SC-300 Microsoft Identity and Access Administrator v1.0 3 — Questions and Answers
Question 1: An organization uses Azure AD B2C for customer identity. They want to allow customers to sign in with their Google accounts. What must be configured in B2C?
- A SAML identity provider for Google
- An OAuth 2.0 social identity provider for Google (Correct answer)
- An OpenID Connect enterprise application for Google
- A B2B guest user policy for Google accounts
Correct answer: An OAuth 2.0 social identity provider for Google
Azure AD B2C supports Google as a social identity provider using OAuth 2.0, configured in the Identity providers section.
Question 2: A user's Azure AD Identity Protection risk level is set to 'High' due to leaked credentials. Which automatic remediation action should a risk-based Conditional Access policy enforce?
- Block access permanently
- Require password change with MFA (Correct answer)
- Require device compliance check
- Require Terms of Use acceptance
Correct answer: Require password change with MFA
For high user risk, the recommended remediation is requiring the user to perform MFA and change their password to clear the risk.
Question 3: Which PIM setting ensures that a user must provide a business justification before activating an eligible Azure AD role?
- Require approval to activate
- Require justification on activation (Correct answer)
- Require MFA on activation
- Require ticket information on activation
Correct answer: Require justification on activation
The 'Require justification on activation' PIM role setting forces users to enter a justification reason before their role is activated.
Question 4: An organization needs to federate their on-premises Active Directory with Azure AD using a third-party federation service. Which protocol does Azure AD require the federation service to support?
- Kerberos
- WS-Federation or SAML 2.0 (Correct answer)
- LDAP over SSL
- OAuth 2.0 device code flow
Correct answer: WS-Federation or SAML 2.0
Azure AD supports federation with third-party identity providers using WS-Federation or SAML 2.0 protocols.
Question 5: A developer registers an application in Azure AD. The application needs to call Microsoft Graph as itself (no user context). Which OAuth 2.0 grant type should be used?
- Authorization code flow
- Client credentials flow (Correct answer)
- On-behalf-of flow
- Device code flow
Correct answer: Client credentials flow
The client credentials flow is used for daemon/service applications that authenticate as themselves without a signed-in user.
Question 6: An administrator wants to prevent users from registering new MFA methods unless they are in a trusted location. Which feature enables this control?
- Authentication methods policy restrictions
- Conditional Access policy targeting 'Microsoft Azure MFA' registration
- Conditional Access Authentication Context for MFA registration (Correct answer)
- Identity Protection registration policy
Correct answer: Conditional Access Authentication Context for MFA registration
Conditional Access Authentication Context can be applied to the MFA registration combined registration experience to restrict where users can register.
Question 7: Which Azure AD feature enables administrators to see a risk score for each sign-in and take automated action based on that score?
- Microsoft Sentinel sign-in analytics
- Azure AD Identity Protection sign-in risk policy (Correct answer)
- Defender for Cloud Apps session policy
- Azure Monitor alert rules on sign-in logs
Correct answer: Azure AD Identity Protection sign-in risk policy
Azure AD Identity Protection evaluates each sign-in and assigns a risk level, which can trigger automated Conditional Access responses.
SC-300 Microsoft Identity and Access Administrator v1.0 3
An organization uses Azure AD B2C for customer identity.
They want to allow customers to sign in with their Google accounts.
What must be configured in B2C?