SC-300 Microsoft Identity and Access Administrator v1.0 4 — Questions and Answers
Question 1: An administrator needs to ensure that guest users in Azure AD can only see their own profile and cannot enumerate other users in the directory. Which setting controls this?
- External collaboration settings — guest user access restrictions (Correct answer)
- Conditional Access guest policy
- Cross-tenant access settings inbound restrictions
- Azure AD roles — Guest Inviter restrictions
Correct answer: External collaboration settings — guest user access restrictions
The 'Guest user access restrictions' in External collaboration settings controls what directory objects guest users can read or enumerate.
Question 2: A company uses Seamless SSO with Password Hash Synchronization. A user changes their on-premises AD password. How long before the new password hash is available in Azure AD?
- Up to 24 hours via scheduled sync
- Within 2 minutes via real-time password writeback
- Immediately via on-demand provisioning
- Within 2 minutes via delta sync triggered by the password change (Correct answer)
Correct answer: Within 2 minutes via delta sync triggered by the password change
Azure AD Connect detects on-premises password changes within 2 minutes and syncs the hash to Azure AD via a triggered delta sync.
Question 3: Which Azure AD cross-tenant access setting controls whether your users can be invited as guests into another organization's tenant?
- Inbound settings — B2B collaboration
- Outbound settings — B2B collaboration (Correct answer)
- Inbound settings — B2B direct connect
- Trust settings — MFA claims
Correct answer: Outbound settings — B2B collaboration
Outbound B2B collaboration settings control whether your users can be invited to and access external Azure AD tenants as guests.
Question 4: An organization wants to automatically provision and deprovision user accounts in a SaaS application using Azure AD. Which protocol is preferred when supported by the application?
- SAML 2.0 attribute mapping
- SCIM 2.0 provisioning (Correct answer)
- LDAP directory sync
- Graph API delta queries
Correct answer: SCIM 2.0 provisioning
SCIM 2.0 is the standard protocol Azure AD uses for automated provisioning and deprovisioning to supported SaaS applications.
Question 5: A Conditional Access policy uses Sign-in frequency set to '1 hour'. What happens to a user's session after one hour of inactivity?
- The user is signed out immediately after 1 hour
- The user must re-authenticate on their next request after 1 hour has elapsed (Correct answer)
- The token is revoked and the user must re-enroll in MFA
- The session persists until the browser is closed
Correct answer: The user must re-authenticate on their next request after 1 hour has elapsed
Sign-in frequency controls how often users are prompted to re-authenticate; after the interval, the next resource request triggers a new sign-in.
Question 6: An administrator is configuring Azure AD Password Protection for on-premises Active Directory. Which component must be installed on each domain controller?
- Azure AD Connect sync agent
- Azure AD Password Protection DC agent (Correct answer)
- Microsoft Entra private access connector
- Azure AD Application Proxy connector
Correct answer: Azure AD Password Protection DC agent
The Azure AD Password Protection DC agent must be installed on each domain controller to enforce the banned password list during on-premises password changes.
Question 7: Which Azure AD feature allows an organization to require that access to a specific sensitive application always triggers a step-up authentication challenge, even if the user already has an active session?
- Persistent browser session policy
- Conditional Access authentication context (Correct answer)
- Sign-in frequency policy set to every sign-in
- Identity Protection high-risk session policy
Correct answer: Conditional Access authentication context
Authentication context lets applications trigger a Conditional Access policy with stricter controls (like MFA) for specific high-sensitivity operations within an app.
SC-300 Microsoft Identity and Access Administrator v1.0 4
An administrator needs to ensure that guest users in Azure AD can only see their own profile and cannot enumerate other users in the directory.
Which setting controls this?