SC-300 Microsoft Identity and Access Administrator Dumps 2 — Questions and Answers
Question 1: A company wants to enforce that users can only access Microsoft 365 from compliant devices. Which Conditional Access grant control should be configured?
- Require multi-factor authentication
- Require device to be marked as compliant (Correct answer)
- Require Hybrid Azure AD joined device
- Require approved client app
Correct answer: Require device to be marked as compliant
The 'Require device to be marked as compliant' grant control ensures only Intune-compliant devices can access resources.
Question 2: An administrator needs to allow external users from a partner organization (contoso.com) to access internal SharePoint sites using their own credentials. What should be configured in Azure AD?
- Azure AD B2C tenant
- External Identities cross-tenant access settings with direct connect
- Azure AD B2B collaboration with allow list for contoso.com (Correct answer)
- Federation with contoso.com using AD FS
Correct answer: Azure AD B2B collaboration with allow list for contoso.com
Azure AD B2B collaboration allows external users to sign in with their own credentials; an allow list restricts this to specific domains.
Question 3: Which Azure AD feature automatically detects when a user's credentials have been leaked on the dark web and flags their sign-in as high risk?
- Azure AD Password Protection
- Microsoft Defender for Identity
- Azure AD Identity Protection leaked credentials detection (Correct answer)
- Microsoft Sentinel UEBA
Correct answer: Azure AD Identity Protection leaked credentials detection
Azure AD Identity Protection's leaked credentials detection compares credentials against known breach lists and raises user risk.
Question 4: A Privileged Identity Management (PIM) role assignment is set to 'eligible.' What must the user do before they can use the role?
- Wait for an administrator to activate the role on their behalf
- Activate the role themselves, optionally providing a justification (Correct answer)
- Request permanent assignment through an access review
- Complete a background check within the Azure portal
Correct answer: Activate the role themselves, optionally providing a justification
With an eligible assignment, the user must self-activate the role in PIM, and activation may require MFA, justification, or approval.
Question 5: Which token type does Microsoft identity platform issue that contains user claims and is validated by the receiving API without a round-trip to Azure AD?
- Refresh token
- Authorization code
- Access token (JWT) (Correct answer)
- SAML assertion
Correct answer: Access token (JWT)
A JWT access token is self-contained with claims and a signature, allowing the API to validate it locally.
Question 6: An organization uses Azure AD Connect. After a recent change, some synchronized users cannot sign in to Azure AD. The administrator suspects an attribute sync issue. Which tool should be used first to diagnose the problem?
- Azure AD Connect Health
- Synchronization Service Manager (Correct answer)
- IdFix tool
- Azure AD audit logs
Correct answer: Synchronization Service Manager
Synchronization Service Manager shows connector errors and object-level sync details, making it the primary diagnostic tool for attribute sync issues.
Question 7: A user reports they are prompted for MFA every time they sign in, even from a trusted corporate network. What Conditional Access configuration would eliminate repeated MFA prompts from that network?
- Create a named location for the corporate IP range and exclude it from the MFA policy (Correct answer)
- Disable the MFA registration policy in Identity Protection
- Set the session control to 'Sign-in frequency: Never'
- Configure the user's MFA methods to include a hardware FIDO2 key
Correct answer: Create a named location for the corporate IP range and exclude it from the MFA policy
Defining the corporate IP range as a trusted named location and excluding it from the Conditional Access MFA requirement removes the repeated prompt.
SC-300 Microsoft Identity and Access Administrator Dumps 2
A company wants to enforce that users can only access Microsoft 365 from compliant devices.
Which Conditional Access grant control should be configured?