Microsoft Identity and Access Administrator Associate (SC-300) · 24% practice allocation

Microsoft SC-300: Plan and implement workload identities Practice Questions

5 free sample questions from the Plan and implement workload identities domain, with answers and explanations. The full SC-300 bank has 64 questions across 4 domains. Questions are scenario-based and written from the official Microsoft exam guide.

1.

Twenty virtual machine scale set instances, recreated frequently, all need the same access to a storage account. Pre-authorisation must exist before the instances are created. Which identity fits best?

  • A. A system-assigned managed identity on each instance
  • B. A service principal with a certificate deployed to each instance
  • C. A user-assigned managed identity assigned to the scale set✓ Correct
  • D. The Entra Connect sync account
Explanation

A user-assigned managed identity is created independently, can be granted roles in advance, and can be attached to many resources, so recreated instances keep the same identity and permissions. System-assigned identities change each time a resource is recreated. Distributing certificates adds secret management.

2.

A script running on a VM uses a user-assigned managed identity to call Azure Resource Manager. It gets 403 Forbidden when reading a storage account's properties. What is the most likely fix?

  • A. Add the managed identity to the Global Readers directory role
  • B. Grant admin consent for the Azure Service Management API to the identity
  • C. Give the managed identity a client secret
  • D. Assign an Azure RBAC role such as Reader on the storage account✓ Correct
Explanation

Managed identities authenticate automatically, but authorisation to Azure resources comes from Azure RBAC role assignments at the right scope. Directory roles govern Microsoft Entra, not Azure resources. Managed identities don't have client secrets you manage.

3.

You are registering an app for your organisation's employees only. It runs in a web server and calls an API with client credentials. What credential should it use, according to Microsoft guidance for production apps?

  • A. A client secret set to the longest expiry the portal allows
  • B. The app's application (client) ID alone
  • C. A certificate, or a federated identity credential✓ Correct
  • D. A redirect URI on localhost
Explanation

Microsoft recommends certificates over client secrets for production confidential clients, and federated identity credentials (workload identity federation) remove secrets entirely where the platform supports it. The client ID isn't a credential, and redirect URIs aren't credentials.

4.

Your API must let administrators grant some callers read-only access and others read-write access, with the decision visible as a claim in the token. What should you define in the API's app registration?

  • A. App roles such as Data.Read and Data.ReadWrite✓ Correct
  • B. Two separate client secrets, one per access level
  • C. Optional claims for the groups claim only
  • D. A second app registration that exposes only the read-write version of the API
Explanation

App roles defined on an app registration appear in the roles claim of tokens and can be assigned to users, groups (for user apps) or service principals (as application permissions). Secrets are credentials, not authorisation. Group claims can work but tie authorisation to group IDs and have overage limits; app roles are the purpose-built option.

5.

In the Defender for Cloud Apps cloud app catalog, an app scores poorly on security and compliance. You want it flagged in discovery and, with enforcement enabled in the Defender for Endpoint integration, blocked on onboarded devices. What should you do?

  • A. Tag the app as Unsanctioned✓ Correct
  • B. Delete the app from the catalog
  • C. Create an app connector for it
  • D. Override its risk score to 10
Explanation

Marking an app Unsanctioned flags it in Cloud Discovery and, with the Defender for Endpoint integration, blocks it on onboarded devices. You can't delete catalog apps, connectors are for sanctioned apps you manage, and overriding the score doesn't block anything.

Test yourself across every SC-300 domain

The free SC-300 practice test mixes about 20 questions weighted like the exam. The full 64-question bank adds instant grading, flashcards and a timed mock exam.

Take the free SC-300 practice testPractice the full bank

Study this domain

Plan and implement workload identities study guide (SC-300) →

Other SC-300 domains

← All Microsoft Identity and Access Administrator Associate study resources