McAfee Secure

Microsoft SC-300 Bundle

Exam Code: SC-300

Exam Name Microsoft Identity and Access Administrator

Certification Provider: Microsoft

Corresponding Certification: Microsoft Certified: Identity and Access Administrator Associate

Microsoft SC-300 Bundle $44.99
SC-300 Sample 1 SC-300 Sample 2 SC-300 Sample 3 SC-300 Sample 4 SC-300 Sample 5 SC-300 Sample 6 SC-300 Sample 7 SC-300 Sample 8 SC-300 Sample 9 SC-300 Sample 10

100% Microsoft SC-300 Guaranteed Success With Testking Training Materials

Get Real SC-300 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    SC-300 Questions & Answers

    490 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual SC-300 exam while allowing you to hone and measure every aspect of your test-taking ability.

  • SC-300 Video Course

    SC-300 Training Course

    43 Video Lectures

    SC-300 Video Course is developed by Microsoft Professionals to help you pass the SC-300 exam.

    Description

    This course will improve your knowledge and skills required to pass Microsoft Identity and Access Administrator exam.
  • Study Guide

    SC-300 Study Guide

    599 PDF Pages

    Developed by industry experts, this 599-page guide spells out in painstaking detail all of the information you need to ace SC-300 exam.

Microsoft Identity and Access Administrator (SC-300) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    490 Questions

    $124.99
  • SC-300 Video Course

    Training Course

    43 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    599 PDF Pages

    $29.99

Microsoft SC-300 Practice Test 32

Question 310

A change board will approve one identity configuration to satisfy: A third-party automation service outside Azure must access a Microsoft Graph API without a reusable client secret. Which change should it approve?

  1. Create an application registration and configure workload identity federation with the trusted external issuer and subject
  2. Inspect resource access logs and service-principal sign-in activity using principal and client IDs
  3. Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments
  4. Grant narrowly scoped Microsoft Graph application permissions through the application registration and obtain appropriate administrator consent

Explanation

Correct Answer

A:

Correct implementation. Create an application registration and configure workload identity federation with the trusted external issuer and subject. It meets the stated requirement: A third-party automation service outside Azure must access a Microsoft Graph API without a reusable client secret. Acceptance evidence is: A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored.

Incorrect Answers

B:

Investigators compare only display names without validating the stable service principal object ID. That condition is not the problem here: The federated credential's subject or audience does not match the issued workload token. The targeted implementation is: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

C:

The app selected a default or different attached identity client ID instead of the one granted resource access. That condition is not the problem here: The federated credential's subject or audience does not match the issued workload token. The targeted implementation is: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

D:

The app requested only delegated scopes and never received application permission consent. That condition is not the problem here: The federated credential's subject or audience does not match the issued workload token. The targeted implementation is: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

Question 311

After configuring: Create an application registration and configure workload identity federation with the trusted external issuer and subject, an engineer performs a targeted pilot for this objective: A third-party automation service outside Azure must access a Microsoft Graph API without a reusable client secret. What result constitutes a pass?

  1. A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials
  2. A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored
  3. The unattended job calls the approved Graph endpoint under the application identity without a signed-in employee
  4. The recorded application/service principal ID ties each resource request to the actual workload, not a named human account

Explanation

Correct Answer

B:

Correct acceptance check. A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if configuring an approved federated workload identity for the deployment principal succeeds, this does not prove the required identity-control outcome. The decisive check is: A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored.

C:

Even if granting narrowly scoped Microsoft Graph application permissions through the application registration succeeds, this does not prove the required identity-control outcome. The decisive check is: A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored.

D:

Even if inspecting resource access logs succeeds, this does not prove the required identity-control outcome. The decisive check is: A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored.

Question 312

A team must isolate a broken configuration. Goal: A third-party automation service outside Azure must access a Microsoft Graph API without a reusable client secret. Symptom: The external workload receives a federated-credential mismatch at token exchange. Which hypothesis most precisely accounts for the observed result?

  1. The receiving API does not verify the audience claim
  2. The federated credential's subject or audience does not match the issued workload token
  3. The app requested only delegated scopes and never received application permission consent
  4. The app selected a default or different attached identity client ID instead of the one granted resource access

Explanation

Correct Answer

B:

Correct diagnosis. The federated credential's subject or audience does not match the issued workload token. This fault explains the observed failure: The external workload receives a federated-credential mismatch at token exchange. The intended configuration would instead be: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

Incorrect Answers

A:

The receiving API does not verify the audience claim. The reported symptom instead has this cause: The federated credential's subject or audience does not match the issued workload token. The corrective action is: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

C:

The app requested only delegated scopes and never received application permission consent. The reported symptom instead has this cause: The federated credential's subject or audience does not match the issued workload token. The corrective action is: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

D:

The app selected a default or different attached identity client ID instead of the one granted resource access. The reported symptom instead has this cause: The federated credential's subject or audience does not match the issued workload token. The corrective action is: Create an application registration and configure workload identity federation with the trusted external issuer and subject.

Question 313

A change request covers two Microsoft Entra needs. Requirement A: An internal web app needs Microsoft Entra authentication for human employees rather than granting broad app-only permissions. Requirement B: A background Azure job has a user-assigned managed identity but needs to select it explicitly when more than one identity is attached. Select TWO actions, one for each requirement.

  1. Grant narrowly scoped Microsoft Graph application permissions through the application registration and obtain appropriate administrator consent
  2. Register the application for delegated user sign-in and request only the required delegated scopes
  3. Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments
  4. Configure the API's expected audience/app ID URI and validate issuer, audience, signature and scopes or roles as appropriate
  5. Create an application registration and configure workload identity federation with the trusted external issuer and subject

Explanation

Correct Answers

B:

Correct for task 1. Register the application for delegated user sign-in and request only the required delegated scopes. This directly addresses the first requirement: An internal web app needs Microsoft Entra authentication for human employees rather than granting broad app-only permissions. Verify it by checking: A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization.

C:

Correct for task 2. Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments. This addresses the independent second requirement: A background Azure job has a user-assigned managed identity but needs to select it explicitly when more than one identity is attached. Verify it by checking: The token identifies the selected user-assigned identity and its precisely granted data/resource role, not another attached workload identity.

Incorrect Answers

A:

The app requested only delegated scopes and never received application permission consent. To satisfy task 1, use: Register the application for delegated user sign-in and request only the required delegated scopes. For task 2, use: Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments.

D:

The receiving API does not verify the audience claim. To satisfy task 1, use: Register the application for delegated user sign-in and request only the required delegated scopes. For task 2, use: Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments.

E:

The federated credential's subject or audience does not match the issued workload token. To satisfy task 1, use: Register the application for delegated user sign-in and request only the required delegated scopes. For task 2, use: Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments.

Question 314

The requirement is: An internal web app needs Microsoft Entra authentication for human employees rather than granting broad app-only permissions. The technical change was: Register the application for delegated user sign-in and request only the required delegated scopes. Which observation validates the intended boundary?

  1. Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically
  2. The Function presents its system-assigned identity token and retrieves only its approved vault secret, with no long-lived client password in settings
  3. A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored
  4. A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization

Explanation

Correct Answer

D:

Correct acceptance check. A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if enabling a system-assigned managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization.

B:

Even if enabling a Function system-assigned managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization.

C:

Even if creating an application registration succeeds, this does not prove the required identity-control outcome. The decisive check is: A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization.

Question 315

The deployment owner asks why this identity requirement failed: An internal web app needs Microsoft Entra authentication for human employees rather than granting broad app-only permissions. The test shows: The service makes calls as a workload principal with tenant-wide access rather than within the user context. Which fault is the best diagnosis?

  1. The VM app is requesting a token for the wrong resource audience
  2. The app is configured with application permissions instead of delegated permissions for its interactive calls
  3. A user-assigned identity was used even though identity lifecycle was meant to be bound to that app
  4. A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal

Explanation

Correct Answer

B:

Correct diagnosis. The app is configured with application permissions instead of delegated permissions for its interactive calls. This fault explains the observed failure: The service makes calls as a workload principal with tenant-wide access rather than within the user context. The intended configuration would instead be: Register the application for delegated user sign-in and request only the required delegated scopes.

Incorrect Answers

A:

The VM app is requesting a token for the wrong resource audience. The reported symptom instead has this cause: The app is configured with application permissions instead of delegated permissions for its interactive calls. The corrective action is: Register the application for delegated user sign-in and request only the required delegated scopes.

C:

A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The reported symptom instead has this cause: The app is configured with application permissions instead of delegated permissions for its interactive calls. The corrective action is: Register the application for delegated user sign-in and request only the required delegated scopes.

D:

A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The reported symptom instead has this cause: The app is configured with application permissions instead of delegated permissions for its interactive calls. The corrective action is: Register the application for delegated user sign-in and request only the required delegated scopes.

Question 316

A team is reviewing its proposed Microsoft Entra change. The required outcome is: An Azure VM must retrieve a certificate from Key Vault when its code starts, without installing credentials on disk. What is the most suitable implementation?

  1. Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope
  2. Enable a Function system-assigned managed identity and grant least-privileged Key Vault secret data-plane access through the vault’s configured Azure RBAC model or supported access-policy model
  3. Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method
  4. Inspect resource access logs and service-principal sign-in activity using principal and client IDs

Explanation

Correct Answer

C:

Correct implementation. Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method. It meets the stated requirement: An Azure VM must retrieve a certificate from Key Vault when its code starts, without installing credentials on disk. Acceptance evidence is: The VM retrieves only the approved vault object using its identity endpoint without any stored application secret.

Incorrect Answers

A:

A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. That condition is not the problem here: The VM app is requesting a token for the wrong resource audience. The targeted implementation is: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

B:

The Function identity lacks the Key Vault secret data-plane authorization required by its configured vault permission model. That condition is not the problem here: The VM app is requesting a token for the wrong resource audience. The targeted implementation is: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

D:

Investigators compare only display names without validating the stable service principal object ID. That condition is not the problem here: The VM app is requesting a token for the wrong resource audience. The targeted implementation is: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

Question 317

The owner wants independent acceptance evidence after the team chose: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method. It was meant to solve: An Azure VM must retrieve a certificate from Key Vault when its code starts, without installing credentials on disk. Which result demonstrates success?

  1. The recorded application/service principal ID ties each resource request to the actual workload, not a named human account
  2. A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials
  3. The VM retrieves only the approved vault object using its identity endpoint without any stored application secret
  4. The Function presents its system-assigned identity token and retrieves only its approved vault secret, with no long-lived client password in settings

Explanation

Correct Answer

C:

Correct acceptance check. The VM retrieves only the approved vault object using its identity endpoint without any stored application secret. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if inspecting resource access logs succeeds, this does not prove the required identity-control outcome. The decisive check is: The VM retrieves only the approved vault object using its identity endpoint without any stored application secret.

B:

Even if configuring an approved federated workload identity for the deployment principal succeeds, this does not prove the required identity-control outcome. The decisive check is: The VM retrieves only the approved vault object using its identity endpoint without any stored application secret.

D:

Even if enabling a Function system-assigned managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: The VM retrieves only the approved vault object using its identity endpoint without any stored application secret.

Question 318

The deployment was intended to satisfy: An Azure VM must retrieve a certificate from Key Vault when its code starts, without installing credentials on disk. During testing, this happened: The Key Vault request is rejected despite an apparently successful local identity token call. Which configuration defect best explains the failure?

  1. The VM app is requesting a token for the wrong resource audience
  2. Investigators compare only display names without validating the stable service principal object ID
  3. The Function identity lacks the Key Vault secret data-plane authorization required by its configured vault permission model
  4. The receiving API does not verify the audience claim

Explanation

Correct Answer

A:

Correct diagnosis. The VM app is requesting a token for the wrong resource audience. This fault explains the observed failure: The Key Vault request is rejected despite an apparently successful local identity token call. The intended configuration would instead be: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

Incorrect Answers

B:

Investigators compare only display names without validating the stable service principal object ID. The reported symptom instead has this cause: The VM app is requesting a token for the wrong resource audience. The corrective action is: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

C:

The Function identity lacks the Key Vault secret data-plane authorization required by its configured vault permission model. The reported symptom instead has this cause: The VM app is requesting a token for the wrong resource audience. The corrective action is: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

D:

The receiving API does not verify the audience claim. The reported symptom instead has this cause: The VM app is requesting a token for the wrong resource audience. The corrective action is: Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method.

Question 319

During an access-management pilot, the engineer is tasked with the following: An application must call an Azure resource using short-lived tokens while following least privilege and avoiding shared administrator credentials. Which action best addresses the requirement?

  1. Enable an appropriate managed identity on the VM and grant its principal certificate/secret access as required by the retrieval method
  2. Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource
  3. Grant narrowly scoped Microsoft Graph application permissions through the application registration and obtain appropriate administrator consent
  4. Inspect resource access logs and service-principal sign-in activity using principal and client IDs

Explanation

Correct Answer

B:

Correct implementation. Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource. It meets the stated requirement: An application must call an Azure resource using short-lived tokens while following least privilege and avoiding shared administrator credentials. Acceptance evidence is: The workload reaches only its approved target and authentication logs identify the application principal.

Incorrect Answers

A:

The VM app is requesting a token for the wrong resource audience. That condition is not the problem here: The application still runs under a personal Global Administrator session. The targeted implementation is: Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource.

C:

The app requested only delegated scopes and never received application permission consent. That condition is not the problem here: The application still runs under a personal Global Administrator session. The targeted implementation is: Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource.

D:

Investigators compare only display names without validating the stable service principal object ID. That condition is not the problem here: The application still runs under a personal Global Administrator session. The targeted implementation is: Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource.

Question 320

An operational review checks whether the change “Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource” meets this need: An application must call an Azure resource using short-lived tokens while following least privilege and avoiding shared administrator credentials. Which finding supports acceptance?

  1. The Function presents its system-assigned identity token and retrieves only its approved vault secret, with no long-lived client password in settings
  2. The unattended job calls the approved Graph endpoint under the application identity without a signed-in employee
  3. The workload reaches only its approved target and authentication logs identify the application principal
  4. The recorded application/service principal ID ties each resource request to the actual workload, not a named human account

Explanation

Correct Answer

C:

Correct acceptance check. The workload reaches only its approved target and authentication logs identify the application principal. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if enabling a Function system-assigned managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: The workload reaches only its approved target and authentication logs identify the application principal.

B:

Even if granting narrowly scoped Microsoft Graph application permissions through the application registration succeeds, this does not prove the required identity-control outcome. The decisive check is: The workload reaches only its approved target and authentication logs identify the application principal.

D:

Even if inspecting resource access logs succeeds, this does not prove the required identity-control outcome. The decisive check is: The workload reaches only its approved target and authentication logs identify the application principal.