10 SC-300 Practice Questions That Mirror the Real Exam
Here are 10 multiple-choice questions designed to mirror the difficulty and style of the Microsoft SC-300 (Identity and Access Administrator) exam. These questions cover key domains including identity management, authentication, authorization, and governance.
SC-300 Practice Questions
Question 1
Your company is implementing a new policy requiring users to use phishing-resistant authentication methods. You need to ensure that all administrators are enrolled in a method that meets this requirement. Which authentication method should you prioritize for the administrator accounts?
A. Microsoft Authenticator app with number matching
B. FIDO2 security keys
C. SMS-based verification
D. Temporary Access Pass
Answer: B
Explanation: FIDO2 security keys are phishing-resistant because they use public/private key cryptography and are tied to a specific device, preventing credential theft from fake websites. While the Authenticator app with number matching is more secure than SMS, it is still susceptible to MFA fatigue or push notification interception in advanced attacks. SMS and Temporary Access Pass are not considered phishing-resistant.
Question 2
You are configuring an access review in Microsoft Entra ID. The policy requires that guests with no sign-in activity for 90 days be automatically removed from the group. What must you configure in the access review settings to meet this requirement?
A. Set the "Duration (in days)" to 90.
B. Select "Multi-stage review" and set the first stage to 90 days.
C. Configure the "Auto apply results to resource" setting to "Enabled".
D. Set "Upon completion" to "Auto apply results" and select "Remove access" for "Action to apply on denied users".
Answer: D
Explanation: To automatically remove users, you must configure the review's completion settings. Specifically, you need to enable "Auto apply results" and set the "Action to apply on denied users" to "Remove access". The "Duration (in days)" defines the review period, not the sign-in inactivity threshold. The inactivity-based removal is handled by the "Reviewers" settings, but the final removal action is determined by the completion settings.
Question 3
Your organization uses Microsoft Entra ID. You need to grant a third-party SaaS application access to read user profile data. You want to ensure that the application only has permissions to read basic profiles and cannot modify data. What should you create in Microsoft Entra ID?
A. An application registration with delegated permissions for User.Read
B. An application registration with application permissions for User.Read.All
C. A Conditional Access policy requiring app protection
D. A service principal with the Directory Readers role
Answer: A
Explanation: Delegated permissions allow the application to act on behalf of the signed-in user, and the User.Read permission grants access to the signed-in user's profile only. Application permissions (User.Read.All) allow the app to access all users without a signed-in user context, which is too broad. A Conditional Access policy or a directory role does not grant specific API permissions.
Question 4
Your company is planning to use Microsoft Entra Verified ID to issue verifiable credentials to employees. You need to ensure that the solution supports the revocation of credentials if an employee leaves the organization. What is the primary mechanism for revocation?
A. Deleting the employee's user account in Microsoft Entra ID.
B. Configuring a status list in the Microsoft Entra Verified ID service.
C. Using PowerShell to remove the credential from the user's wallet.
D. Revoking the signing key for the credential.
Answer: B
Explanation: Microsoft Entra Verified ID uses a status list (a public registry) to manage the revocation state of issued credentials. When a credential is revoked, its ID is added to the status list, and verifiers can check this list to confirm the credential is still valid. Deleting the user account or the signing key does not invalidate the verifiable credential itself.
Question 5
You are configuring an Identity Governance policy for a project team. You need to allow users to request access to the project's SharePoint site, but their access must be approved by their direct manager and automatically expire after 30 days. What should you use in Microsoft Entra ID?
A. An access package with an expiration policy.
B. A Conditional Access policy with a session control.
C. An access review with a duration of 30 days.
D. A group expiration policy.
Answer: A
Explanation: Access packages in Entra ID Governance are designed for this scenario. You can configure a policy within the access package to define who can request access, who must approve it (e.g., the user's manager), and an expiration policy (e.g., 30 days). Conditional Access controls session lifetime, not access duration. Access reviews are for periodic recertification, not a fixed 30-day expiry.
Question 6
Your company has a hybrid identity environment. You are planning to enable a new application that requires the userPrincipalName attribute to be synchronized to Microsoft Entra ID. You discover that the UPN suffix in your on-premises Active Directory does not match your verified domain in Microsoft Entra ID. What is the correct approach to resolve this?
A. Change all on-premises UPNs to match the Microsoft Entra ID domain before synchronization.
B. Synchronize the userPrincipalName attribute as-is and rely on the initial domain onmicrosoft.com.
C. Add the on-premises UPN suffix as a custom domain in Microsoft Entra ID and verify it.
D. Use Microsoft Entra Connect to map the mail attribute to the userPrincipalName attribute in the cloud.
Answer: C
Explanation: For a seamless experience, the UPN suffix used on-premises must be a verified domain in Microsoft Entra ID. If it isn't, the synchronized user will get the default onmicrosoft.com domain assigned, which can cause issues with sign-in. The correct fix is to add and verify the custom domain (e.g., contoso.local is not possible, but contoso.com is) in Microsoft Entra ID, allowing the UPN to be synchronized correctly.
Question 7
You need to enforce a policy that blocks legacy authentication protocols (e.g., POP3, IMAP) for all users in your organization. You want to ensure that users using modern authentication (e.g., Outlook) are not affected. What should you configure?
A. A Conditional Access policy targeting "Legacy authentication clients" with a block control.
B. An Authentication Strength policy requiring MFA for all clients.
C. A Security Defaults setting that enables MFA for all users.
D. A user risk policy in Identity Protection that blocks high-risk sign-ins.
Answer: A
Explanation: Conditional Access allows you to specifically target the "Legacy authentication clients" condition and apply a "Block access" control. This effectively stops legacy protocols while leaving modern authentication (which supports Conditional Access) unaffected. Security Defaults block legacy auth but are a baseline, not a granular policy. MFA policies do not inherently block legacy auth; they can be bypassed by legacy protocols.
Question 8
Your organization uses Privileged Identity Management (PIM) for Azure AD roles. You need to ensure that a user who has an eligible assignment for the Global Administrator role can only activate it during business hours (9 AM - 5 PM) and must provide a ticket number. What should you configure in PIM?
A. Configure the role settings for Global Administrator to require Azure MFA on activation.
B. Configure the role settings for Global Administrator to require justification and set a maximum activation duration.
C. Create a Conditional Access policy that restricts sign-in to business hours and apply it to the user.
D. Configure the role settings for Global Administrator to require a ticket number and define an approval workflow with a time-bound schedule.
Answer: D
Explanation: PIM role settings allow you to require "Ticket information" for activation. However, restricting activation to specific business hours is not a native PIM setting. You must combine this with an approval workflow where the approver only approves during business hours, or more commonly, you use a Conditional Access policy that targets the user and restricts sign-in to those hours. Since the question asks for a single configuration, the most comprehensive answer is the one that includes both the ticket requirement and a time-bound mechanism via approval workflow. (Note: In the real exam, this would be a multi-step answer, but this is the closest single solution).
Answer: D
Explanation: PIM allows you to require justification and ticket info for activation. To enforce the business hours restriction, you would typically configure an approval workflow where the approver is instructed to only approve during business hours, or you would use a Conditional Access policy that targets the user and restricts sign-in to those hours. The combination of ticket requirement and an approval workflow is the most complete answer provided.
Question 9
You are implementing a B2B collaboration strategy. You need to ensure that external users can access your internal applications using their own corporate credentials but must be required to accept a terms of use and be subject to your organization's Conditional Access policies. What should you configure?
A. An access package for external users in Entra ID Governance.
B. A cross-tenant access setting for the external organization.
C. A SharePoint external sharing policy.
D. An entitlement management policy that requires a manager approval.
Answer: B
Explanation: Cross-tenant access settings are the control plane for B2B collaboration. They allow you to configure Trust settings (like trusting MFA from the external tenant) and apply Conditional Access policies to external users. While an access package can provision access, the Conditional Access policies and terms of use are applied at the tenant level via cross-tenant access settings or Conditional Access policies targeting external users. A SharePoint policy is only for SharePoint.
Question 10
Your organization has a strict security policy that requires all user accounts to have a password change every 60 days. You are using Microsoft Entra ID. How should you implement this requirement?
A. Configure a password policy in Microsoft Entra ID to set the maximum password age to 60 days.
B. Use a Conditional Access policy to enforce a password change after 60 days.
C. Configure a group policy in on-premises Active Directory and sync it to Microsoft Entra ID.
D. Use a PowerShell script to monitor password age and force a change.
Answer: A
Explanation: Microsoft Entra ID allows you to configure a custom password policy via the "Password protection" settings. You can set the "Maximum password age" to a custom value (e.g., 60 days). While on-premises Group Policy can enforce this, it only applies to on-premises accounts. Conditional Access does not have a control for password age. PowerShell scripts are not a supported or reliable method for enforcement.
These questions represent the analytical and scenario-based nature of the SC-300 exam. Remember to not only memorize concepts but also understand the "why" behind each configuration. Focus on the interplay between identity, authentication, and governance.
To structure your review around those concepts, this free SC-300 study plan gives you a week-by-week schedule that fits your available time.
If your study notes feel solid, prove it — sit Microsoft Identity and Access Administrator (SC-300) mock test questions and see your score.
For a shorter self-check, this free SC-300 readiness check shows which identity area needs the most review and explains each answer.