SC-300 Microsoft Identity and Access Administrator Certification 4

Question 1

A security team wants to detect when an Azure AD privileged role is assigned outside of PIM. Which monitoring approach should they implement?

Accepted Answer

Azure Monitor alert on 'Add member to role' audit event outside PIM

Answer

Creating an Azure Monitor or Microsoft Sentinel alert on direct role assignment audit events (not initiated by PIM) catches privileged role assignments that bypass PIM controls.

Question 2

Which Azure AD feature provides a self-service portal where users can view and revoke their own active sessions and app authorizations?

Accepted Answer

My Account portal (myaccount.microsoft.com)

Answer

The My Account portal allows users to review their security info, active sessions, privacy data, and revoke individual device sessions.

Question 3

An organization wants guest accounts to automatically expire 90 days after their last sign-in. Which feature manages this lifecycle?

Accepted Answer

Azure AD Identity Governance — lifecycle workflows

Answer

Lifecycle workflows in Azure AD Identity Governance can trigger tasks (including account deletion or disablement) based on inactivity thresholds for guest users.

Question 4

A developer registers an application in Azure AD and needs it to call Microsoft Graph without a signed-in user. Which credential type should be used?

Accepted Answer

Client secret or certificate with application permissions

Answer

Daemon/service applications use the OAuth 2.0 client credentials grant with a client secret or certificate and application (not delegated) permissions to call Graph API.

Question 5

Which Azure AD Conditional Access condition evaluates whether a user's sign-in is flagged as medium or high risk by Identity Protection?

Accepted Answer

Sign-in risk condition

Answer

The sign-in risk condition in Conditional Access evaluates the real-time risk score assigned to a specific authentication attempt by Azure AD Identity Protection.

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 Microsoft Identity and Access Administrator Certification 4