Free SC-300 sample questions with answers
Here are five free SC-300 sample questions covering all four skill areas, with the answer and the reasoning behind it. Try each one before opening the answer. These are original scenario questions written against the official skills outline, not questions from the real exam.
Question 1. A regional IT team must reset passwords for users who belong to the Sales department only. They must not be able to reset passwords for any other users in the tenant. What is the best way to scope their access?
- A. Assign the Password Administrator role at tenant scope
- B. Assign the Global Administrator role and ask the team to avoid other users
- C. Create an administrative unit for Sales and assign the Password Administrator role scoped to it
- D. Create a dynamic group for Sales and make the team its owners
Show answer
Answer: C
Assigning a role such as Password Administrator scoped to an administrative unit that contains only the Sales users limits the permission to those accounts. Assigning the role at tenant scope gives access to everyone. A dynamic group on its own does not restrict a directory role unless it is role-assignable or tied to an administrative unit. Global Administrator is far too broad.
Want more questions like this? Full SC-300 practice tests →
Question 2. You want to require multifactor authentication for all users signing in to a finance application. Before enforcing it, you want to see which sign-ins would have been affected without blocking anyone. What should you do?
- A. Create the policy and set its state to On
- B. Create the policy and set its state to Report-only
- C. Enable security defaults for the tenant
- D. Create the policy and leave it disabled
Show answer
Answer: B
Report-only mode evaluates a Conditional Access policy and records the result in the sign-in logs without enforcing the controls. Creating the policy in the enabled state would enforce it immediately. Security defaults cannot be scoped to one application and cannot be used alongside Conditional Access policies. Disabling the policy evaluates nothing.
Want more questions like this? Full SC-300 practice tests →
Question 3. Microsoft Entra ID Protection flags a user as high risk because their credentials appeared in a leak. The user can complete MFA and self-service password reset is enabled. You want the user to regain access without helpdesk involvement. What should you configure?
- A. A sign-in risk policy that blocks access at medium risk
- B. A policy that blocks access for high-risk users
- C. Dismiss the user risk in the risky users report
- D. A user risk policy that requires a password change at high risk
Show answer
Answer: D
A user risk policy, in ID Protection or as a Conditional Access policy, can require a secure password change when user risk is high; a user who can authenticate with MFA can self-remediate. A sign-in risk policy reacts to a risky sign-in, not a compromised credential. Blocking access forces helpdesk involvement. Dismissing the risk leaves the leaked password in place.
Want more questions like this? Full SC-300 practice tests →
Question 4. A daemon service with no signed-in user must read all user profiles in the tenant by calling Microsoft Graph. Which kind of permission do you add to the app registration, and what must happen before it works?
- A. An application permission, granted by admin consent
- B. A delegated permission, granted by user consent
- C. A delegated permission, granted by admin consent
- D. An application permission, granted by user consent
Show answer
Answer: A
A background service with no user context uses an application permission, which always requires admin consent. Delegated permissions need a signed-in user and act on that user’s behalf. A delegated permission cannot read all profiles without a user holding that access, and user consent cannot be used for application permissions.
Want more questions like this? Full SC-300 practice tests →
Question 5. Administrators with the Exchange Administrator role should hold it only while they work. Each activation must require a business justification and approval from the security lead, and last no more than two hours. What should you configure?
- A. A permanent active assignment with a monthly access review
- B. An eligible assignment in PIM with approval, justification and a two-hour maximum activation
- C. A Conditional Access policy that requires MFA for the role
- D. A time-bound active assignment that expires after two hours
Show answer
Answer: B
In Privileged Identity Management, make the assignment eligible and set the role settings to require justification and approval, with a maximum activation duration of two hours. A permanent active assignment gives standing access. An access review checks assignments periodically but does not control each activation. A Conditional Access policy cannot require approval from a named approver.
Want more questions like this? Full SC-300 practice tests →
How did you do?
Questions 3 and 4 catch the most people. Risk policies come in two types that react to different signals, and the delegated versus application permission split looks simple until a scenario hides the word “daemon” or “background”. If either slowed you down, read the authentication and access guide or the workload identities guide.
Question 5 is worth a second look too. Eligible versus active is one of the most reliable ideas in the governance domain; the identity governance guide covers it.
What these questions have in common
None of them asks for a definition. Each describes a requirement and several plausible options, and the answer turns on one detail: scoped to a unit, report-only, self-remediation, no user present, eligible with approval. That is how most of SC-300 reads. Underline the constraint before you look at the options.
For a longer check, take the 20-question practice test.