McAfee Secure

Microsoft SC-300 Bundle

Exam Code: SC-300

Exam Name Microsoft Identity and Access Administrator

Certification Provider: Microsoft

Corresponding Certification: Microsoft Certified: Identity and Access Administrator Associate

Microsoft SC-300 Bundle $44.99
SC-300 Sample 1 SC-300 Sample 2 SC-300 Sample 3 SC-300 Sample 4 SC-300 Sample 5 SC-300 Sample 6 SC-300 Sample 7 SC-300 Sample 8 SC-300 Sample 9 SC-300 Sample 10

100% Microsoft SC-300 Guaranteed Success With Testking Training Materials

Get Real SC-300 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    SC-300 Questions & Answers

    490 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual SC-300 exam while allowing you to hone and measure every aspect of your test-taking ability.

  • SC-300 Video Course

    SC-300 Training Course

    43 Video Lectures

    SC-300 Video Course is developed by Microsoft Professionals to help you pass the SC-300 exam.

    Description

    This course will improve your knowledge and skills required to pass Microsoft Identity and Access Administrator exam.
  • Study Guide

    SC-300 Study Guide

    599 PDF Pages

    Developed by industry experts, this 599-page guide spells out in painstaking detail all of the information you need to ace SC-300 exam.

Microsoft Identity and Access Administrator (SC-300) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    490 Questions

    $124.99
  • SC-300 Video Course

    Training Course

    43 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    599 PDF Pages

    $29.99

Microsoft SC-300 Practice Test 34

Question 330

During post-change review of the requirement “Two APIs share a tenant but each must validate access tokens intended for its own audience,” an auditor observes: API B accepts a validly signed token originally issued for API A. Which root-cause finding would explain that symptom?

  1. The service used a system-assigned identity whose lifecycle ended with the old compute instance
  2. The federated credential's subject or audience does not match the issued workload token
  3. The receiving API does not verify the audience claim
  4. The VM app is requesting a token for the wrong resource audience

Explanation

Correct Answer

C:

Correct diagnosis. The receiving API does not verify the audience claim. This fault explains the observed failure: API B accepts a validly signed token originally issued for API A. The intended configuration would instead be: Configure the API's expected audience/app ID URI and validate issuer, audience, signature and scopes or roles as appropriate.

Incorrect Answers

A:

The service used a system-assigned identity whose lifecycle ended with the old compute instance. The reported symptom instead has this cause: The receiving API does not verify the audience claim. The corrective action is: Configure the API's expected audience/app ID URI and validate issuer, audience, signature and scopes or roles as appropriate.

B:

The federated credential's subject or audience does not match the issued workload token. The reported symptom instead has this cause: The receiving API does not verify the audience claim. The corrective action is: Configure the API's expected audience/app ID URI and validate issuer, audience, signature and scopes or roles as appropriate.

D:

The VM app is requesting a token for the wrong resource audience. The reported symptom instead has this cause: The receiving API does not verify the audience claim. The corrective action is: Configure the API's expected audience/app ID URI and validate issuer, audience, signature and scopes or roles as appropriate.

Question 331

A change board will approve one identity configuration to satisfy: A microservice hosted on Azure App Service needs an identity that cannot survive deletion of the web app. Which change should it approve?

  1. Enable a system-assigned managed identity and scope its downstream permissions to that service identity
  2. Enable a Function system-assigned managed identity and grant least-privileged Key Vault secret data-plane access through the vault’s configured Azure RBAC model or supported access-policy model
  3. Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments
  4. Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource

Explanation

Correct Answer

A:

Correct implementation. Enable a system-assigned managed identity and scope its downstream permissions to that service identity. It meets the stated requirement: A microservice hosted on Azure App Service needs an identity that cannot survive deletion of the web app. Acceptance evidence is: Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically.

Incorrect Answers

B:

The Function identity lacks the Key Vault secret data-plane authorization required by its configured vault permission model. That condition is not the problem here: A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The targeted implementation is: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

C:

The app selected a default or different attached identity client ID instead of the one granted resource access. That condition is not the problem here: A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The targeted implementation is: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

D:

The application still runs under a personal Global Administrator session. That condition is not the problem here: A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The targeted implementation is: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

Question 332

After configuring: Enable a system-assigned managed identity and scope its downstream permissions to that service identity, an engineer performs a targeted pilot for this objective: A microservice hosted on Azure App Service needs an identity that cannot survive deletion of the web app. What result constitutes a pass?

  1. Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically
  2. The unattended job calls the approved Graph endpoint under the application identity without a signed-in employee
  3. A signed-in user obtains a token reflecting approved delegated permissions and cannot exceed their own authorization
  4. The workload reaches only its approved target and authentication logs identify the application principal

Explanation

Correct Answer

A:

Correct acceptance check. Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

B:

Even if granting narrowly scoped Microsoft Graph application permissions through the application registration succeeds, this does not prove the required identity-control outcome. The decisive check is: Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically.

C:

Even if registering the application for delegated user sign-in succeeds, this does not prove the required identity-control outcome. The decisive check is: Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically.

D:

Even if using a dedicated service principal or managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically.

Question 333

A team must isolate a broken configuration. Goal: A microservice hosted on Azure App Service needs an identity that cannot survive deletion of the web app. Symptom: The original service identity still exists as a separate resource after the web app is removed. Which hypothesis most precisely accounts for the observed result?

  1. Investigators compare only display names without validating the stable service principal object ID
  2. A user-assigned identity was used even though identity lifecycle was meant to be bound to that app
  3. The service used a system-assigned identity whose lifecycle ended with the old compute instance
  4. The app selected a default or different attached identity client ID instead of the one granted resource access

Explanation

Correct Answer

B:

Correct diagnosis. A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. This fault explains the observed failure: The original service identity still exists as a separate resource after the web app is removed. The intended configuration would instead be: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

Incorrect Answers

A:

Investigators compare only display names without validating the stable service principal object ID. The reported symptom instead has this cause: A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The corrective action is: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

C:

The service used a system-assigned identity whose lifecycle ended with the old compute instance. The reported symptom instead has this cause: A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The corrective action is: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

D:

The app selected a default or different attached identity client ID instead of the one granted resource access. The reported symptom instead has this cause: A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. The corrective action is: Enable a system-assigned managed identity and scope its downstream permissions to that service identity.

Question 334

An identity project has this requirement: An Azure deployment pipeline must access a target subscription but cannot keep password credentials in its build variables. Which configuration should the administrator implement?

  1. Inspect resource access logs and service-principal sign-in activity using principal and client IDs
  2. Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope
  3. Enable a system-assigned managed identity and scope its downstream permissions to that service identity
  4. Create a user-assigned managed identity, grant its needed roles, and attach it to each replacement workload

Explanation

Correct Answer

B:

Correct implementation. Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope. It meets the stated requirement: An Azure deployment pipeline must access a target subscription but cannot keep password credentials in its build variables. Acceptance evidence is: A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials.

Incorrect Answers

A:

Investigators compare only display names without validating the stable service principal object ID. That condition is not the problem here: A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The targeted implementation is: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

C:

A user-assigned identity was used even though identity lifecycle was meant to be bound to that app. That condition is not the problem here: A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The targeted implementation is: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

D:

The service used a system-assigned identity whose lifecycle ended with the old compute instance. That condition is not the problem here: A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The targeted implementation is: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

Question 335

The requirement is: An Azure deployment pipeline must access a target subscription but cannot keep password credentials in its build variables. The technical change was: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope. Which observation validates the intended boundary?

  1. The token identifies the selected user-assigned identity and its precisely granted data/resource role, not another attached workload identity
  2. A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials
  3. A token exchange from the approved external workload succeeds and a different subject fails, with no static secret stored
  4. The VM retrieves only the approved vault object using its identity endpoint without any stored application secret

Explanation

Correct Answer

B:

Correct acceptance check. A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if selecting the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector succeeds, this does not prove the required identity-control outcome. The decisive check is: A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials.

C:

Even if creating an application registration succeeds, this does not prove the required identity-control outcome. The decisive check is: A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials.

D:

Even if enabling an appropriate managed identity on the VM succeeds, this does not prove the required identity-control outcome. The decisive check is: A trusted pipeline run deploys in the allowed resource group without a client secret; other repositories cannot exchange credentials.

Question 336

The deployment owner asks why this identity requirement failed: An Azure deployment pipeline must access a target subscription but cannot keep password credentials in its build variables. The test shows: An unrelated branch can obtain deployment tokens and modify the target resource group. Which fault is the best diagnosis?

  1. The federated credential's subject or audience does not match the issued workload token
  2. The application still runs under a personal Global Administrator session
  3. The service used a system-assigned identity whose lifecycle ended with the old compute instance
  4. A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal

Explanation

Correct Answer

D:

Correct diagnosis. A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. This fault explains the observed failure: An unrelated branch can obtain deployment tokens and modify the target resource group. The intended configuration would instead be: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

Incorrect Answers

A:

The federated credential's subject or audience does not match the issued workload token. The reported symptom instead has this cause: A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The corrective action is: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

B:

The application still runs under a personal Global Administrator session. The reported symptom instead has this cause: A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The corrective action is: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

C:

The service used a system-assigned identity whose lifecycle ended with the old compute instance. The reported symptom instead has this cause: A broad wildcard federated subject allows untrusted pipeline branches to assume the same deployment principal. The corrective action is: Configure an approved federated workload identity for the deployment principal and assign minimal Azure RBAC at target scope.

Question 337

An identity engineer has two independent tasks. Task 1: A key rotation incident requires an application operator to locate which workload identity actually accessed an Azure resource. Task 2: A storage-processing job receives authorization-denied errors even though its managed identity token request succeeds. Which TWO configuration changes jointly meet both tasks?

  1. Inspect resource access logs and service-principal sign-in activity using principal and client IDs
  2. Select the intended user-assigned managed identity by its client ID or supported Azure SDK credential selector, and separately use its principal object ID for downstream RBAC role assignments
  3. Use a dedicated service principal or managed identity, grant narrowly scoped resource RBAC, and acquire a token for the resource
  4. Grant the managed identity an appropriate Storage Blob Data Reader or other narrowly necessary Blob data-plane role at the intended container/account scope; do not mistake Azure Reader for blob content access
  5. Create an application registration and configure workload identity federation with the trusted external issuer and subject

Explanation

Correct Answers

A:

Correct for task 1. Inspect resource access logs and service-principal sign-in activity using principal and client IDs. This directly addresses the first requirement: A key rotation incident requires an application operator to locate which workload identity actually accessed an Azure resource. Verify it by checking: The recorded application/service principal ID ties each resource request to the actual workload, not a named human account.

D:

Correct for task 2. Grant the managed identity an appropriate Storage Blob Data Reader or other narrowly necessary Blob data-plane role at the intended container/account scope; do not mistake Azure Reader for blob content access. This addresses the independent second requirement: A storage-processing job receives authorization-denied errors even though its managed identity token request succeeds. Verify it by checking: The identity reads an allowed blob with the Blob data role while another scoped container stays inaccessible despite successful token acquisition.

Incorrect Answers

B:

The app selected a default or different attached identity client ID instead of the one granted resource access. To satisfy task 1, use: Inspect resource access logs and service-principal sign-in activity using principal and client IDs. For task 2, use: Grant the managed identity an appropriate Storage Blob Data Reader or other narrowly necessary Blob data-plane role at the intended container/account scope; do not mistake Azure Reader for blob content access.

C:

The application still runs under a personal Global Administrator session. To satisfy task 1, use: Inspect resource access logs and service-principal sign-in activity using principal and client IDs. For task 2, use: Grant the managed identity an appropriate Storage Blob Data Reader or other narrowly necessary Blob data-plane role at the intended container/account scope; do not mistake Azure Reader for blob content access.

E:

The federated credential's subject or audience does not match the issued workload token. To satisfy task 1, use: Inspect resource access logs and service-principal sign-in activity using principal and client IDs. For task 2, use: Grant the managed identity an appropriate Storage Blob Data Reader or other narrowly necessary Blob data-plane role at the intended container/account scope; do not mistake Azure Reader for blob content access.

Question 338

The owner wants independent acceptance evidence after the team chose: Inspect resource access logs and service-principal sign-in activity using principal and client IDs. It was meant to solve: A key rotation incident requires an application operator to locate which workload identity actually accessed an Azure resource. Which result demonstrates success?

  1. The recorded application/service principal ID ties each resource request to the actual workload, not a named human account
  2. The same identity principal is associated with the old and replacement compute resources, and retains scoped access
  3. The workload reaches only its approved target and authentication logs identify the application principal
  4. Deleting the App Service removes the attached system identity lifecycle, and a replacement app cannot inherit the old principal automatically

Explanation

Correct Answer

A:

Correct acceptance check. The recorded application/service principal ID ties each resource request to the actual workload, not a named human account. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

B:

Even if creating a user-assigned managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: The recorded application/service principal ID ties each resource request to the actual workload, not a named human account.

C:

Even if using a dedicated service principal or managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: The recorded application/service principal ID ties each resource request to the actual workload, not a named human account.

D:

Even if enabling a system-assigned managed identity succeeds, this does not prove the required identity-control outcome. The decisive check is: The recorded application/service principal ID ties each resource request to the actual workload, not a named human account.

Question 339

The deployment was intended to satisfy: A key rotation incident requires an application operator to locate which workload identity actually accessed an Azure resource. During testing, this happened: Access records cannot be reconciled because identical app display names mask distinct principals. Which configuration defect best explains the failure?

  1. Investigators compare only display names without validating the stable service principal object ID
  2. The application still runs under a personal Global Administrator session
  3. The app requested only delegated scopes and never received application permission consent
  4. The service used a system-assigned identity whose lifecycle ended with the old compute instance

Explanation

Correct Answer

A:

Correct diagnosis. Investigators compare only display names without validating the stable service principal object ID. This fault explains the observed failure: Access records cannot be reconciled because identical app display names mask distinct principals. The intended configuration would instead be: Inspect resource access logs and service-principal sign-in activity using principal and client IDs.

Incorrect Answers

B:

The application still runs under a personal Global Administrator session. The reported symptom instead has this cause: Investigators compare only display names without validating the stable service principal object ID. The corrective action is: Inspect resource access logs and service-principal sign-in activity using principal and client IDs.

C:

The app requested only delegated scopes and never received application permission consent. The reported symptom instead has this cause: Investigators compare only display names without validating the stable service principal object ID. The corrective action is: Inspect resource access logs and service-principal sign-in activity using principal and client IDs.

D:

The service used a system-assigned identity whose lifecycle ended with the old compute instance. The reported symptom instead has this cause: Investigators compare only display names without validating the stable service principal object ID. The corrective action is: Inspect resource access logs and service-principal sign-in activity using principal and client IDs.

Question 340

An identity engineer has two independent tasks. Task 1: A vendor's SaaS application supports SAML SSO and company users must authenticate through Microsoft Entra. Task 2: A team manages 70 enterprise applications and needs a curated app catalog without changing individual app authorization. Which TWO configuration changes jointly meet both tasks?

  1. Configure the SaaS enterprise application's SAML SSO identifiers, reply URL, signing certificate and claims mapping
  2. Use Microsoft Entra enterprise app provisioning logs filtered by the application and target user
  3. Publish the supported web app with Microsoft Entra Application Proxy connectors and assign the intended users
  4. Stage the new SAML certificate and coordinate SP-side trust changes before switching the active signing certificate
  5. Build Microsoft Entra application collections for the appropriate groups of apps

Explanation

Correct Answers

A:

Correct for task 1. Configure the SaaS enterprise application's SAML SSO identifiers, reply URL, signing certificate and claims mapping. This directly addresses the first requirement: A vendor's SaaS application supports SAML SSO and company users must authenticate through Microsoft Entra. Verify it by checking: The vendor accepts the signed assertion for an assigned employee and rejects a mismatched audience.

E:

Correct for task 2. Build Microsoft Entra application collections for the appropriate groups of apps. This addresses the independent second requirement: A team manages 70 enterprise applications and needs a curated app catalog without changing individual app authorization. Verify it by checking: Users see the curated application collection while their actual access remains governed by each app's assignment.

Incorrect Answers

B:

The analyst searched only interactive user sign-in logs instead of provisioning logs. To satisfy task 1, use: Configure the SaaS enterprise application's SAML SSO identifiers, reply URL, signing certificate and claims mapping. For task 2, use: Build Microsoft Entra application collections for the appropriate groups of apps.

C:

The Application Proxy connector is not registered or cannot reach the on-premises app endpoint. To satisfy task 1, use: Configure the SaaS enterprise application's SAML SSO identifiers, reply URL, signing certificate and claims mapping. For task 2, use: Build Microsoft Entra application collections for the appropriate groups of apps.

D:

The signing certificate was activated before the service provider trusted its public key. To satisfy task 1, use: Configure the SaaS enterprise application's SAML SSO identifiers, reply URL, signing certificate and claims mapping. For task 2, use: Build Microsoft Entra application collections for the appropriate groups of apps.