SC-300 Microsoft Identity and Access Administrator Dumps 4 — Questions and Answers
Question 1: A developer registers a multi-tenant application in Azure AD. A user from a different Azure AD tenant attempts to consent to the application but is blocked. What is the most likely cause?
- The application's redirect URI is not configured for multi-tenant use
- The external tenant has admin consent required for all applications and no admin has consented (Correct answer)
- The application's signing certificate has expired
- The external user's account type does not support OAuth 2.0
Correct answer: The external tenant has admin consent required for all applications and no admin has consented
If the external tenant requires admin consent for all apps, individual users cannot consent, and an administrator must grant tenant-wide consent first.
Question 2: Which hybrid identity authentication method allows password hash synchronization to Azure AD while also supporting on-premises authentication policies like account lockout and hours restrictions?
- Password Hash Synchronization (PHS) only
- Pass-through Authentication (PTA) (Correct answer)
- Active Directory Federation Services (AD FS)
- Seamless Single Sign-On (SSO) with Kerberos
Correct answer: Pass-through Authentication (PTA)
Pass-through Authentication validates credentials against on-premises AD in real time, so on-premises policies like lockout and logon hours are enforced.
Question 3: An administrator configures an entitlement management access package with an approval workflow requiring two stages. What happens if the first approver does not respond within the configured timeout?
- The request is automatically approved and moves to stage two
- The request is automatically denied
- The request escalates to the fallback approver defined in that stage (Correct answer)
- The requestor must resubmit the request
Correct answer: The request escalates to the fallback approver defined in that stage
Entitlement management supports fallback approvers per stage; if the primary approver times out, the request escalates to the fallback approver.
Question 4: Which Azure AD Conditional Access policy component determines WHO the policy applies to?
- Conditions
- Assignments — Users and groups (Correct answer)
- Grant controls
- Session controls
Correct answer: Assignments — Users and groups
The 'Assignments — Users and groups' section of a Conditional Access policy defines which users, groups, or roles the policy targets.
Question 5: A global administrator wants to prevent any other administrator from removing the MFA requirement on a critical Conditional Access policy. Which feature provides this protection?
- Policy locking via Azure AD Privileged Identity Management
- Enabling the policy in 'Report-only' mode
- Configuring the policy to require a second global admin approval to edit
- Setting the policy as a protected action requiring re-authentication with Conditional Access (Correct answer)
Correct answer: Setting the policy as a protected action requiring re-authentication with Conditional Access
Protected actions in Azure AD require re-authentication (with elevated Conditional Access) to perform sensitive operations like modifying specific policies, adding extra friction.
Question 6: An organization wants to federate their on-premises AD DS with Azure AD using AD FS. Which certificate must be shared with Azure AD to establish the federation trust?
- The AD FS SSL/TLS certificate for HTTPS
- The AD FS token-signing certificate (Correct answer)
- The Web Application Proxy SSL certificate
- The Kerberos service account certificate
Correct answer: The AD FS token-signing certificate
The token-signing certificate is used to sign SAML tokens issued by AD FS; Azure AD needs the public key to verify those tokens.
Question 7: A user's Identity Protection sign-in risk is detected as 'medium' due to an atypical travel alert. The Conditional Access policy for medium risk requires MFA. The user completes MFA. What happens to the risk level after successful MFA?
- The risk level is automatically remediated to 'none' by the system
- The risk level remains 'medium' until an administrator manually dismisses it (Correct answer)
- The risk level is remediated to 'none' only if the user also changes their password
- The risk level escalates to 'high' because of the atypical travel
Correct answer: The risk level remains 'medium' until an administrator manually dismisses it
Completing MFA satisfies the Conditional Access requirement but does not automatically clear the Identity Protection risk; an administrator must dismiss it or the user must remediate via SSPR.
