Microsoft SC-300 Practice Exam

Microsoft Identity and Access Administrator SC-300

The Microsoft Identity and Access Administrator SC-300 exam validates the skills to design, implement and operate identity and access management with Microsoft Entra. It is weighted across four domains: implement and manage user identities at 20 to 25 percent, implement authentication and access management at 25 to 30 percent, plan and implement workload identities at 20 to 25 percent, and plan and automate identity governance at 20 to 25 percent. Questions test hybrid identity, Conditional Access, Global Secure Access, enterprise applications and Privileged Identity Management. This practice exam mirrors that scope with scenario-based single-answer and multiple-answer questions and drag-and-drop matching, each with a worked explanation.

Question bank updated : questions, answers, explanations and chapters.

Certification Overview

  • Exam name: SC-300
  • Vendor: Microsoft
  • Exam code: SC-300
  • Duration: 100 minutes
  • Total questions: about 50
  • Official passing score: 700 on a scale of 1 to 1,000 (source)
  • Our practice exam pass mark: 70%

Who Should Take This Exam?

Identity and Access Administrator, Microsoft Entra Administrator, Security Engineer, Cloud Administrator, Systems Administrator, Identity Architect, IAM Analyst, Security Administrator

Prerequisites

No formal prerequisite. Microsoft expects familiarity with Azure, Microsoft 365 services and workloads, and Active Directory Domain Services, plus experience with PowerShell and Kusto Query Language.

Topics Covered

  • Implement and manage user identities
  • Implement authentication and access management
  • Plan and implement workload identities
  • Plan and automate identity governance

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)
  • Drag and Drop

SC-300 Practice Questions

Our question bank contains 650+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomised questions from our full question bank.

Implement and manage user identities

A security review at Fabrikam requires two changes for external collaborators: guests must not be able to browse internal user and group names in the directory, and only the identity administration team may send invitations. Which two settings should you configure in External identities? (Choose two.)
  • A. Turn on self-service sign-up
  • B. Block B2B collaboration in the default cross-tenant access settings
  • C. Restrict guest invitations to the Guest inviter role Correct answer
  • D. Set guest user access to the most restrictive level Correct answer
  • E. Require an email one-time passcode

Options C and D are correct because restricting guest user access to the most restrictive level stops guests from enumerating users and groups, and limiting invitations to the Guest inviter role leaves only that team able to invite. Self-service sign-up, one-time passcodes and blocking B2B collaboration entirely do not address either requirement.

Which type of DNS record does Microsoft Entra ID use to verify that an organization owns a custom domain name?
  • A. An SRV record
  • B. A TXT record Correct answer
  • C. A CNAME record
  • D. An A record

Option B is correct because Microsoft Entra ID gives you a TXT (or MX) record to add at your DNS registrar, and it verifies ownership by looking for that value. SRV, CNAME and A records are not used for custom domain verification.

An organization's identity team wants to prevent standard users from creating their own applications in the Microsoft Entra tenant. Which setting should the team set to No?
  • A. External Identities > External collaboration settings
  • B. Properties > Access management for Azure resources
  • C. User settings > Users can register applications Correct answer
  • D. Enterprise applications > User consent and permissions

Option C is correct because setting 'Users can register applications' to No under User settings prevents standard users from creating app registrations. External collaboration settings, Azure resource access management and user consent settings control other behaviors and do not block app registration.

Regional IT staff in Frankfurt must create, modify, and reset passwords for employee accounts in Europe only, in a company that runs a single Microsoft Entra tenant. What should the identity team configure so the staff have no control over accounts in other regions?
  • A. Grant the Password Administrator role to the Frankfurt team
  • B. Assign the User Administrator role to a group containing the European users
  • C. Create a second Microsoft Entra tenant and move the European accounts into it
  • D. Assign the User Administrator role scoped to an administrative unit Correct answer

Option D is correct because an administrative unit lets you scope the User Administrator role to only the European users within one tenant. Password Administrator cannot create or modify accounts, a role assigned to a group of users does not scope the permissions, and a second tenant is needless overhead and breaks the single-tenant requirement.

Which Microsoft Entra admin center bulk operation creates new member user accounts from a downloaded CSV template?
  • A. Download users
  • B. Bulk invite user
  • C. Bulk restore user
  • D. Bulk create user Correct answer

Option D is correct because Bulk create user takes a downloaded CSV template and creates new member accounts. Bulk invite user creates external guest invitations, Bulk restore restores deleted users, and Download users exports existing accounts.

Implement authentication and access management

Lucerne Publishing wants Microsoft Entra ID Protection to respond automatically to detected risks: a user whose credentials appear in a published leak must set a new password, and a sign-in from an anonymous IP address must receive an MFA challenge. All users are already registered for MFA and self-service password reset. Which two policies should the identity team enable? (Choose two.)
  • A. User risk policy that requires a password change Correct answer
  • B. Conditional Access policy that requires MFA for every sign-in
  • C. Sign-in risk policy that blocks access
  • D. MFA registration policy for all users
  • E. Sign-in risk policy that requires MFA Correct answer

Options A and E are correct because a user risk policy requiring a password change handles leaked credentials, and a sign-in risk policy requiring MFA handles the anonymous IP sign-in. Option B applies MFA to every sign-in rather than responding to risk, option C blocks access instead of challenging, and option D is unnecessary because all users are already registered.

An organization wants to let employees sign in with a passkey created in the Microsoft Authenticator app. Which policy should the identity administrator update to make the method available for users?
  • A. Authentication methods policy Correct answer
  • B. Sign-in risk policy
  • C. Security defaults
  • D. Per-user multifactor authentication settings

Option A is correct because the Authentication methods policy controls which methods, including passkeys in Microsoft Authenticator, are available to which users. Sign-in risk policies and security defaults do not enable specific methods, and per-user MFA settings are the legacy way to enforce MFA, not to enable passkeys.

An identity team is creating a Conditional Access policy that requires multifactor authentication for all users. Which configuration prevents the team from being locked out of the tenant if the MFA service becomes unavailable?
  • A. Excluding two emergency access accounts Correct answer
  • B. Excluding the Global Administrator accounts
  • C. Adding a persistent browser session control
  • D. Setting sign-in frequency to every 30 days

Option A is correct because Microsoft recommends excluding at least two emergency access (break-glass) accounts from Conditional Access policies so administrators can still sign in if MFA is unavailable. Excluding all Global Administrators (B) removes protection from privileged accounts, and options C and D do not provide a fallback.

Repeated failed password attempts from an unfamiliar network target a Microsoft Entra user account. What does smart lockout do for the legitimate user?
  • A. The account is locked for a fixed period for all attempts
  • B. The user can sign in; only the attacker is locked out Correct answer
  • C. The account is locked until an administrator releases it
  • D. The user must complete a password reset before signing in

Option B is correct because smart lockout distinguishes sign-in attempts from familiar locations and devices of the legitimate user from unfamiliar ones, so the attacker is locked out while the user can still sign in. Options A, C and D describe indiscriminate or manual lockout behavior that smart lockout is designed to avoid.

A drafted Conditional Access policy will require multifactor authentication for all users and all cloud apps. The team must measure the policy's effect on real sign-ins before enforcing it. What should the team do?
  • A. Enable the policy for a pilot group of IT staff
  • B. Run selected users through the What If tool
  • C. Enable the policy in report-only mode Correct answer
  • D. License every user for Microsoft Entra ID P2 first

Option C is correct because report-only mode evaluates the policy on real sign-ins and logs the result without enforcing it, so its impact can be measured. Option A enforces the policy on users, option B simulates a single scenario rather than measuring real sign-ins, and option D is not required for report-only mode.

Plan and implement workload identities

An identity and access administrator wants to monitor user activity within a sanctioned cloud app in real time and block file downloads from unmanaged devices. Which two actions should the administrator perform in Microsoft Defender for Cloud Apps? (Choose two.)
  • A. Monitor app usage with Cloud Discovery
  • B. Create a session policy that blocks downloads Correct answer
  • C. Onboard the app to Conditional Access App Control Correct answer
  • D. Create an access policy that blocks unmanaged devices
  • E. Create an OAuth app policy that revokes the app's permissions

Options B and C are correct because real-time monitoring and blocking of downloads in a sanctioned app is done with Conditional Access App Control, which requires onboarding the app to it and then creating a session policy that blocks downloads. Option A (Cloud Discovery) only analyzes traffic logs after the fact and cannot control sessions. Option D (an access policy) allows or blocks access outright rather than restricting actions inside a session, and option E (an OAuth app policy) governs app permissions, not user downloads.

An Azure environment runs several virtual machines that host related applications. The identity team wants a single identity that the virtual machines share and that keeps existing when any one of them is deleted. Which type of managed identity should the team create?
  • A. A service principal with a federated identity credential
  • B. An app registration with a certificate credential
  • C. A user-assigned managed identity Correct answer
  • D. A system-assigned managed identity

Option C is correct because a user-assigned managed identity is a standalone Azure resource that can be attached to multiple virtual machines and persists when any one of them is deleted. Option D (system-assigned) is tied to a single resource and is deleted with it. Options A and B are service principal or app registration credentials that must be managed manually and are not managed identities.

Litware, Inc. adds a SaaS application from the Microsoft Entra ID gallery. The application's vendor documents support for SCIM 2.0, and the team wants users to be created, updated, and disabled in the application automatically as their group memberships change in Microsoft Entra ID. Which configuration should the team set up on the enterprise application?
  • A. An access package that assigns the application to users
  • B. Automatic user provisioning Correct answer
  • C. SAML single sign-on with just-in-time user provisioning
  • D. Password-based single sign-on

Option B is correct because automatic user provisioning in the enterprise application uses SCIM to create, update, and disable users in the app as assignments and group memberships change in Microsoft Entra ID. Option A (an access package) handles entitlement requests, not provisioning. Option C (JIT) only creates users at sign-in and does not update or disable them, and option D (password-based SSO) handles sign-in only.

A scheduled nightly job uses an app registration to export calendar events from shared mailboxes in Microsoft Entra ID. No user account is signed in while the job runs. The job authenticates with a client secret, the app registration holds the delegated Calendars.Read permission with admin consent, and its Microsoft Graph requests fail. Which change should the team make?
  • A. Assign an admin role to the app's service principal
  • B. Add the delegated permission Calendars.Read.Shared
  • C. Create a new client secret for the app registration
  • D. Grant Calendars.Read as an application permission Correct answer

Option D is correct because a job that runs with no signed-in user must use application permissions; delegated permissions require a user context, so Calendars.Read as a delegated permission cannot work with the client credentials flow. Option A does not grant Graph API permissions, option B is still a delegated permission, and option C is wrong because the secret is not the cause of the failure.

A web app hosted on Azure App Service must read secrets from an Azure Key Vault without any credentials stored in its code or configuration. The system-assigned managed identity is now enabled on the app. What should the administrator do next?
  • A. Create a client secret for the identity and add it to app settings
  • B. Register the identity as an app registration and grant admin consent
  • C. Add the identity to the Directory Readers role in Microsoft Entra ID
  • D. Assign the identity the Key Vault Secrets User role on the vault Correct answer

Option D is correct. A managed identity needs an Azure RBAC role on the vault before it can read secrets, and Key Vault Secrets User gives read access to secret values. Option A stores a credential, which the stem prohibits. Option B is not needed because a managed identity is created for the resource and needs no app registration. Option C grants directory read access, which does not authorize Key Vault data access.

Plan and automate identity governance

Contoso's identity team onboards hundreds of contractors each quarter. Each contractor needs the same set of resources: membership in two security groups, two SaaS applications, and a SharePoint site. Administrators currently assign these individually and often forget to remove them when engagements end. You need to let contractors request all of these resources in a single request, require manager approval, and remove access automatically after 180 days. What should you configure?
  • A. an access review that recurs every 180 days
  • B. an access package whose assignments expire after 180 days Correct answer
  • C. a dynamic security group with a department-based membership rule
  • D. a lifecycle workflow triggered by a contractor hire event

Option B is correct because an access package bundles group memberships, applications and a SharePoint site into one request, supports manager approval in its policy, and can set assignments to expire after 180 days so access is removed automatically. Option A only reviews existing access and does not let contractors request it, option C grants group membership alone, and option D automates joiner/mover/leaver tasks rather than self-service requests.

A security group was deleted from Microsoft Entra ID last week, and the identity team must identify which administrator deleted it. Which log should the team review in the Microsoft Entra admin center?
  • A. Provisioning logs
  • B. Usage & insights reports
  • C. Sign-in logs
  • D. Audit logs Correct answer

Option D is correct because Microsoft Entra audit logs record directory changes, including who deleted a group and when. Sign-in logs (C) track authentication events, provisioning logs (A) track synchronization to target apps, and usage & insights reports (B) summarize app usage rather than administrative changes.

An identity administrator supports a tenant in which five users hold permanent Global Administrator assignments. Security policy now requires the privilege to be granted just in time, with approval and multi-factor authentication before each elevation. Which two actions meet the requirement? (Choose two)
  • A. Convert the five assignments to eligible Correct answer
  • B. Require MFA for the five admins in Conditional Access
  • C. Govern the role with an access package that expires annually
  • D. Run quarterly access reviews of the Global Administrator role
  • E. Require approval and MFA for each activation of the role Correct answer

Options A and E are correct because converting permanent assignments to eligible in Privileged Identity Management makes the role just in time, and activation settings can require approval and MFA each time the role is elevated. Option B applies MFA to sign-in, not role activation, option C does not provide just-in-time elevation, and option D only reviews assignments periodically.

Fabrikam wants new hires to sign in on their first day without a password, and the hiring manager must receive the credential before the start date. Which Lifecycle Workflows task meets this requirement?
  • A. Send welcome email to the new hire
  • B. Generate Temporary Access Pass and email the manager Correct answer
  • C. Add user to selected Microsoft 365 groups
  • D. Request user access package assignment for the new hire

Option B is correct because the Lifecycle Workflows task Generate Temporary Access Pass and email the manager creates a TAP for the new hire and delivers it to the manager before the start date, enabling passwordless first sign-in. A welcome email, group membership and access package assignment do not issue a credential.

An administrator is adding resources to a catalog for use in access packages in Microsoft Entra entitlement management. Which two of the following can be added as catalog resources? (Choose two)
  • A. A Conditional Access policy
  • B. A Microsoft Intune compliance policy
  • C. An Azure subscription Contributor role
  • D. A SharePoint Online site Correct answer
  • E. A Microsoft 365 group Correct answer

Options D and E are correct because SharePoint Online sites and Microsoft 365 groups (including Teams) are resource types that can be added to an entitlement management catalog, along with security groups and applications. Conditional Access and Intune compliance policies are not catalog resources, and Azure subscription roles are not supported.

Free Study Guide

Read the free Microsoft SC-300 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.

More Microsoft Practice Exams

All Microsoft practice exams →

Practise with realistic mock exams to prepare for your Microsoft certification.