Identity and Access Administrator Associate (SC-300) - Full Practice Exam 1

1. A background daemon must call an API without any signed-in user. Which permission model should be considered where the API supports it?
2. A company needs to synchronize supported identities from on-premises Active Directory to Entra ID. Which tool family is designed for this?
3. A company wants eligible users to receive a license according to membership in an assigned group. Which capability should it use?
4. A company wants to block commonly used weak passwords and organization-specific terms in supported password-change scenarios. Which capability should it configure?
5. A company wants to publish a supported on-premises web application using Entra preauthentication without opening an inbound internet path to the application server. Which capability fits?
6. A developer compares an application registration with an enterprise application's service principal. Which statement is correct?
7. A hybrid organization wants cloud sign-in to verify synchronized password-derived hashes without depending on a live on-premises authentication agent for each sign-in. Which approach fits?
8. A hybrid team wants to assess whether lightweight provisioning agents and cloud-managed configuration can meet its identity synchronization requirements. Which service should it evaluate?
9. A multi-tenant organization wants a managed process to create, update, and remove supported B2B users across its tenants. Which capability should it evaluate?
10. A new Conditional Access policy could disrupt many users. The team wants to inspect its likely impact before enforcement. Which mode should it evaluate first?
11. A new employee needs a time-limited credential to bootstrap registration of a supported strong authentication method. Which capability fits?
12. A project needs a single request that grants access to several groups and applications for a fixed period, with approval. Which identity-governance object fits?
13. A regional help desk should manage eligible user properties only for employees in its division. Which TWO configuration steps fit? Select TWO.
14. A security group should automatically include users whose department attribute matches Finance. Which group membership approach fits?
15. A security team wants a protected operation to trigger stronger authentication only when the user reaches that operation. Which Conditional Access concept should it evaluate with application integration?
16. A supported Entra task needs a narrow custom administrative role. Which TWO design decisions support least privilege? Select TWO.
17. A supported SaaS app needs additional session controls based on Conditional Access integration, such as governing downloads in a risky session. Which capability should be evaluated?
18. A team wants selected users to register a stronger supported authentication method during sign-in through a controlled rollout. Which capability should it evaluate?
19. A tenant needs access recovery if ordinary administrators are locked out by a faulty authentication policy. Which design should it maintain?
20. A trusted external CI workload needs Azure access without storing a long-lived Entra client secret. Which authentication approach should be evaluated?
21. A user reports being blocked after a policy rollout. Which evidence is the most direct starting point for identifying the applied Conditional Access decision?
22. A workload still requires a supported credential rather than managed identity or federation. What is an appropriate operational practice?
23. Administrators should hold eligible rather than continuously active roles and activate them after approval for a short maintenance window. Which capability fits?
24. An access review finds that several guest users no longer need an application. What must be configured or performed to make the review outcome affect access?
25. An administrator needs to determine who changed a directory role assignment. Which log category is the most direct starting point?
26. An analyst sees a risky sign-in and a risky user classification. Which distinction is correct?
27. An app requests broad permissions to read organizational data. What should an administrator verify before granting consent?
28. An application acts on behalf of a signed-in user and must remain limited by the user's access as well as the app's granted scope. Which permission type applies?
29. An Azure workload needs an identity that should be deleted with its owning resource. Which managed identity type directly follows that lifecycle?
30. An employee account is believed compromised. The administrator must prevent further use and address existing sessions through supported mechanisms. Which response is appropriate?
31. An engineer is eligible for a role in PIM but cannot yet perform its privileged operations. What action is normally needed, subject to configured requirements?
32. An interactive app receives redirect URI mismatch errors during sign-in. What should be corrected?
33. An investigator needs the authentication conditions and outcome for a specific user's application sign-in. Which records should be inspected?
34. An organization adds a custom domain to Entra ID. What must it generally do before using the domain as a verified tenant domain?
35. An organization wants identity-aware security controls for internet and SaaS access using Global Secure Access capabilities. Which service should it evaluate?
36. An organization wants phishing-resistant authentication for administrators. Which supported method should it prioritize over reusable passwords and one-time-code-only approaches?
37. An organization wants resource owners to periodically certify access instead of relying only on IT administrators. Which design fits?
38. An organization wants supported applications to react more quickly to critical identity events rather than relying only on ordinary token expiry. Which capability should it evaluate?
39. Corporate Windows devices should be joined directly to Entra ID rather than only registered for a user's personal access. Which device state should the administrator plan?
40. Employees should be created and removed in a supported SaaS application according to their assigned access. Which capability should be configured?
41. External project access should expire automatically unless renewed through an authorized process. Which design most directly supports this?
42. Hybrid users must reset passwords through Entra SSPR and have the new password applied to supported on-premises AD accounts. Which integration is needed?
43. Policy requires hybrid users' passwords to be validated against on-premises Active Directory through supported agents during sign-in. Which authentication approach fits?
44. Security wants longer-term analysis of supported Entra activity in a Log Analytics workspace using KQL. What should be configured?
45. Several supported resources must share one managed identity that remains when any single resource is replaced. Which type fits?
46. Two applicable Conditional Access policies require MFA and a compliant device respectively. What must a successful sign-in normally satisfy?
47. Two departments need different approval and expiry rules for the same resource bundle. How should entitlement management model this?
48. Two organizations want to control inbound and outbound B2B collaboration and selectively trust supported partner authentication or device claims. Which settings should they evaluate?
49. Users need identity-centric access to private applications without broad network access to every internal destination. Which service should be evaluated?
50. Why should emergency access account use generate a high-priority monitoring signal?

Comments — 0