Hard — SC-300 Practice Quiz

Question 1

You register a single-page application in Microsoft Entra ID and configure it to receive group membership claims in the ID token. Users who belong to a large number of groups report that the application fails to load, and you discover that Entra ID is issuing an overage claim instead of the full list of groups because the token exceeds the size limit. The application needs to make authorization decisions based only on the specific application roles you have defined, not on all of the user's security groups. What should you do to resolve this reliably for all users?

Accepted Answer

Change the group claims configuration to emit only groups assigned to the application, and configure app roles that are assigned to users and groups, then use role claims for authorization.

Answer

Increase the token size limit in the application's manifest by setting the optionalClaims property to accept larger tokens.

Answer

Configure the group claims to emit the sAMAccountName format instead of the group ObjectId to reduce token size.

Answer

Switch the application to request tokens using the implicit grant flow so the group overage claim is resolved automatically.

Question 2

Your organization is deploying Entra certificate-based authentication (CBA) for a group of high-privilege administrators who use smart cards. Security requires that these admins satisfy the multifactor authentication requirement using only their certificate, and that the certificate be validated against a specific policy OID. During pilot testing, admins report they can sign in but are still being prompted for a second factor after presenting their certificate. Which configuration change in the Entra admin center resolves this while enforcing the OID requirement?

Accepted Answer

In the certificate-based authentication settings, configure the authentication binding policy to treat certificates with the required policy OID as multifactor, and set the protection level accordingly.

Answer

Create a Conditional Access policy that grants access and requires 'Authenticator app or hardware token' as an additional control for the admin group.

Answer

Enable the username binding policy to map the certificate SubjectAlternativeName to onPremisesUserPrincipalName so the second factor is skipped.

Answer

Configure Self-Service Password Reset for the admin group so that the certificate counts as a registered authentication method.

Question 3

Your organization uses a custom line-of-business SharePoint site that contains highly sensitive financial records. Users can already access other SharePoint content after satisfying a baseline Conditional Access policy requiring MFA. Security requires that when users open the sensitive financial site specifically, they must re-authenticate with a phishing-resistant method (FIDO2), even if they already have an active session. You need to enforce this step-up requirement only for that site without affecting access to the rest of SharePoint. What should you configure?

Accepted Answer

Create an authentication context, tag the sensitive site with it via a sensitivity label, and build a Conditional Access policy that targets the authentication context and requires an authentication strength allowing only FIDO2.

Answer

Modify the existing baseline Conditional Access policy to require FIDO2 for all SharePoint access using the Office 365 cloud app assignment.

Answer

Configure a Conditional Access policy targeting the SharePoint Online cloud app with sign-in frequency set to every time and require MFA.

Answer

Create a named location for the site's URL and build a Conditional Access policy requiring a compliant device when that location is accessed.

Question 4

Contoso has a SharePoint Online document library named 'Financials' that contains highly sensitive files. Users may already have an active session to SharePoint after signing in with a password. Security requires that when a user attempts to open a file specifically in the 'Financials' library, they must satisfy multifactor authentication at that moment — even if they authenticated with only a password earlier in the session. Regular access to other SharePoint sites should not be affected. Which combination should you configure to enforce this granular, on-demand step-up?

Accepted Answer

Create a sensitivity label with an authentication context, publish it, apply it to the 'Financials' library, and create a Conditional Access policy targeting that authentication context requiring MFA.

Answer

Create a Conditional Access policy targeting the Office 365 SharePoint Online cloud app for all users requiring MFA, and enable app-enforced restrictions.

Answer

Configure a sign-in frequency session control of 1 hour on a Conditional Access policy scoped to all users accessing SharePoint Online.

Answer

Create a Conditional Access policy that uses a filter for devices and requires compliant devices when accessing SharePoint Online.

Question 5

Contoso wants sign-in tokens for Exchange Online and SharePoint Online to be revoked in near real time when a user's IP address moves outside a defined corporate network range during an active session. They have already enabled continuous access evaluation (CAE) and configured named locations for their corporate IP ranges. However, they notice that when a user's IP changes mid-session, access is not being blocked until the token naturally expires. What must they configure to achieve near-real-time enforcement of the location change?

Accepted Answer

Enable strict location enforcement (strictly enforce location policies) in the Conditional Access session controls

Answer

Reduce the sign-in frequency to 1 hour in the Conditional Access session controls

Answer

Enable token protection (token binding) in the Conditional Access session controls

Answer

Configure a persistent browser session set to 'Never persistent'

Question 6

Contoso invites external guests from partner organizations to collaborate in SharePoint and Teams. Security requires that all guests satisfy MFA before accessing any cloud app. You create a Conditional Access policy assigned to 'All guest and external users' that requires multifactor authentication. After deployment, guests who have never signed in report they cannot register an MFA method and are completely blocked at sign-in. Contoso does not use cross-tenant access trust settings for these partners. What should you do so guests can complete MFA registration while still being protected?

Accepted Answer

Keep the MFA requirement but ensure the 'Register security information' user action is not blocked; guests register their own method at first sign-in when a method registration interrupt is allowed.

Answer

Exclude the 'Microsoft Intune Enrollment' and 'Microsoft Intune' cloud apps from the policy so guests can register.

Answer

Configure the policy to exclude the guest users, since MFA cannot be enforced on external identities without cross-tenant trust.

Answer

Change the grant control from 'Require multifactor authentication' to 'Require authentication strength' set to phishing-resistant MFA.

Question 7

Contoso has 4,200 users who were enabled for MFA years ago using legacy per-user MFA (their state is set to 'Enforced' in the MFA service settings). Security wants to modernize to Conditional Access so they can require MFA based on risk and location, and eventually retire per-user MFA. During the transition, an administrator creates a Conditional Access policy requiring MFA for all users. Several users report they are still being prompted to re-register MFA methods and are asked to confirm the app-password legacy behavior. What is the recommended approach to complete the migration cleanly?

Accepted Answer

Use the Microsoft Entra 'per-user MFA to Conditional Access' migration utility to convert users' per-user MFA state to Disabled after confirming the Conditional Access policy enforces MFA, so methods and registrations are preserved.

Answer

Delete all users' registered authentication methods first, then set per-user MFA state to Disabled and let users re-register through the Conditional Access prompt.

Answer

Leave per-user MFA state at 'Enforced' and rely on the Conditional Access policy, since both layers enforce MFA and this provides defense in depth.

Answer

Convert all users to per-user MFA state 'Enabled' instead of 'Enforced', which disables legacy behavior while keeping Conditional Access as the primary control.

Question 8

Contoso allows employees to access Microsoft 365 web apps from personal, unmanaged devices. Security requires that on these devices users must re-authenticate every 4 hours and that browser sessions must not persist after the browser is closed. On corporate Entra-joined devices, users should retain a normal persistent session. You need to configure Conditional Access to meet these requirements while affecting only unmanaged devices. What should you configure?

Accepted Answer

Create a Conditional Access policy scoped using a filter for unmanaged devices, and under Session set Sign-in frequency to 4 hours and Persistent browser session to 'Never persistent'.

Answer

Create a Conditional Access policy targeting all users and cloud apps with a device filter for compliant/hybrid-joined devices, and set Sign-in frequency to 4 hours with Persistent browser session set to 'Never persistent'.

Answer

Configure a tenant-wide sign-in frequency of 4 hours in the authentication session management defaults and disable 'Stay signed in' for all users.

Answer

Create an Intune app protection policy that enforces a 4-hour timeout and blocks browser persistence on personal devices.

Question 9

Contoso wants to prevent token replay attacks where refresh and access tokens are exported from a compromised device and used elsewhere. Security requires that tokens issued to a user's device are cryptographically bound to that device, so a stolen token cannot be used on a different machine. Which Conditional Access session control should you configure to meet this requirement?

Accepted Answer

Token protection (token binding) for sign-in sessions

Answer

Sign-in frequency set to 'Every time'

Answer

Persistent browser session set to 'Never persistent'

Answer

Customize continuous access evaluation to 'Disable'

Question 10

Your organization runs a critical daemon application registered as a service principal in Microsoft Entra ID. Security requires that this service principal only be permitted to obtain tokens when the request originates from your on-premises datacenter's public IP range. Recently, credentials for a similar app were leaked and abused from a foreign IP. You need to enforce a location restriction specifically on the service principal's sign-ins. Which solution should you implement?

Accepted Answer

Create a Conditional Access policy targeting workload identities, assign the service principal, and apply a Block control for all locations except the named location representing the datacenter IP range.

Answer

Configure a user risk-based Conditional Access policy that requires MFA when the service principal's risk level is elevated.

Answer

Add the datacenter IP range to the trusted IPs in the multifactor authentication service settings for the service principal.

Answer

Enable Continuous Access Evaluation for the service principal so tokens are revoked when the IP address changes.

Question 11

Your organization wants a small team of identity engineers to manage the membership and settings of a specific set of highly sensitive groups that also carry role assignments. These groups are role-assignable (isAssignableToRole = true). You create a custom role with permissions to update group membership and assign it to the engineers scoped to those groups. However, the engineers report they cannot modify the membership of the role-assignable groups, even though they can manage other groups. What is the reason for this behavior?

Accepted Answer

Managing role-assignable groups requires the assignee to hold a privileged role such as Privileged Role Administrator or Global Administrator, not just group management permissions.

Answer

Custom roles cannot be scoped to individual groups; they can only be assigned at the tenant level.

Answer

Role-assignable groups must use dynamic membership, so manual membership changes are always blocked.

Answer

The engineers need the Groups Administrator built-in role because custom roles do not support any group membership permissions.

Question 12

Your organization wants to delegate the ability to update the reply URLs (redirect URIs) of existing application registrations to a team of developers. The developers must NOT be able to create new app registrations, delete apps, or manage credentials such as client secrets. You need to follow least-privilege principles. What should you do?

Accepted Answer

Create a custom role granting the microsoft.directory/applications/basic/update permission and assign it to the developers.

Answer

Assign the developers the built-in Application Administrator role.

Answer

Assign the developers the built-in Cloud Application Administrator role.

Answer

Add the developers as owners of every application registration object.

Question 13

Contoso uses entitlement management to grant contractors access to project resources through an access package. The compliance team requires that whenever a contractor's access request is approved, a record must be created in an external ticketing system by calling a REST API, and the access grant must not complete until the API confirms the ticket was created. You need to configure this in the access package. What should you do?

Accepted Answer

Create a Logic App and add a custom extension (custom workflow extension) to the catalog, then configure the access package policy to launch the extension and wait for a callback during the request-granted stage.

Answer

Configure an Azure Logic App triggered by an audit log event for approved requests, using entitlement management's built-in provisioning logs as the trigger.

Answer

Add a multi-stage approval policy where the second stage approver is a service account that calls the ticketing API before approving.

Answer

Enable an access review on the access package and configure the reviewer to be the ticketing system's managed identity so the API is invoked automatically.

Question 14

Your organization uses Microsoft Entra ID Protection. Security operations reports that legacy authentication protocols are generating a high volume of sign-in risk detections that cannot be challenged with MFA. Leadership wants automated protection that blocks the riskiest sign-ins in real time while allowing medium-risk users to self-remediate, and they want to avoid excessive help desk tickets from false positives at low risk. Which configuration best meets these requirements?

Accepted Answer

Configure a sign-in risk-based Conditional Access policy that blocks access at high risk, requires MFA at medium risk, and add a policy blocking legacy authentication clients.

Answer

Configure a sign-in risk-based Conditional Access policy that requires MFA at low and above, and a separate policy that blocks legacy authentication clients.

Answer

Configure a user risk-based Conditional Access policy that requires a secure password change at high risk and rely on the built-in ID Protection MFA registration policy.

Answer

Configure a single sign-in risk-based Conditional Access policy that requires MFA for all risk levels and enable legacy authentication for backward compatibility.

Question 15

Your organization has deployed Global Secure Access and enrolled all corporate Windows devices with the Global Secure Access client configured to route Microsoft 365 traffic. The security team wants to ensure that users can only access Exchange Online and SharePoint Online when their traffic is verifiably passing through the Global Secure Access service, without depending on IP address ranges that change frequently or can be spoofed by VPNs. What should you configure to enforce this requirement?

Accepted Answer

Enable the Compliant Network check in the Global Secure Access session management settings and require a compliant network in a Conditional Access policy

Answer

Create a trusted named location containing the Global Secure Access egress IP ranges and require it in a Conditional Access policy

Answer

Configure a device compliance grant control in Conditional Access and mark all enrolled devices as compliant

Answer

Create an authentication context and bind it to the Microsoft 365 traffic forwarding profile

Question 16

Contoso has deployed Global Secure Access with the Microsoft 365 traffic forwarding profile and the Internet Access profile enabled on all corporate Windows devices. The security team wants to ensure that employees can only sign in to Contoso's own Microsoft 365 tenant from these managed devices and cannot authenticate to any external or personal Microsoft 365 tenants, even when using web browsers. The solution must apply automatically based on the device's Global Secure Access connectivity and must not require configuring proxy headers on each device manually. What should you configure?

Accepted Answer

Enable universal tenant restrictions in the Global Secure Access cross-tenant access settings so tenant restriction v2 signals are injected into traffic through the Internet Access profile

Answer

Create a Conditional Access policy that blocks access for all users when the sign-in comes from an unmanaged device

Answer

Configure a Private Access application segment that publishes the Microsoft 365 sign-in endpoints internally

Answer

Add the corporate tenant to the allowed list in the outbound cross-tenant access settings and rely on B2B collaboration defaults

Question 17

Contoso assigns Microsoft 365 E5 licenses through two dynamic security groups: 'All-Employees' (assigns the full E5 license) and 'Legal-Restricted' (assigns E5 but with the Exchange Online service plan disabled to meet a compliance hold). A legal team member belongs to both groups. Their account currently shows a license assignment error, and Exchange Online is not functioning as expected. Which action correctly resolves the conflict so the user retains a working E5 license while honoring the most restrictive intent?

Accepted Answer

Because both groups assign the same E5 product, the user consumes only one license and the enabled service plans are the union of both groups; disable Exchange Online at the group level or resolve via a single authoritative group.

Answer

Assign the E5 license directly to the user account, which overrides all group-based assignments and clears the error.

Answer

Remove the user from both groups and rely on a dynamic membership rule to reassign the license automatically.

Answer

Purchase a second E5 license so each group assignment consumes its own SKU and the plans no longer conflict.

Question 18

Contoso runs an Azure Function App in Tenant A that must read secrets from an Azure Key Vault located in a subscription owned by Tenant B (a recently acquired subsidiary). You want the Function App to authenticate to Key Vault without storing any credentials. You enable a system-assigned managed identity on the Function App and attempt to grant it access to the Key Vault in Tenant B. The access assignment fails. What is the correct explanation and recommended approach?

Accepted Answer

Managed identities cannot be used to authenticate across Microsoft Entra tenant boundaries; use a multi-tenant app registration with a service principal and certificate credential instead.

Answer

System-assigned managed identities never support Key Vault; switch to a user-assigned managed identity, which can be granted access in any tenant.

Answer

You must enable the Key Vault firewall exception for trusted Microsoft services, after which the managed identity from Tenant A can be assigned directly.

Answer

Assign the Contributor role on the Key Vault to the managed identity at the subscription scope in Tenant B to allow cross-tenant token issuance.

Question 19

Your organization uses Privileged Identity Management (PIM) for Entra ID roles. The security team wants to receive an automated alert whenever the Global Administrator role is activated outside normal business hours. You have already configured diagnostic settings to send Entra ID audit logs to a Log Analytics workspace. You need to build a query that detects these activation events so it can be used in an Azure Monitor alert rule. Which log table and operation should your KQL query target?

Accepted Answer

Query the AuditLogs table for OperationName 'Add member to role completed (PIM activation)'

Answer

Query the SigninLogs table for ResultType 0 where AppDisplayName equals 'Azure AD PIM'

Answer

Query the AADManagedIdentitySignInLogs table for the Global Administrator role activation event

Answer

Query the AuditLogs table for OperationName 'Add eligible member to role in PIM completed'

Question 20

Your organization is deploying Privileged Identity Management (PIM) for the Global Administrator role and enforcing a Conditional Access policy that requires phishing-resistant MFA for all administrators. Security policy also requires two break-glass (emergency access) accounts that must remain usable if PIM, MFA infrastructure, or federation fails. You must configure the break-glass accounts to comply with Microsoft's recommended practices while still maintaining oversight. Which configuration should you implement?

Accepted Answer

Assign the Global Administrator role to the break-glass accounts as permanent active (not eligible) assignments, exclude them from all Conditional Access policies, and create a Log Analytics alert on their sign-ins.

Answer

Make the break-glass accounts eligible for Global Administrator in PIM with approval required, and exclude them from MFA Conditional Access policies.

Answer

Assign the break-glass accounts permanent active Global Administrator, enroll them in phishing-resistant MFA, and include them in all Conditional Access policies for consistency.

Answer

Configure the break-glass accounts as PIM-eligible with a 24-hour activation window and exclude them from the sign-in frequency policy only.

Question 21

Your organization uses Microsoft Entra Connect with password hash synchronization and has enabled Seamless Single Sign-On (Seamless SSO). Security policy requires that the Kerberos decryption key used by the AZUREADSSOACC computer account be rolled over every 30 days. You need to perform this rollover while minimizing the risk of sign-in disruption for users. What should you do?

Accepted Answer

On the Entra Connect server, import the Seamless SSO PowerShell module and run Update-AzureADSSOForest after authenticating with a Domain Administrator account.

Answer

Reset the AZUREADSSOACC computer account password in Active Directory Users and Computers, then restart the Entra Connect server.

Answer

Disable and re-enable Seamless SSO from the Entra Connect wizard, which automatically generates a new key.

Answer

Delete the AZUREADSSOACC computer account and rerun the Entra Connect configuration wizard to recreate it.