Free SC-300 practice test: 20 questions
Twenty questions across the four SC-300 skill areas, weighted roughly as the real exam is: four on user identities, six on authentication and access management, five on workload identities and five on identity governance. These are original scenario questions. Find the constraint in each scenario before you look at the options.
Implement and manage user identities
Question 1. Users in the Marketing department change roles often. Their membership of a Marketing security group must follow the department attribute in their profile with no manual work. What should you configure?
- A. An assigned security group managed by the helpdesk
- B. A dynamic user security group with a rule on the department attribute
- C. A Microsoft 365 group where the owner approves join requests
- D. An administrative unit containing the Marketing users
Show answer
Answer: B
A dynamic user group with a membership rule on the department attribute adds and removes members automatically; it needs Entra ID P1 or higher. An assigned group requires manual updates. A Microsoft 365 group with owners approving requests is also manual. An administrative unit scopes administration and does not manage group membership.
Want more questions like this? Full SC-300 practice tests →
Question 2. A company synchronises its on-premises directory to Entra ID and wants employees to keep signing in to cloud apps even if the on-premises environment goes offline. No agents should validate passwords at sign-in. Which method should you choose?
- A. Password hash synchronization
- B. Pass-through authentication
- C. Federation with AD FS
- D. Seamless single sign-on only
Show answer
Answer: A
Password hash synchronization lets Entra ID validate sign-ins in the cloud, so sign-in continues when the on-premises environment is down. Pass-through authentication validates against on-premises AD through agents at sign-in. Federation with AD FS also depends on on-premises servers. Seamless SSO is a convenience feature and does not replace a sign-in method.
Want more questions like this? Full SC-300 practice tests →
Question 3. Guests from a partner tenant are asked for MFA in your tenant even though they already completed MFA in their home tenant. You want to avoid the double prompt for this partner only. What should you do?
- A. Change the external collaboration settings to allow all domains
- B. Exclude all guests from every MFA policy
- C. Block the partner tenant in the outbound settings
- D. Add an organisation-specific inbound setting that trusts MFA claims from the partner
Show answer
Answer: D
In cross-tenant access settings, an organisation-specific inbound setting can trust MFA claims from the partner tenant, so guests who completed MFA at home are not prompted again. External collaboration settings control invitations, not claims. Removing MFA for all guests weakens security. Blocking the partner removes access instead of fixing the prompt.
Want more questions like this? Full SC-300 practice tests →
Question 4. New corporate laptops are cloud-only, with no connection to an on-premises domain. Users should sign in with their work accounts and the devices must be managed by the organisation. Which device identity state should you use?
- A. Microsoft Entra registered
- B. Microsoft Entra hybrid joined
- C. Microsoft Entra joined
- D. Workgroup with no work account
Show answer
Answer: C
Microsoft Entra join is for organisation-owned devices that sign in with work accounts and need no on-premises domain. Registration is for personal devices. Hybrid join requires membership of on-premises AD. Leaving the device without a work identity gives no organisational control.
Want more questions like this? Full SC-300 practice tests →
Implement authentication and access management
Question 5. You must block sign-ins that use legacy authentication protocols for all users, without risking a lockout of the two emergency access accounts. What should you configure?
- A. A policy requiring MFA for legacy client apps
- B. Security defaults with exclusions for the emergency accounts
- C. A Conditional Access policy that blocks legacy client apps and excludes the emergency accounts
- D. Disable self-service password reset
Show answer
Answer: C
A Conditional Access policy that targets client apps of the legacy type with the Block control, excluding the emergency access accounts, meets the requirement. Requiring MFA does not work for protocols that cannot do MFA. Security defaults cannot exclude accounts and cannot be combined with Conditional Access. Disabling SSPR is unrelated.
Want more questions like this? Full SC-300 practice tests →
Question 6. Sign-ins that Microsoft Entra ID Protection rates as medium risk or higher should prompt for MFA, so legitimate users can continue and attackers cannot. Which policy fits?
- A. A sign-in risk policy that requires MFA at medium and above
- B. A user risk policy that requires a password change
- C. A policy that blocks all medium-risk sign-ins
- D. A named location policy for the corporate network
Show answer
Answer: A
A sign-in risk policy reacts to the likelihood that a given sign-in is not the real user, and requiring MFA lets a legitimate user prove identity. A user risk policy addresses a compromised account and typically requires a password change. Blocking all medium-risk sign-ins locks out real users. A named location does not use risk signals.
Want more questions like this? Full SC-300 practice tests →
Question 7. You want to move users from phone-call MFA to Microsoft Authenticator without forcing everyone on the same day. Users should be prompted to set it up during sign-in. What should you use?
- A. Issue a Temporary Access Pass to every user
- B. Enable a registration campaign for Microsoft Authenticator
- C. Disable phone call authentication for the whole tenant today
- D. Set a sign-in frequency session control
Show answer
Answer: B
A registration campaign in the authentication methods policy nudges users to register Microsoft Authenticator at sign-in, and users can snooze it, which allows a gradual rollout. Temporary Access Pass is for bootstrapping. Disabling voice calls immediately would lock out users who have no alternative. A sign-in frequency control changes re-authentication timing.
Want more questions like this? Full SC-300 practice tests →
Question 8. In a hybrid environment, users reset their passwords with self-service password reset, but afterwards they cannot sign in to on-premises resources with the new password. What is missing?
- A. Pass-through authentication
- B. A Temporary Access Pass
- C. Password writeback
- D. Device registration
Show answer
Answer: C
Password writeback sends the new password from Entra ID to on-premises AD, so both stay in step. Pass-through authentication affects how cloud sign-ins are validated. A Temporary Access Pass is a sign-in credential. Registering the device does not synchronise passwords.
Want more questions like this? Full SC-300 practice tests →
Question 9. When an administrator disables a user account, the user's existing access to Exchange Online and SharePoint must stop within minutes instead of waiting for token expiry. Which feature supports this?
- A. Sign-in frequency set to one hour
- B. A Conditional Access policy in report-only mode
- C. An authentication strength requirement
- D. Continuous access evaluation
Show answer
Answer: D
Continuous access evaluation lets supported services react to critical events such as user disablement or password change in near real time. Sign-in frequency only controls how often users re-authenticate. A report-only policy enforces nothing. Authentication strengths define which methods are accepted, not revocation.
Want more questions like this? Full SC-300 practice tests →
Question 10. Remote employees must reach internal web and TCP apps without a traditional VPN, using Microsoft Entra to control access. Which Global Secure Access capability do you deploy?
- A. Microsoft Entra Private Access
- B. Microsoft Entra Internet Access
- C. The Microsoft traffic profile for Microsoft 365
- D. A guest account for each remote employee
Show answer
Answer: A
Microsoft Entra Private Access, with the Global Secure Access client and a private network connector, gives access to private apps without a VPN and works with Conditional Access. Internet Access secures traffic to the public internet. The Microsoft traffic profile is for Microsoft 365 traffic. Application Proxy is aimed at publishing web applications rather than general TCP apps.
Want more questions like this? Full SC-300 practice tests →
Plan and implement workload identities
Question 11. A CI/CD pipeline running outside Azure must deploy to an Azure subscription. The security team forbids long-lived client secrets. What should you configure on the app registration?
- A. A client secret with a 24-month expiry
- B. A federated credential for the pipeline’s identity provider
- C. A system-assigned managed identity on the pipeline runner outside Azure
- D. A shared user account with a long password
Show answer
Answer: B
A federated credential establishes trust with the pipeline’s identity provider, so it exchanges its own token for an Entra token with no stored secret. A client secret or an uploaded password is a stored credential. A managed identity is available only to resources running in Azure.
Want more questions like this? Full SC-300 practice tests →
Question 12. Five virtual machines must use the same identity to read blobs from one storage account, and the identity must survive if any VM is deleted. What should you use?
- A. Five system-assigned managed identities
- B. One service principal with a client secret on each VM
- C. A guest user account
- D. One user-assigned managed identity assigned to all five VMs
Show answer
Answer: D
A user-assigned managed identity is a standalone resource that can be attached to several resources and persists independently. A system-assigned identity is tied to one resource and deleted with it. A client secret creates a stored credential. A guest user is for external people.
Want more questions like this? Full SC-300 practice tests →
Question 13. An enterprise application must be usable only by members of the Finance group. Users outside the group must not be able to open it, even with the direct link. What should you configure?
- A. Hide the application from the My Apps portal
- B. Grant tenant-wide admin consent
- C. Enable assignment required and assign the Finance group
- D. Restrict guest access in external collaboration settings
Show answer
Answer: C
Turning on assignment required and assigning the Finance group means only assigned users can sign in. Hiding the app from My Apps only removes the tile, not access. Granting admin consent concerns permissions. A guest restriction does not limit internal users.
Want more questions like this? Full SC-300 practice tests →
Question 14. You need to find out which unsanctioned cloud apps employees use, based on firewall and proxy logs, and see a risk score for each. What should you use?
- A. Cloud discovery in Defender for Cloud Apps
- B. App registrations
- C. Application Proxy
- D. Access reviews
Show answer
Answer: A
Cloud discovery in Microsoft Defender for Cloud Apps analyses traffic logs to show app usage and risk scores from the cloud app catalog. App registrations define your own apps. Application Proxy publishes on-premises apps. Access reviews check who has access, not which apps are used.
Want more questions like this? Full SC-300 practice tests →
Question 15. An API needs a Manager role and an Employee role, and the tokens issued to users of the app must carry the role. Where do you define the roles?
- A. As Microsoft Entra directory roles
- B. As app roles on the app registration
- C. As delegated permissions on the API
- D. As custom security attributes
Show answer
Answer: B
App roles are defined on the app registration, assigned to users or groups through the enterprise application, and returned in the token’s roles claim. Directory roles control tenant administration, not app logic. Delegated permissions describe what the app may do on behalf of users, not user roles. Custom security attributes describe objects but do not appear as app roles in tokens.
Want more questions like this? Full SC-300 practice tests →
Plan and automate identity governance
Question 16. You are creating emergency access accounts for the tenant. Which design is recommended?
- A. One synced account tied to the CIO’s phone
- B. Federated accounts that depend on AD FS
- C. Two cloud-only accounts with Global Administrator, strong stored credentials, monitoring and exclusion from risky policies
- D. A PIM-eligible role for a named engineer
Show answer
Answer: C
Emergency access accounts should be cloud-only, not tied to an individual, hold a permanent Global Administrator role, use strong stored credentials, and be monitored and excluded from policies that could lock everyone out. Synced accounts depend on on-premises systems. Accounts tied to a person or protected only by a single phone fail when that person or phone is unavailable.
Want more questions like this? Full SC-300 practice tests →
Question 17. Engineers need membership of a group that grants access to production resources only when they are working on an incident, for a maximum of four hours, with justification. What should you use?
- A. Permanent membership with a yearly access review
- B. A Conditional Access policy requiring MFA
- C. A dynamic group based on job title
- D. PIM for Groups with eligible membership and a four-hour activation limit
Show answer
Answer: D
PIM for Groups makes membership or ownership of a group eligible, with activation settings such as duration and justification, so access is just in time. A permanent member is standing access. An access review checks periodically but does not control activation. Conditional Access cannot create time-bound membership.
Want more questions like this? Full SC-300 practice tests →
Question 18. Guest users in a Teams-connected group should be reviewed monthly. Each guest should be asked whether they still need access, and those who do not respond should lose it. What should you create?
- A. A monthly access review of guest users with default decision Remove access
- B. A catalog in entitlement management
- C. A KQL query run manually every month
- D. A Conditional Access policy that blocks guests
Show answer
Answer: A
An access review of guests in the group with the guests or their sponsors as reviewers, a monthly recurrence and a default of remove access when there is no response meets the requirement. Entitlement management is for requesting access, not for reviewing an existing group on its own. A sign-in log query only reports. Conditional Access cannot remove membership.
Want more questions like this? Full SC-300 practice tests →
Question 19. You send Entra sign-in logs to a Log Analytics workspace. You need a query that lists sign-ins together with which Conditional Access policies applied. Which table do you query?
- A. AuditLogs
- B. SigninLogs
- C. AADProvisioningLogs
- D. AzureActivity
Show answer
Answer: B
Interactive sign-in events, including the Conditional Access evaluation results, are in the SigninLogs table. AuditLogs records directory changes. AADProvisioningLogs holds provisioning results. AzureActivity holds Azure resource management events.
Want more questions like this? Full SC-300 practice tests →
Question 20. Employees of a partner organisation should be able to request an access package themselves, without anyone sending individual invitations. What should you configure in entitlement management?
- A. A bulk invitation from a CSV file
- B. A new catalog for the partner
- C. A connected organization and an access package policy that allows it
- D. A terms of use document
Show answer
Answer: C
A connected organization defines the partner so that its users can request access packages whose policy allows that organization. Individual invitations contradict the requirement. A new catalog groups resources. Terms of use only collect agreement.
Want more questions like this? Full SC-300 practice tests →
How did you do?
Sixteen or more correct suggests you are close. Below fourteen, the domain guides in this section are the fastest way to find the gaps. Questions 5–10 are the largest domain; weak results there point to the authentication and access guide. Questions 11–15 test applications: if you missed more than one, read workload identities. Questions 16–20 are governance, covered in identity governance, and questions 1–4 in user identities.
Repeat the free Microsoft practice assessment afterwards. If both results point at the same domain, you know where your remaining time should go.