SC-300 Microsoft Identity and Access Administrator Certification 4 — Questions and Answers
Question 1: A security team wants to detect when an Azure AD privileged role is assigned outside of PIM. Which monitoring approach should they implement?
- Azure Monitor alert on 'Add member to role' audit event outside PIM (Correct answer)
- Identity Protection sign-in risk policy
- PIM access review
- Microsoft Secure Score recommendation
Correct answer: Azure Monitor alert on 'Add member to role' audit event outside PIM
Creating an Azure Monitor or Microsoft Sentinel alert on direct role assignment audit events (not initiated by PIM) catches privileged role assignments that bypass PIM controls.
Question 2: Which Azure AD feature provides a self-service portal where users can view and revoke their own active sessions and app authorizations?
- My Sign-Ins (mysignins.microsoft.com)
- My Account portal (myaccount.microsoft.com) (Correct answer)
- My Apps portal (myapps.microsoft.com)
- Azure AD Access Panel
Correct answer: My Account portal (myaccount.microsoft.com)
The My Account portal allows users to review their security info, active sessions, privacy data, and revoke individual device sessions.
Question 3: An organization wants guest accounts to automatically expire 90 days after their last sign-in. Which feature manages this lifecycle?
- Azure AD guest user access reviews with auto-removal
- Azure AD Identity Governance — lifecycle workflows (Correct answer)
- Conditional Access sign-in frequency
- External collaboration expiration settings
Correct answer: Azure AD Identity Governance — lifecycle workflows
Lifecycle workflows in Azure AD Identity Governance can trigger tasks (including account deletion or disablement) based on inactivity thresholds for guest users.
Question 4: A developer registers an application in Azure AD and needs it to call Microsoft Graph without a signed-in user. Which credential type should be used?
- Client secret or certificate with application permissions (Correct answer)
- Delegated permissions with user consent
- Device authorization grant
- On-behalf-of flow with user token
Correct answer: Client secret or certificate with application permissions
Daemon/service applications use the OAuth 2.0 client credentials grant with a client secret or certificate and application (not delegated) permissions to call Graph API.
Question 5: Which Azure AD Conditional Access condition evaluates whether a user's sign-in is flagged as medium or high risk by Identity Protection?
- Sign-in risk condition (Correct answer)
- User risk condition
- Device platform condition
- Named location condition
Correct answer: Sign-in risk condition
The sign-in risk condition in Conditional Access evaluates the real-time risk score assigned to a specific authentication attempt by Azure AD Identity Protection.
Question 6: An admin must configure SSO for a legacy application that only supports header-based authentication. Which Azure AD feature enables this?
- Azure AD Application Proxy with Kerberos Constrained Delegation or header-based SSO via PingAccess (Correct answer)
- Password-based SSO
- SAML 2.0 SSO
- OAuth 2.0 implicit flow
Correct answer: Azure AD Application Proxy with Kerberos Constrained Delegation or header-based SSO via PingAccess
Application Proxy with header-based SSO (using PingAccess or the built-in header injection) translates Azure AD tokens into HTTP headers that legacy apps understand.
Question 7: Which setting in an Azure AD access package policy controls whether requestors must provide a justification when requesting access?
- Require requestor justification toggle in the access package request policy (Correct answer)
- Access review frequency setting
- Approval stage configuration
- Custom extension (logic app) trigger
Correct answer: Require requestor justification toggle in the access package request policy
The 'Require requestor justification' option in the access package request policy forces users to enter a business reason before their request is submitted for approval.
SC-300 Microsoft Identity and Access Administrator Certification 4
A security team wants to detect when an Azure AD privileged role is assigned outside of PIM.
Which monitoring approach should they implement?