direct assignment. The consultant must retain access to unrelated projects. Select the targeted correction.

Accepted Answer

Remove the consultant's direct assignment to the procurement enterprise application.

Answer

Revoke the consultant's sign-in sessions without changing application assignments.

Answer

Hide the application's tile in the consultant's My Apps view.

Answer

Block the consultant's account in Microsoft Entra ID while retaining the application assignments.

Question 5

Microsoft Entra ID Protection reports High user risk for a cloud-only employee after a leaked-credentials detection. The employee's latest sign-in is Low risk and successfully completes MFA. The password has not been changed. The organization wants registered users to remediate this type of account risk during access rather than wait for an administrator to unblock them. Which Conditional Access configuration addresses the unresolved risk?

Accepted Answer

Target High user risk and select Require risk remediation.

Answer

Target High user risk and block access until an administrator clears the risk.

Answer

Target High user risk and require MFA without requiring password remediation.

Answer

Require MFA for Medium- or High-risk sign-ins.

Question 6

An organization uses pass-through authentication with password hash synchronization already enabled. During disaster-recovery planning, the team models an outage in which no authentication agent can reach AD DS, while Entra ID remains available. Which proposed recovery assumption should be rejected?

Accepted Answer

Password hash synchronization would automatically take over when pass-through authentication became unavailable.

Answer

Password hash synchronization could be enabled alongside pass-through authentication before an outage.

Answer

Cloud-only users could authenticate while the on-premises password-validation path was unavailable.

Answer

Pass-through authentication agents would need reachable domain controllers to validate synchronized users.

Question 7

A nightly export uses the OAuth 2.0 client-credentials flow to call a custom Records API without a signed-in user. The API defines Records.Read as a delegated scope for records the signed-in user may read, and Records.Read.All as an application role for app-only exports. Only Records.Read has been consented. The API accepts the token's signature and audience but rejects the read request; the token has no roles claim. What should be corrected in the authorization configuration?

Accepted Answer

Grant admin consent to Records.Read.All as an application permission, then obtain a new token.

Answer

Grant the export operator access to all records.

Answer

Regrant admin consent to the delegated Records.Read scope, then repeat the existing client-credentials request.

Answer

Replace the client secret with a certificate credential, then request the same delegated API permission.

Question 8

A role-assignable group has an active Microsoft Entra User Administrator assignment. Through PIM for Groups, an engineer is eligible for both group membership and group ownership. The engineer activates ownership only, then cannot reset an ordinary cloud user's password. No other administrator role is assigned to the engineer. To perform the task through the approved, time-limited elevation path, the engineer needs to:

Accepted Answer

Activate the eligible membership assignment for the role-assignable group.

Answer

Have the group ownership assignment changed from eligible to permanently active.

Answer

Extend the current ownership activation.

Answer

Request a permanent direct User Administrator assignment instead of using group membership.

Question 9

A company is deploying Microsoft Entra Private Access for two private services: a maintenance host on TCP 3389 and an inventory server on TCP 1433. Contractors need only the maintenance host; employees need only the inventory server. Each population must have its own Conditional Access requirements. The licensed clients and private network connectors are ready, and neither service is published yet. Which design provides the required access separation?

Accepted Answer

Publish a separate per-app enterprise application for each service, with its own segment, assignments, and Conditional Access policy.

Answer

Place connectors in separate groups, publish both services in Quick Access, and assign both populations to Quick Access.

Answer

Publish both services in one Quick Access application, assign both populations, and require MFA for that application.

Answer

Publish both services as segments of one per-app enterprise application, then assign both populations to that application.

Question 10

While investigating repeated Microsoft 365 sign-in prompts, a technician runs dsregcmd /status in the affected user's Windows session and captures:

AzureAdJoined : YES
DomainJoined  : YES
AzureAdPrt    : NO

What can the technician conclude from these values, without assuming a device-compliance state?

Accepted Answer

The device is Microsoft Entra hybrid joined, but the user has no Primary Refresh Token.

Answer

The device is Microsoft Entra hybrid joined, and the missing token proves that it is noncompliant.

Answer

Hybrid join has not completed; this is an AD DS-only device.

Answer

The device is Microsoft Entra registered, and the missing token means its registration has expired.

Free SC-300 Practice Questions

Domain 1: Implement and manage user identities (20-25%)

Question 1

Question 2

Question 3

Domain 2: Implement authentication and access management (25-30%)

Question 4

Question 5

Question 6

Domain 3: Plan and implement workload identities (20-25%)

Question 7

Question 8

Domain 4: Plan and automate identity governance (20-25%)

Question 9

Question 10

That's 10 of 1,030