Free SC-300 practice test: 30 questions with answers

The Other clients option under the client apps condition targets legacy authentication protocols such as basic authentication. The other conditions select devices, networks or risk levels and do not identify legacy protocols.

Privileged Identity Management makes role assignments eligible, so users activate them for a set period, optionally after approval and MFA. Permanent assignments keep standing privilege, Azure Policy governs resource configuration, and access packages without expiry remove the time limit.

Identity Protection detects leaked credentials as user risk, and a user risk policy in Conditional Access can require a secure password change. Access reviews and entitlement management address access rights rather than compromised credentials, and a privileged access workstation is a device pattern for administrators.

The number of methods required to reset setting defines how many registered methods a user must verify during SSPR. Password writeback sends cloud password changes back to on-premises Active Directory, the banned password list blocks weak choices, and smart lockout limits repeated failed sign-ins.

A policy scoped to administrative directory roles and the Microsoft Azure Management app enforces MFA where it matters. Security defaults applies to all users and cannot be scoped to roles, a named location does not enforce MFA by itself, and a device compliance requirement is not a substitute for MFA.

FIDO2 security keys bind the authentication to the origin domain, so a phishing site cannot reuse the response. SMS, voice and email codes can be typed into a fake sign-in page, so they do not qualify as phishing-resistant.

A Temporary Access Pass is a time-limited credential that lets the user register methods such as a passkey. A permanent password leaves a long-lived secret in place, security questions are not a supported method, and a guest invitation is for external collaborators.

Entra password protection checks new passwords against a global banned list and a custom list that can include company terms. Password writeback syncs changes to on-premises Active Directory, token lifetime policies control token validity, and smart lockout limits failed sign-in attempts.

Pass-through authentication sends each sign-in to an on-premises agent that validates the password against Active Directory, so no password hashes are stored in the cloud. Password hash synchronization stores hashes in Entra ID, and AD FS needs a federation farm the scenario does not ask for. Seamless SSO is a single sign-on add-on that works alongside a sign-in method rather than replacing it.

The guest user access restrictions setting limits guests to their own directory objects, so they cannot enumerate other users or groups. Giving guests member-level access exposes much more of the directory. The other options grant broader rather than narrower access and do not meet the requirement.

A dynamic user group evaluates membership from user attributes, so new and departing users are added and removed automatically. Assigned membership needs manual upkeep, and dynamic device groups evaluate device attributes rather than user attributes. Nesting does not populate members from an attribute.

Entra ID accepts a TXT or an MX record carrying the value it generates to prove domain ownership. AAAA records map hostnames to IPv6 addresses, PTR records map addresses back to names, and SRV records advertise services, so none of those verify a domain.

User Administrator creates and manages users and groups, including resetting passwords for non-administrators, without rights over Conditional Access. Global Administrator is far broader than needed, Security Administrator can change security policy, and Global Reader can only view configuration.

Invited B2B collaboration users are created with userType set to Guest, which is the value that guest restrictions and guest-focused access reviews target. Member is for internal users, and External and Viewer are not userType values in Entra ID.

Sign-in logs show each authentication attempt, including MFA results, location, device and the Conditional Access policies applied. Audit logs record directory changes, provisioning logs track identity sync to other apps, and the Azure Activity log covers resource management operations.

SAML sign-in to a SaaS application is configured through an enterprise application, which holds the single sign-on settings and user assignments. Administrative units scope administration, dynamic groups hold memberships, and Azure Lighthouse delegates Azure resource management.

Access reviews and entitlement management are identity governance capabilities in Entra ID Governance. Azure Firewall, Azure Bastion and Defender for Endpoint are network, remote access and endpoint security products, not governance features.

Access packages in entitlement management bundle resources, add request and approval policies, and remove access when it expires. Dynamic groups use attributes rather than approvals and expiry, shared mailboxes do not provide that governance, and Azure Policy governs resource configuration.

A recurring access review repeats on a schedule, and its no-response setting can remove access automatically. A one-time review does not recur, a blanket block is not a review, and Terms of use does not confirm ongoing need.

Entra Terms of Use presents the document and records each acceptance, and a Conditional Access policy enforces it before access. A link in an application is neither enforced nor recorded, Azure Policy governs resources, and Identity Protection handles risk rather than acceptance.

Setting the reviewer to group owners lets the people responsible for each group approve or deny its members. A shared mailbox and role holders are not the right reviewers, and guests should not decide on their own or others' access.

Require justification on activation makes the requester enter a reason, which is recorded in the audit history. MFA on assignment and the duration setting control other aspects of activation, and ticket numbers are optional rather than a PIM requirement.

PIM can require MFA and approval before an eligible role is activated. Deleting virtual machines, managing firewall rules and rotating storage keys are resource operations that PIM does not perform.

A managed identity gives the function an Entra identity whose credentials Azure manages, so no secret is stored. The other options rely on stored secrets or shared accounts, which is exactly what this scenario is meant to avoid.

App registrations accept client secrets and X.509 certificates for client credentials flows. SSH public keys, PGP keys and Kerberos keytabs are used by other systems and are not accepted by app registrations.

Workload identity federation lets the workflow exchange a short-lived GitHub OIDC token for a Microsoft Entra token, so no secret is stored. The other options rely on long-lived secrets or personal credentials, which are harder to rotate and audit.

Application permissions let a service call Graph with its own identity, and they require admin consent. Delegated permissions act on behalf of a signed-in user, and a role or CLI session is not a proper app identity for this purpose.

A system-assigned managed identity has the same lifecycle as the resource that owns it, so it is removed with the VM. A user-assigned identity exists independently, and a service principal with a secret or a B2C account does not match this lifecycle.

AcrPull grants only the rights needed to pull images, which matches least privilege. Contributor and Owner grant far broader management rights, and Reader cannot pull images from the registry.

The admin consent request workflow lets users ask for access to an app that needs admin consent, and it routes the request to reviewers. The other features control network conditions, bundled resources or acceptance of terms, not consent.