Microsoft SC-300 QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | STUVIA VERIFIED | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
Domain 1: Implement an Identity Management Solution (Questions 1–35)
,1. You need to ensure that when a user is deleted from on-premises Active Directory, their cloud identity is also
deleted. What should you configure?
A. Password Hash Synchronization
B. Azure AD Connect Sync with Accidental Delete Prevention disabled
C. Azure AD Connect Cloud Sync
D. Microsoft Identity Manager
Answer: B
Rationale: Azure AD Connect Sync (the full sync engine) supports the deletion of cloud users when the on-
premises source object is deleted. However, by default, Accidental Delete Prevention is enabled and will block
deletions until disabled. Password Hash Sync and Cloud Sync do not natively propagate deletions in the same
way.
2. A company wants to require MFA for all users but exclude a group of service accounts. What should you use?
A. Conditional Access policy
B. Security defaults
C. Per-user MFA
D. Authentication methods policy
,Answer: A
Rationale: Conditional Access policies allow granular control, including the ability to include all users and
exclude specific groups (like service accounts). Security defaults apply to all users and cannot be scoped. Per-
user MFA is legacy and not recommended for new deployments.
3. You need to configure self-service password reset (SSPR) so users can reset their passwords using a mobile
app notification. What should you enable?
A. Microsoft Authenticator app
B. Email
C. Security questions
D. Office phone
Answer: A
Rationale: The Microsoft Authenticator app supports push notifications and one-time passcodes for SSPR. Email
and security questions are other options, but only the Authenticator app provides app notifications.
4. Which tool should you use to review sign-in logs and identify risky sign-ins?
A. Microsoft 365 admin center
B. Azure AD Identity Protection
, C. Microsoft Purview
D. Exchange admin center
Answer: B
Rationale: Azure AD Identity Protection (part of Microsoft Entra ID Protection) provides risk detections, risky
sign-ins, and risky users reports. It is the primary tool for identity risk analysis.
5. You need to implement passwordless authentication for Windows 10 devices. What should you use?
A. Windows Hello for Business
B. Microsoft Authenticator
C. FIDO2 security keys
D. All of the above
Answer: D
Rationale: All three are valid passwordless methods. Windows Hello for Business uses biometrics/PIN, Microsoft
Authenticator supports phone sign-in, and FIDO2 keys are hardware-based passwordless credentials.
6. A user reports they cannot use SSPR. You verify they are licensed and enabled. What is the most likely
cause?
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | STUVIA VERIFIED | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
Domain 1: Implement an Identity Management Solution (Questions 1–35)
,1. You need to ensure that when a user is deleted from on-premises Active Directory, their cloud identity is also
deleted. What should you configure?
A. Password Hash Synchronization
B. Azure AD Connect Sync with Accidental Delete Prevention disabled
C. Azure AD Connect Cloud Sync
D. Microsoft Identity Manager
Answer: B
Rationale: Azure AD Connect Sync (the full sync engine) supports the deletion of cloud users when the on-
premises source object is deleted. However, by default, Accidental Delete Prevention is enabled and will block
deletions until disabled. Password Hash Sync and Cloud Sync do not natively propagate deletions in the same
way.
2. A company wants to require MFA for all users but exclude a group of service accounts. What should you use?
A. Conditional Access policy
B. Security defaults
C. Per-user MFA
D. Authentication methods policy
,Answer: A
Rationale: Conditional Access policies allow granular control, including the ability to include all users and
exclude specific groups (like service accounts). Security defaults apply to all users and cannot be scoped. Per-
user MFA is legacy and not recommended for new deployments.
3. You need to configure self-service password reset (SSPR) so users can reset their passwords using a mobile
app notification. What should you enable?
A. Microsoft Authenticator app
B. Email
C. Security questions
D. Office phone
Answer: A
Rationale: The Microsoft Authenticator app supports push notifications and one-time passcodes for SSPR. Email
and security questions are other options, but only the Authenticator app provides app notifications.
4. Which tool should you use to review sign-in logs and identify risky sign-ins?
A. Microsoft 365 admin center
B. Azure AD Identity Protection
, C. Microsoft Purview
D. Exchange admin center
Answer: B
Rationale: Azure AD Identity Protection (part of Microsoft Entra ID Protection) provides risk detections, risky
sign-ins, and risky users reports. It is the primary tool for identity risk analysis.
5. You need to implement passwordless authentication for Windows 10 devices. What should you use?
A. Windows Hello for Business
B. Microsoft Authenticator
C. FIDO2 security keys
D. All of the above
Answer: D
Rationale: All three are valid passwordless methods. Windows Hello for Business uses biometrics/PIN, Microsoft
Authenticator supports phone sign-in, and FIDO2 keys are hardware-based passwordless credentials.
6. A user reports they cannot use SSPR. You verify they are licensed and enabled. What is the most likely
cause?
