About these questions
These five questions are original. We wrote them in the style of the SC-300 skills measured, covering all four domains. They are not real exam questions, and the real exam will word things differently.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.
Question 1 (Implement and manage user identities)
Northwind has an account forest and a separate resource forest. Each employee’s mailbox attributes live in the resource forest, while the sign-in account lives in the account forest. Both objects must become one Microsoft Entra user. Which tool should you deploy?
- A. Microsoft Entra Cloud Sync with one configuration per forest
- B. Microsoft Entra Cloud Sync with several agents installed for failover
- C. Microsoft Entra Connect Sync
- D. Microsoft Entra Cloud Sync with attribute mapping expressions
Show the answer and explanation
Correct answer: C. Entra Connect Sync can join the objects of one user from multiple forests, including an account and resource forest, and merge their attributes into one cloud user. Cloud Sync with one configuration per forest, the closest wrong option, syncs each forest on its own and would not merge the two objects. Extra agents add resilience, not merging. Mapping expressions transform values from a single source object; they do not combine objects across forests.
Question 2 (Implement authentication and access management)
A sign-in by a user at Tailwind Traders is flagged with medium sign-in risk. A Conditional Access policy requires multifactor authentication for medium sign-in risk, and the user completes it successfully. What happens to the risk detection?
- A. It is remediated because the user passed multifactor authentication
- B. It remains active until an administrator dismisses it
- C. It is remediated only after the user changes their password
- D. It becomes a high user risk for review
Show the answer and explanation
Correct answer: A. Completing the required MFA proves the legitimate user is present, so the sign-in risk is self-remediated. Requiring a password change, the closest wrong option, is the control for user risk, which reflects the account as a whole rather than one sign-in. An administrator has to step in only when the user cannot complete the required control. Passing MFA does not raise any risk level.
Question 3 (Implement authentication and access management)
Adatum wants multifactor authentication for every administrator who manages Azure. You create a Conditional Access policy that targets the Windows Azure Service Management API. Which management tool is NOT covered by this policy and needs its own policy?
- A. The Azure portal in a browser
- B. Azure CLI
- C. The Az PowerShell module
- D. Microsoft Graph PowerShell
Show the answer and explanation
Correct answer: D. Microsoft Graph PowerShell calls the Microsoft Graph API, not Azure Resource Manager, so a policy on the Service Management API target never sees its sign-ins. The Azure portal, Azure CLI, and Az module all rely on Azure Resource Manager, so the policy covers them. The Az module is the closest wrong option because both are PowerShell tools, but the API they call is what decides coverage. To cover Graph tooling, you need a policy that targets that resource too.
Question 4 (Plan and implement workload identities)
Litware publishes an on-premises intranet app that uses Integrated Windows Authentication through Microsoft Entra Application Proxy. Users must get single sign-on. Which two actions should you perform? Choose two.
- A. Set the app’s single sign-on mode to password-based and store the credentials
- B. Set the app’s pre-authentication to Passthrough
- C. Set the single sign-on mode to Integrated Windows authentication and enter the app’s internal SPN
- D. Set the single sign-on mode to header-based and map the user principal name
- E. Configure the connector computer account for Kerberos constrained delegation to the app’s SPN
Show the answer and explanation
Correct answers: C and E. Application Proxy needs to be told to request a Kerberos ticket for the app’s service principal name, which is the Integrated Windows authentication setting. The connector’s computer account must also be allowed to delegate to that SPN so it can act on the user’s behalf. Header-based single sign-on, the closest wrong option, passes identity in HTTP headers, but an IWA app expects a Kerberos ticket. Password-based sign-on replays stored credentials into a form, and Passthrough skips Entra authentication, leaving no user identity to delegate.
Question 5 (Plan and automate identity governance)
Fabrikam has Microsoft Entra ID Governance. Everyone whose department is Finance must get the Finance Apps access package automatically, without submitting a request. When someone leaves Finance, they must keep access for ten more days to hand over work. What should you configure?
- A. A request policy for users in the directory with a ten-day expiration
- B. An access review of Finance users that repeats every ten days with auto-apply
- C. A dynamic group for Finance, added as a resource role in the access package
- D. An automatic assignment policy that keeps access for ten days after users fall out of scope
Show the answer and explanation
Correct answer: D. An automatic assignment policy uses a membership rule to add and remove assignments, and it lets you set how long access continues after a user stops matching the rule. The dynamic group in option C, the closest wrong option, removes members as soon as the attribute changes, so there is no ten-day grace period. A request policy still requires users to ask, and an access review recertifies existing access rather than granting it.
More guides for SC-300
- SC-300 Study Plan: 4 and 8 Week Schedules
- Is SC-300 Hard? An Honest Difficulty Check
- SC-300 Prerequisites and Skills Self-Check
- SC-300 Renewal and Retakes Explained
- Is SC-300 Worth It? An Honest Look
- SC-300 Cheat Sheet: Key Facts to Review
- SC-300 vs SC-500: Which Exam First?
Next step
If these felt comfortable, check the exam format and book. If a domain felt shaky, try more questions in the SC-300 practice tests.