Practice Test GeeksSC-300 - Microsoft Identity and Access Administrator Practice Test
← All SC-300 Flashcard Decks

Microsoft Identity and Access Administrator Certification Flashcards

7 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Microsoft Identity and Access Administrator Certification flashcards as text

  1. A security team wants to detect when an Azure AD privileged role is assigned outside of PIM. Which monitoring approach should they implement?

    Answer: Azure Monitor alert on 'Add member to role' audit event outside PIM

    Creating an Azure Monitor or Microsoft Sentinel alert on direct role assignment audit events (not initiated by PIM) catches privileged role assignments that bypass PIM controls.

  2. Which Azure AD feature provides a self-service portal where users can view and revoke their own active sessions and app authorizations?

    Answer: My Account portal (myaccount.microsoft.com)

    The My Account portal allows users to review their security info, active sessions, privacy data, and revoke individual device sessions.

  3. An organization wants guest accounts to automatically expire 90 days after their last sign-in. Which feature manages this lifecycle?

    Answer: Azure AD Identity Governance — lifecycle workflows

    Lifecycle workflows in Azure AD Identity Governance can trigger tasks (including account deletion or disablement) based on inactivity thresholds for guest users.

  4. A developer registers an application in Azure AD and needs it to call Microsoft Graph without a signed-in user. Which credential type should be used?

    Answer: Client secret or certificate with application permissions

    Daemon/service applications use the OAuth 2.0 client credentials grant with a client secret or certificate and application (not delegated) permissions to call Graph API.

  5. Which Azure AD Conditional Access condition evaluates whether a user's sign-in is flagged as medium or high risk by Identity Protection?

    Answer: Sign-in risk condition

    The sign-in risk condition in Conditional Access evaluates the real-time risk score assigned to a specific authentication attempt by Azure AD Identity Protection.

  6. An admin must configure SSO for a legacy application that only supports header-based authentication. Which Azure AD feature enables this?

    Answer: Azure AD Application Proxy with Kerberos Constrained Delegation or header-based SSO via PingAccess

    Application Proxy with header-based SSO (using PingAccess or the built-in header injection) translates Azure AD tokens into HTTP headers that legacy apps understand.

  7. Which setting in an Azure AD access package policy controls whether requestors must provide a justification when requesting access?

    Answer: Require requestor justification toggle in the access package request policy

    The 'Require requestor justification' option in the access package request policy forces users to enter a business reason before their request is submitted for approval.