Microsoft Identity and Access Administrator Associate (SC-300) · 28% practice allocation

Microsoft SC-300: Implement authentication and access management Practice Questions

5 free sample questions from the Implement authentication and access management domain, with answers and explanations. The full SC-300 bank has 64 questions across 4 domains. Questions are scenario-based and written from the official Microsoft exam guide.

1.

Remote staff need access to an on-premises file server and an internal web app without a traditional VPN, with per-app Conditional Access. Which Global Secure Access component should you deploy?

  • A. Microsoft Entra Private Access with the Global Secure Access client✓ Correct
  • B. Microsoft Entra Internet Access with web content filtering
  • C. The Microsoft traffic profile with universal tenant restrictions
  • D. Microsoft Entra application proxy with a connector installed next to the file server
Explanation

Private Access gives identity-centric, VPN-less access to private apps (any TCP/UDP app, not only web) through the Global Secure Access client and connectors, with Conditional Access per app. Internet Access secures internet and SaaS traffic. The Microsoft traffic profile covers Microsoft 365 traffic. Application proxy only publishes web apps, so it wouldn't cover the SMB file share.

2.

Synced users change their passwords through SSPR in the cloud, but the new password doesn't work on their domain-joined PCs. What is missing?

  • A. Seamless SSO
  • B. Password hash synchronization
  • C. Microsoft Entra password protection DC agents
  • D. Password writeback✓ Correct
Explanation

Password writeback (configured in Entra Connect Sync or Cloud Sync) writes cloud SSPR changes back to on-premises AD. Without it, a synced user's on-premises password is unchanged. Password hash sync flows the other way, seamless SSO only affects sign-in prompts, and password protection blocks weak passwords.

3.

Before enabling a new Conditional Access policy that blocks legacy authentication, you want to see who it would affect without blocking anyone. What should you do?

  • A. Create the policy in the Off state and use sign-in logs
  • B. Enable it for a pilot group of administrators only
  • C. Run the What If tool for every user in the tenant and export the combined results
  • D. Create it in report-only mode and review sign-in logs and the insights workbook✓ Correct
Explanation

Report-only mode evaluates the policy at every sign-in and logs the result (success, failure, user action required) without enforcing it; the Conditional Access insights and reporting workbook aggregates the results. An Off policy isn't evaluated. What If simulates one sign-in at a time and is used for troubleshooting, not tenant-wide impact.

4.

Your tenant still has the user risk and sign-in risk policies configured on the ID Protection blade. What should you do?

  • A. Nothing; ID Protection risk policies take precedence over Conditional Access and stay supported
  • B. Recreate them as risk-based Conditional Access policies, then disable the legacy ones✓ Correct
  • C. Convert them to authentication methods registration campaigns
  • D. Move them into a PIM role setting
Explanation

Microsoft retires the legacy risk policies configured in ID Protection on October 1, 2026 and documents the migration: create equivalent risk-based Conditional Access policies (often from templates) in report-only mode, turn them on, then disable the old ones. Microsoft also says not to combine user risk and sign-in risk in the same policy.

5.

Accessing a SharePoint site labelled Highly Confidential must require a compliant device and phishing-resistant MFA, even for users already signed in. Other SharePoint sites keep the normal policy. What should you configure?

  • A. An authentication context targeted by a CA policy, applied to the site via its sensitivity label✓ Correct
  • B. A Conditional Access policy for SharePoint Online with a device filter and a rule on the site URL
  • C. A session policy in Defender for Cloud Apps that blocks downloads
  • D. A protected action for the SharePoint site permission
Explanation

Authentication context lets an app or resource (a SharePoint site via a sensitivity label, Defender for Cloud Apps, PIM) request step-up; a Conditional Access policy that targets the context defines the requirements. Conditional Access can't target individual site URLs. Protected actions apply to Microsoft Entra permissions such as changing Conditional Access policies, not SharePoint sites.

Test yourself across every SC-300 domain

The free SC-300 practice test mixes about 20 questions weighted like the exam. The full 64-question bank adds instant grading, flashcards and a timed mock exam.

Take the free SC-300 practice testPractice the full bank

Study this domain

Implement authentication and access management study guide (SC-300) →

Other SC-300 domains

← All Microsoft Identity and Access Administrator Associate study resources