SC-300 Microsoft Identity and Access Administrator Certification 2 — Questions and Answers
Question 1: An administrator needs to enforce that users can only register security information from trusted locations. Which Azure AD feature should be configured?
- Named Locations in Conditional Access (Correct answer)
- Identity Protection risk policies
- Authentication Methods policy
- Access Reviews
Correct answer: Named Locations in Conditional Access
Named Locations in Conditional Access allow administrators to restrict security info registration to specific trusted IP ranges or countries.
Question 2: A company wants to require re-authentication every time a user accesses a sensitive app, regardless of session age. Which Conditional Access session control achieves this?
- Sign-in frequency set to 'Every time' (Correct answer)
- Persistent browser session disabled
- Continuous access evaluation
- Defender for Cloud Apps app control
Correct answer: Sign-in frequency set to 'Every time'
Setting Sign-in frequency to 'Every time' forces reauthentication on each access attempt to the targeted application.
Question 3: Which Azure AD Identity Protection risk detection fires when a user's credentials appear in a third-party leaked credentials database?
- Leaked credentials (Correct answer)
- Anonymous IP address
- Atypical travel
- Malicious IP address
Correct answer: Leaked credentials
The 'Leaked credentials' detection triggers when Microsoft finds user credentials in publicly leaked data sets on the dark web.
Question 4: An organization uses Azure AD B2C. A developer needs to customize the user journey for sign-up and sign-in. Which feature enables fully custom logic beyond built-in flows?
- Custom policies (Identity Experience Framework) (Correct answer)
- User flows
- Conditional Access in B2C
- External Identities settings
Correct answer: Custom policies (Identity Experience Framework)
Custom policies via the Identity Experience Framework provide granular XML-based control over every step of the user journey in Azure AD B2C.
Question 5: A global admin wants to view all Privileged Identity Management (PIM) activations from the past 30 days. Where is this audit information found?
- PIM > Azure AD roles > Resource audit (Correct answer)
- Azure AD > Sign-in logs
- Microsoft Defender XDR > Incidents
- Azure Monitor > Activity Log
Correct answer: PIM > Azure AD roles > Resource audit
PIM Resource audit within Azure AD roles provides a history of all role activations, assignments, and approvals.
Question 6: Which protocol does Azure AD use for modern authentication token issuance to support OAuth 2.0 flows?
- OpenID Connect (OIDC) (Correct answer)
- SAML 2.0
- WS-Federation
- Kerberos
Correct answer: OpenID Connect (OIDC)
OpenID Connect is the identity layer on top of OAuth 2.0 that Azure AD uses to issue ID tokens for modern authentication flows.
Question 7: An admin needs to automatically revoke all refresh tokens for a user suspected of compromise without deleting the account. Which action accomplishes this?
- Revoke sign-in sessions in Azure AD user properties (Correct answer)
- Reset the user's password
- Disable the user account
- Remove all app registrations
Correct answer: Revoke sign-in sessions in Azure AD user properties
Revoking sign-in sessions via the 'Revoke sessions' option invalidates all refresh tokens, forcing the user to reauthenticate on all devices.
SC-300 Microsoft Identity and Access Administrator Certification 2
An administrator needs to enforce that users can only register security information from trusted locations.
Which Azure AD feature should be configured?