Microsoft Identity and Access Administrator Dumps Flashcards
7 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft Identity and Access Administrator Dumps flashcards as text
An administrator wants to ensure that Azure AD guests cannot enumerate other users in the directory. Which setting controls this behavior?
Answer: Guest user access restrictions in External Identities settings
The 'Guest user access restrictions' in External Identities settings controls whether guests can enumerate directory objects like users and groups.
Which Conditional Access session control can force a user to re-authenticate after a defined period, regardless of whether the session token is still valid?
Answer: Sign-in frequency
The 'Sign-in frequency' session control sets a maximum interval before the user must reauthenticate.
A company needs to provide time-limited, audited access to a sensitive Azure resource group for a contractor. Which PIM feature is best suited for this?
Answer: Eligible Azure resource role assignment with expiration date
PIM supports time-bound eligible assignments for Azure resource roles, requiring activation and providing full audit trails.
What is the primary purpose of the 'What If' tool in Azure AD Conditional Access?
Answer: Simulate which Conditional Access policies apply to a specific user, app, and sign-in condition
The 'What If' tool lets administrators simulate a sign-in scenario and see which Conditional Access policies would apply and why.
An application registered in Azure AD needs to read all users' profiles without a signed-in user. Which permission type is required?
Answer: Application permission with User.Read.All scope
Application permissions (app roles) allow a service or daemon to access the API without a signed-in user; User.Read.All grants access to all user profiles.
After enabling Azure AD Self-Service Password Reset (SSPR), some users report they cannot reset their passwords. The administrator notices these users have not registered authentication methods. What should the administrator do?
Answer: Force SSPR registration at next sign-in using the SSPR registration policy in Identity Protection
The SSPR registration policy in Identity Protection can enforce that users register their authentication methods on next sign-in.
Which Azure AD feature allows administrators to review and certify whether users should retain access to groups, applications, or Azure AD roles on a recurring basis?
Answer: Access reviews in Microsoft Entra ID Governance
Access reviews periodically prompt reviewers to confirm or revoke access, automating recertification of group memberships, app assignments, and role assignments.