SC-300 Microsoft Identity and Access Administrator v1.0 5 — Questions and Answers
Question 1: A global administrator delegates the ability to manage user accounts in a single administrative unit to a helpdesk team. Which role should be assigned scoped to that administrative unit?
- User Administrator at tenant scope
- Helpdesk Administrator scoped to the administrative unit (Correct answer)
- Authentication Administrator scoped to the administrative unit
- Groups Administrator at tenant scope
Correct answer: Helpdesk Administrator scoped to the administrative unit
Helpdesk Administrator scoped to an administrative unit restricts the role to only the users within that administrative unit.
Question 2: An enterprise application uses certificate-based authentication for its service principal. The certificate is about to expire. Which action prevents an authentication outage?
- Rotate the client secret before the certificate expires
- Upload a new certificate to the app registration before the old one expires (Correct answer)
- Re-register the application with a new application ID
- Renew the certificate using Azure Key Vault auto-rotation
Correct answer: Upload a new certificate to the app registration before the old one expires
Uploading a new certificate to the app registration before expiry ensures continuous authentication without service interruption.
Question 3: Which claim in a JWT access token issued by Azure AD uniquely identifies the tenant that issued the token?
- sub
- oid
- tid (Correct answer)
- iss
Correct answer: tid
The 'tid' (tenant ID) claim uniquely identifies the Azure AD tenant that issued the token.
Question 4: A user is assigned an eligible Global Administrator role in PIM. They activate it but are blocked by a Conditional Access policy requiring a compliant device. What should the administrator do?
- Exclude the Global Administrator role from all Conditional Access policies
- Ensure the user activates the role from a compliant device or adjust the CA policy for PIM activation (Correct answer)
- Disable MFA requirement for the Global Administrator role in PIM
- Set the role activation to permanent instead of eligible
Correct answer: Ensure the user activates the role from a compliant device or adjust the CA policy for PIM activation
PIM activation is subject to Conditional Access policies, so the user must meet the policy requirements (compliant device) or the policy scope must be adjusted.
Question 5: An organization wants to monitor for users signing in from IP addresses associated with anonymous proxies. Which Azure AD Identity Protection risk detection type covers this scenario?
- Leaked credentials
- Anonymous IP address (Correct answer)
- Atypical travel
- Malicious IP address
Correct answer: Anonymous IP address
The 'Anonymous IP address' risk detection fires when a sign-in originates from an IP associated with anonymous proxies or Tor networks.
Question 6: When configuring Azure AD Connect for hybrid identity, which feature allows users to perform password reset on-premises and have it written back to on-premises AD immediately?
- Password hash synchronization
- Pass-through authentication
- Password writeback (Correct answer)
- Seamless SSO
Correct answer: Password writeback
Password writeback allows passwords changed or reset in Azure AD (including via SSPR) to be written back to the on-premises Active Directory in real time.
Question 7: An administrator wants to ensure that an application only receives a token when the calling user has explicitly granted consent and no admin consent has been pre-granted. Which consent model enforces this?
- Tenant-wide admin consent
- User consent for verified publishers only
- Per-user incremental consent without admin pre-consent (Correct answer)
- Static application permission consent
Correct answer: Per-user incremental consent without admin pre-consent
Incremental (dynamic) consent without admin pre-consent ensures each individual user must explicitly consent before the app receives tokens on their behalf.
SC-300 Microsoft Identity and Access Administrator v1.0 5
A global administrator delegates the ability to manage user accounts in a single administrative unit to a helpdesk team.
Which role should be assigned scoped to that administrative unit?