McAfee Secure

Microsoft SC-300 Bundle

Exam Code: SC-300

Exam Name Microsoft Identity and Access Administrator

Certification Provider: Microsoft

Corresponding Certification: Microsoft Certified: Identity and Access Administrator Associate

Microsoft SC-300 Bundle $44.99
SC-300 Sample 1 SC-300 Sample 2 SC-300 Sample 3 SC-300 Sample 4 SC-300 Sample 5 SC-300 Sample 6 SC-300 Sample 7 SC-300 Sample 8 SC-300 Sample 9 SC-300 Sample 10

100% Microsoft SC-300 Guaranteed Success With Testking Training Materials

Get Real SC-300 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    SC-300 Questions & Answers

    490 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual SC-300 exam while allowing you to hone and measure every aspect of your test-taking ability.

  • SC-300 Video Course

    SC-300 Training Course

    43 Video Lectures

    SC-300 Video Course is developed by Microsoft Professionals to help you pass the SC-300 exam.

    Description

    This course will improve your knowledge and skills required to pass Microsoft Identity and Access Administrator exam.
  • Study Guide

    SC-300 Study Guide

    599 PDF Pages

    Developed by industry experts, this 599-page guide spells out in painstaking detail all of the information you need to ace SC-300 exam.

Microsoft Identity and Access Administrator (SC-300) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    490 Questions

    $124.99
  • SC-300 Video Course

    Training Course

    43 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    599 PDF Pages

    $29.99

Microsoft SC-300 Practice Test 10

Question 90

The deployment owner asks why this identity requirement failed: An enterprise must supply synchronized B2B users to a receiving tenant instead of emailing each employee an invitation. The test shows: Synchronization logs show the targeted source user was skipped or rejected. Which fault is the best diagnosis?

  1. The employee stays in the source-side provisioning assignment or filter scope
  2. The user is outside source-side assignment scope, or the target tenant has not allowed inbound cross-tenant user synchronization
  3. The inbound cross-tenant policy was configured for the wrong tenant ID
  4. The guest restriction is left at the permissive member-equivalent setting

Explanation

Correct Answer

B:

Correct diagnosis. The user is outside source-side assignment scope, or the target tenant has not allowed inbound cross-tenant user synchronization. This fault explains the observed failure: Synchronization logs show the targeted source user was skipped or rejected. The intended configuration would instead be: Configure source-tenant push synchronization of in-scope internal members with source attribute mappings, and authorize inbound synchronization and redemption in the target tenant.

Incorrect Answers

A:

The employee stays in the source-side provisioning assignment or filter scope. The reported symptom instead has this cause: The user is outside source-side assignment scope, or the target tenant has not allowed inbound cross-tenant user synchronization. The corrective action is: Configure source-tenant push synchronization of in-scope internal members with source attribute mappings, and authorize inbound synchronization and redemption in the target tenant.

C:

The inbound cross-tenant policy was configured for the wrong tenant ID. The reported symptom instead has this cause: The user is outside source-side assignment scope, or the target tenant has not allowed inbound cross-tenant user synchronization. The corrective action is: Configure source-tenant push synchronization of in-scope internal members with source attribute mappings, and authorize inbound synchronization and redemption in the target tenant.

D:

The guest restriction is left at the permissive member-equivalent setting. The reported symptom instead has this cause: The user is outside source-side assignment scope, or the target tenant has not allowed inbound cross-tenant user synchronization. The corrective action is: Configure source-tenant push synchronization of in-scope internal members with source attribute mappings, and authorize inbound synchronization and redemption in the target tenant.

Question 91

A change request covers two Microsoft Entra needs. Requirement A: An external guest invited under an obsolete email address needs the collaboration invitation redirected to their current address. Requirement B: A B2B guest no longer works for the vendor but still appears assigned to multiple groups and apps. Select TWO actions, one for each requirement.

  1. Evaluate and configure cross-tenant inbound trust for partner device claims only when the organization accepts the associated trust model
  2. Configure the supported SAML federation settings for the external identity provider with validated issuer, endpoints, and trust material
  3. Apply the supported external-collaboration guest access restrictions, then validate delegated permissions separately
  4. Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access
  5. Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process

Explanation

Correct Answers

D:

Correct for task 1. Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access. This directly addresses the first requirement: An external guest invited under an obsolete email address needs the collaboration invitation redirected to their current address. Verify it by checking: The intended guest redeems using the approved current identity and retains only authorized resource access.

E:

Correct for task 2. Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process. This addresses the independent second requirement: A B2B guest no longer works for the vendor but still appears assigned to multiple groups and apps. Verify it by checking: The terminated guest cannot access the app and the access review records the removal decision.

Incorrect Answers

A:

The resource tenant did not enable the relevant cross-tenant trust setting for the partner. To satisfy task 1, use: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access. For task 2, use: Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process.

B:

The SAML issuer or signing certificate does not match the configured trust. To satisfy task 1, use: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access. For task 2, use: Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process.

C:

The guest restriction is left at the permissive member-equivalent setting. To satisfy task 1, use: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access. For task 2, use: Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process.

Question 92

After a deployment under this requirement — An external guest invited under an obsolete email address needs the collaboration invitation redirected to their current address — administrators claim the following solution is in place: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access. Which pilot finding supports that claim?

  1. The intended guest redeems using the approved current identity and retains only authorized resource access
  2. The invited guest is presented the terms and cannot reach the target app without acceptance
  3. The supplier redeems the invitation, appears with the expected guest identity, and accesses only the granted site
  4. An unauthorized member cannot invite a new vendor, and an existing approved guest can still reach its allocated resource

Explanation

Correct Answer

A:

Correct acceptance check. The intended guest redeems using the approved current identity and retains only authorized resource access. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

B:

Even if publish succeeds, this does not prove the required identity-control outcome. The decisive check is: The intended guest redeems using the approved current identity and retains only authorized resource access.

C:

Even if inviting the supplier through Microsoft Entra B2B collaboration with appropriate tenant succeeds, this does not prove the required identity-control outcome. The decisive check is: The intended guest redeems using the approved current identity and retains only authorized resource access.

D:

Even if restricting new guest invitations to authorized inviters while preserving explicitly granted access for existing guests succeeds, this does not prove the required identity-control outcome. The decisive check is: The intended guest redeems using the approved current identity and retains only authorized resource access.

Question 93

The deployment was intended to satisfy: An external guest invited under an obsolete email address needs the collaboration invitation redirected to their current address. During testing, this happened: Redemption repeatedly targets the stale external identity despite the new invitation address. Which configuration defect best explains the failure?

  1. The guest restriction is left at the permissive member-equivalent setting
  2. The invitee is created as an ordinary internal member without the intended external collaboration flow
  3. The guest is still bound to a previously redeemed external identity when the new address invitation is sent
  4. The team deleted only the guest's invitation email, leaving the directory account and grants intact

Explanation

Correct Answer

C:

Correct diagnosis. The guest is still bound to a previously redeemed external identity when the new address invitation is sent. This fault explains the observed failure: Redemption repeatedly targets the stale external identity despite the new invitation address. The intended configuration would instead be: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access.

Incorrect Answers

A:

The guest restriction is left at the permissive member-equivalent setting. The reported symptom instead has this cause: The guest is still bound to a previously redeemed external identity when the new address invitation is sent. The corrective action is: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access.

B:

The invitee is created as an ordinary internal member without the intended external collaboration flow. The reported symptom instead has this cause: The guest is still bound to a previously redeemed external identity when the new address invitation is sent. The corrective action is: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access.

D:

The team deleted only the guest's invitation email, leaving the directory account and grants intact. The reported symptom instead has this cause: The guest is still bound to a previously redeemed external identity when the new address invitation is sent. The corrective action is: Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access.

Question 94

A change board will approve one identity configuration to satisfy: A regulated tenant wants guests to accept terms before using protected resources, without affecting regular internal browsing. Which change should it approve?

  1. Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope
  2. Configure the supported SAML federation settings for the external identity provider with validated issuer, endpoints, and trust material
  3. Set Microsoft Entra cross-tenant access inbound B2B collaboration settings to allow the named partner, with suitable app and user scopes
  4. Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly

Explanation

Correct Answer

A:

Correct implementation. Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope. It meets the stated requirement: A regulated tenant wants guests to accept terms before using protected resources, without affecting regular internal browsing. Acceptance evidence is: The invited guest is presented the terms and cannot reach the target app without acceptance.

Incorrect Answers

B:

The SAML issuer or signing certificate does not match the configured trust. That condition is not the problem here: A terms document exists but is not assigned through the relevant access policy. The targeted implementation is: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

C:

The inbound cross-tenant policy was configured for the wrong tenant ID. That condition is not the problem here: A terms document exists but is not assigned through the relevant access policy. The targeted implementation is: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

D:

The host assumed all external tenants' MFA claims were automatically trusted. That condition is not the problem here: A terms document exists but is not assigned through the relevant access policy. The targeted implementation is: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

Question 95

The team implemented the following change: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope. The acceptance requirement was: A regulated tenant wants guests to accept terms before using protected resources, without affecting regular internal browsing. Which observed outcome most directly proves the change works?

  1. The invited guest is presented the terms and cannot reach the target app without acceptance
  2. An unauthorized member cannot invite a new vendor, and an existing approved guest can still reach its allocated resource
  3. An in-scope source internal member is provisioned as a cross-tenant B2B object in the target while source external guests and excluded members are not provisioned
  4. A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls

Explanation

Correct Answer

A:

Correct acceptance check. The invited guest is presented the terms and cannot reach the target app without acceptance. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

B:

Even if restricting new guest invitations to authorized inviters while preserving explicitly granted access for existing guests succeeds, this does not prove the required identity-control outcome. The decisive check is: The invited guest is presented the terms and cannot reach the target app without acceptance.

C:

Even if configuring source-tenant push synchronization of in-scope internal members with source attribute mappings succeeds, this does not prove the required identity-control outcome. The decisive check is: The invited guest is presented the terms and cannot reach the target app without acceptance.

D:

Even if configuring the approved partner's inbound cross-tenant trust for MFA succeeds, this does not prove the required identity-control outcome. The decisive check is: The invited guest is presented the terms and cannot reach the target app without acceptance.

Question 96

An engineer troubleshoots an identity solution for: A regulated tenant wants guests to accept terms before using protected resources, without affecting regular internal browsing. The pilot result is: The guest opens the resource directly without acknowledging the terms. What is the most likely relevant fault?

  1. The resource tenant did not enable the relevant cross-tenant trust setting for the partner
  2. The SAML issuer or signing certificate does not match the configured trust
  3. The invitee is created as an ordinary internal member without the intended external collaboration flow
  4. A terms document exists but is not assigned through the relevant access policy

Explanation

Correct Answer

D:

Correct diagnosis. A terms document exists but is not assigned through the relevant access policy. This fault explains the observed failure: The guest opens the resource directly without acknowledging the terms. The intended configuration would instead be: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

Incorrect Answers

A:

The resource tenant did not enable the relevant cross-tenant trust setting for the partner. The reported symptom instead has this cause: A terms document exists but is not assigned through the relevant access policy. The corrective action is: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

B:

The SAML issuer or signing certificate does not match the configured trust. The reported symptom instead has this cause: A terms document exists but is not assigned through the relevant access policy. The corrective action is: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

C:

The invitee is created as an ordinary internal member without the intended external collaboration flow. The reported symptom instead has this cause: A terms document exists but is not assigned through the relevant access policy. The corrective action is: Publish and require Microsoft Entra terms of use through the intended Conditional Access policy scope.

Question 97

An identity project has this requirement: Two companies use a shared SaaS app but the host must trust only one external partner's MFA claim. Which configuration should the administrator implement?

  1. Set Microsoft Entra cross-tenant access inbound B2B collaboration settings to allow the named partner, with suitable app and user scopes
  2. Evaluate and configure cross-tenant inbound trust for partner device claims only when the organization accepts the associated trust model
  3. Remove the departing internal member from the source provisioning scope and verify supported target soft-deletion/deprovisioning without treating cross-tenant sync as an independent account migration
  4. Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly

Explanation

Correct Answer

D:

Correct implementation. Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly. It meets the stated requirement: Two companies use a shared SaaS app but the host must trust only one external partner's MFA claim. Acceptance evidence is: A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls.

Incorrect Answers

A:

The inbound cross-tenant policy was configured for the wrong tenant ID. That condition is not the problem here: The host assumed all external tenants' MFA claims were automatically trusted. The targeted implementation is: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

B:

The resource tenant did not enable the relevant cross-tenant trust setting for the partner. That condition is not the problem here: The host assumed all external tenants' MFA claims were automatically trusted. The targeted implementation is: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

C:

The employee stays in the source-side provisioning assignment or filter scope. That condition is not the problem here: The host assumed all external tenants' MFA claims were automatically trusted. The targeted implementation is: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

Question 98

An auditor must verify this deployment decision: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly. Its purpose was: Two companies use a shared SaaS app but the host must trust only one external partner's MFA claim. Which test result is the strongest evidence?

  1. The removed source-scope user is soft-deleted or otherwise denied target access according to the tested cross-tenant synchronization behavior, while remaining in-scope users stay available
  2. A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls
  3. A normal guest cannot enumerate restricted directory profiles but can access explicitly shared resources
  4. A permitted partner user can access the approved app while another organization is blocked

Explanation

Correct Answer

B:

Correct acceptance check. A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if removing the departing internal member from the source provisioning scope succeeds, this does not prove the required identity-control outcome. The decisive check is: A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls.

C:

Even if applying the supported external-collaboration guest access restrictions succeeds, this does not prove the required identity-control outcome. The decisive check is: A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls.

D:

Even if setting Microsoft Entra cross-tenant access inbound B2B collaboration settings to allow the named partner succeeds, this does not prove the required identity-control outcome. The decisive check is: A partner login with trusted MFA satisfies the protected app; a login without MFA still requires appropriate controls.

Question 99

A change appears correct at a glance, but the requirement is still unmet: Two companies use a shared SaaS app but the host must trust only one external partner's MFA claim. The key observed symptom is: A properly authenticated approved partner is required to repeat MFA despite configured expectation. Which cause should be investigated first?

  1. The host assumed all external tenants' MFA claims were automatically trusted
  2. The SAML issuer or signing certificate does not match the configured trust
  3. The guest restriction is left at the permissive member-equivalent setting
  4. The employee stays in the source-side provisioning assignment or filter scope

Explanation

Correct Answer

A:

Correct diagnosis. The host assumed all external tenants' MFA claims were automatically trusted. This fault explains the observed failure: A properly authenticated approved partner is required to repeat MFA despite configured expectation. The intended configuration would instead be: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

Incorrect Answers

B:

The SAML issuer or signing certificate does not match the configured trust. The reported symptom instead has this cause: The host assumed all external tenants' MFA claims were automatically trusted. The corrective action is: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

C:

The guest restriction is left at the permissive member-equivalent setting. The reported symptom instead has this cause: The host assumed all external tenants' MFA claims were automatically trusted. The corrective action is: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

D:

The employee stays in the source-side provisioning assignment or filter scope. The reported symptom instead has this cause: The host assumed all external tenants' MFA claims were automatically trusted. The corrective action is: Configure the approved partner's inbound cross-tenant trust for MFA and scope the access policy accordingly.

Question 100

A team is reviewing its proposed Microsoft Entra change. The required outcome is: A B2B guest no longer works for the vendor but still appears assigned to multiple groups and apps. What is the most suitable implementation?

  1. Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process
  2. Remove the departing internal member from the source provisioning scope and verify supported target soft-deletion/deprovisioning without treating cross-tenant sync as an independent account migration
  3. Review the guest object's redemption state and follow supported reset-redemption or reinvitation steps rather than creating duplicate uncontrolled access
  4. Invite the supplier through Microsoft Entra B2B collaboration with appropriate tenant and resource permissions

Explanation

Correct Answer

A:

Correct implementation. Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process. It meets the stated requirement: A B2B guest no longer works for the vendor but still appears assigned to multiple groups and apps. Acceptance evidence is: The terminated guest cannot access the app and the access review records the removal decision.

Incorrect Answers

B:

The employee stays in the source-side provisioning assignment or filter scope. That condition is not the problem here: The team deleted only the guest's invitation email, leaving the directory account and grants intact. The targeted implementation is: Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process.

C:

The guest is still bound to a previously redeemed external identity when the new address invitation is sent. That condition is not the problem here: The team deleted only the guest's invitation email, leaving the directory account and grants intact. The targeted implementation is: Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process.

D:

The invitee is created as an ordinary internal member without the intended external collaboration flow. That condition is not the problem here: The team deleted only the guest's invitation email, leaving the directory account and grants intact. The targeted implementation is: Remove the obsolete guest's resource assignments and disable or remove the guest account under the tenant's offboarding process.