Mixed Deck — All SC-300 Topics Flashcards

You have a tenant called contoso.com in Azure Active Directory (Azure AD). Policies governing conditional access are applied to all users that run applications that are registered in Azure AD. The users must not be allowed to use legacy authentication. What ought to be covered by the conditional access policies to weed out attempts at legacy authentication?

Answer: Client apps condition

The Client apps condition in Conditional Access lets you target legacy authentication clients (those that can't perform modern auth), so you can block them specifically. Sign-in risk, user risk, and cloud apps conditions target other signals and don't distinguish legacy versus modern authentication protocols.

Which authentication method in Azure AD uses a physical device compliant with the FIDO Alliance standards for passwordless sign-in?

Answer: FIDO2 security keys

FIDO2 security keys are physical hardware devices (like YubiKey) that comply with FIDO2/WebAuthn standards, enabling passwordless authentication without any shared secrets.

A user successfully completes SSPR to reset their password after being flagged by Identity Protection. What is the result on their user risk level?

Answer: User risk is automatically remediated and reset to none

A secure password reset through SSPR signals to Identity Protection that the credential risk has been addressed, automatically remediating the user's risk level back to none.

Which Azure AD External Identities setting controls whether guest users can invite other external users into the tenant?

Answer: Guest invite restrictions in External collaboration settings

The 'Guest invite restrictions' in External collaboration settings determines whether guest users can send B2B invitations, limiting this capability to admins only or allowing guests to invite others.

Which Azure AD Connect sync rule precedence value takes priority when two rules conflict — a lower number or a higher number?

Answer: Lower number (e.g., 50) takes priority over higher numbers

In Azure AD Connect, sync rules with a lower precedence number have higher priority and win conflicts over rules with higher numbers.

A global administrator wants to prevent any other administrator from removing the MFA requirement on a critical Conditional Access policy. Which feature provides this protection?

Answer: Setting the policy as a protected action requiring re-authentication with Conditional Access

Protected actions in Azure AD require re-authentication (with elevated Conditional Access) to perform sensitive operations like modifying specific policies, adding extra friction.

An organization wants to automatically create a guest account in Azure AD when an external user requests an access package for the first time. Which Entitlement Management setting enables this?

Answer: For external users, automatically create an account in this directory

Enabling automatic guest account creation in the access package policy allows Entitlement Management to provision a B2B guest account for external requestors who do not yet have a presence in the tenant.

An administrator marks a risky user as 'Confirm user compromised' in Identity Protection. What immediate effect does this action have?

Answer: The user's risk level is set to high and the account may be blocked based on policy

Confirming a user as compromised sets their user risk to high, which can trigger the user risk policy to block sign-in or require password reset depending on policy configuration.

An administrator wants to enable passwordless authentication for users who use Windows 10 domain-joined devices. Which authentication method should they configure?

Answer: Windows Hello for Business

Windows Hello for Business is the passwordless solution designed specifically for Windows 10/11 domain-joined and Azure AD-joined devices, replacing passwords with biometric or PIN-based authentication tied to the device.

An enterprise application uses certificate-based authentication for its service principal. The certificate is about to expire. Which action prevents an authentication outage?

Answer: Upload a new certificate to the app registration before the old one expires

Uploading a new certificate to the app registration before expiry ensures continuous authentication without service interruption.

Which Azure AD feature enables administrators to see a risk score for each sign-in and take automated action based on that score?

Answer: Azure AD Identity Protection sign-in risk policy

Azure AD Identity Protection evaluates each sign-in and assigns a risk level, which can trigger automated Conditional Access responses.

An organization wants to federate their on-premises AD DS with Azure AD using AD FS. Which certificate must be shared with Azure AD to establish the federation trust?

Answer: The AD FS token-signing certificate

The token-signing certificate is used to sign SAML tokens issued by AD FS; Azure AD needs the public key to verify those tokens.

Which session control in Conditional Access restricts the duration of a user's authenticated session before re-authentication is required?

Answer: Sign-in frequency

Sign-in frequency controls how often users must re-authenticate, overriding the default session lifetime.

Which Azure AD feature provides additional context in push notifications, such as the application name and geographic location, to help users make informed MFA approval decisions?

Answer: Additional context in Microsoft Authenticator notifications

Additional context in Microsoft Authenticator notifications shows users the application requesting access and the approximate location of the sign-in attempt, helping them detect suspicious MFA requests.

Which Azure AD feature allows bulk invitation of multiple guest users by uploading a CSV file?

Answer: Bulk invite users feature in the Azure portal

The 'Bulk invite users' feature in the Azure portal allows administrators to upload a CSV file with external user email addresses and redirect URLs to send multiple B2B invitations simultaneously.

Which Azure AD Identity Protection feature integrates with Microsoft Sentinel to stream risk events for advanced threat hunting?

Answer: Identity Protection diagnostic settings

Identity Protection's diagnostic settings allow risk detection and risky user events to be streamed to Log Analytics, which Microsoft Sentinel can then ingest for SIEM-level threat hunting.

Which Azure AD feature allows an organization to require that access to a specific sensitive application always triggers a step-up authentication challenge, even if the user already has an active session?

Answer: Conditional Access authentication context

Authentication context lets applications trigger a Conditional Access policy with stricter controls (like MFA) for specific high-sensitivity operations within an app.

A company runs quarterly access reviews on all privileged directory roles. Which Azure AD feature is being used?

Answer: PIM access reviews

PIM includes built-in access review capabilities that allow periodic recertification of privileged directory role assignments to ensure least privilege is maintained.

An administrator needs to enforce that users can only register security information from trusted locations. Which Azure AD feature should be configured?

Answer: Named Locations in Conditional Access

Named Locations in Conditional Access allow administrators to restrict security info registration to specific trusted IP ranges or countries.

Your business recently adopted Privileged Identity Management for Azure Active Directory (Azure AD) (PIM). You analyze the roles in PIM and find that all 15 employees in the company's IT division have permanent security administrator privileges. The IT department users should only have access to the Security administrator job when necessary, you must make sure. How should the Security administrator role assignment be configured?

Answer: Assignment type to Eligible

Setting the assignment type to Eligible converts the standing Security Administrator access into just-in-time access, so the IT staff must activate the role only when needed instead of holding it permanently. Active assignment keeps the role always on, and the 'expire assignments after' settings only cap how long an assignment lasts—they don't make it on-demand.