Microsoft SC-300 Practice Test

SC-300 practice test: what's covered

• Identity & Access Administrator Associate

Free SC-300 sample questions

1. Your finance team grows constantly and you want every user whose department attribute equals "Finance" to automatically gain membership in a security group used for license assignment, without manual edits. Which Entra ID group configuration meets this need?

   • A. A dynamic membership group with the rule (user.department -eq "Finance")
   • B. An assigned security group with members added manually each onboarding
   • C. A Microsoft 365 group with self-service join enabled for all staff
   • D. A mail-enabled distribution list synced from on-premises Exchange
   Show answer

   Correct: A. Dynamic membership uses an attribute rule so Entra re-evaluates and auto-populates members, which is exactly what license targeting needs and requires Entra ID P1. An assigned group is wrong because it relies on manual edits. A self-service Microsoft 365 group does not filter by department, and a synced distribution list is for mail routing, not dynamic security membership.

2. An administrator is documenting the identity object types present in a Microsoft Entra tenant so the security team understands what each represents. Which of the following are valid distinct identity types in Entra ID? (Choose THREE)

   • A. Member user representing an internal employee account
   • B. Guest user invited through B2B collaboration
   • C. Managed identity automatically handled by Azure for resources
   • D. Group policy object replicated from Active Directory
   • E. Organizational unit container holding delegated permissions
   Show answer

   Correct: A and B and C. Member users, B2B guest users, and managed identities are all real Entra ID identity objects, where a managed identity is an Azure-managed service principal needing no stored secret. Group policy objects and organizational units are Active Directory on-premises constructs that do not exist in Entra ID, so they are incorrect because Entra uses administrative units and Conditional Access rather than GPOs and OUs.

3. A regional helpdesk should be able to reset passwords only for users located in the Mumbai office, but not for the rest of the tenant. As the Entra administrator, how should you scope this delegated control?

   • A. Create an administrative unit for Mumbai users and assign the Password Administrator role scoped to it
   • B. Grant the helpdesk the tenant-wide Global Administrator role for convenience
   • C. Add the helpdesk staff as owners of every individual Mumbai user object
   • D. Enable self-service password reset and remove all helpdesk involvement
   Show answer

   Correct: A. Administrative units restrict a role's reach to a defined subset of users, so a scoped Password Administrator role gives least-privilege regional control. Global Administrator is wrong because it grants tenant-wide power far beyond the requirement. Making them user owners does not confer password-reset rights, and SSPR alone does not address helpdesk-assisted resets.

4. You are deploying hybrid identity for a new project and need a lightweight, cloud-managed synchronization option that supports multiple disconnected on-premises Active Directory forests with minimal server footprint. Which provisioning approach fits best?

   • A. Microsoft Entra Cloud Sync using lightweight provisioning agents
   • B. Microsoft Entra Connect Sync with a single full synchronization server
   • C. Manual CSV bulk import of all user accounts each week
   • D. Active Directory Federation Services token transformation only
   Show answer

   Correct: A. Cloud Sync uses lightweight agents managed from the cloud and natively supports multiple disconnected forests, making it ideal for new, simpler deployments. Connect Sync is heavier and better for advanced filtering or writeback scenarios, not minimal footprint. Manual CSV import is not real-time synchronization, and AD FS handles federated authentication, not directory object provisioning.

5. During an Entra Connect migration between forests, the sync identity for existing users keeps breaking and creating duplicates. Which source anchor attribute should be used to keep the on-premises to cloud identity binding stable through such changes?

   • A. The ms-DS-ConsistencyGuid attribute as the immutable source anchor
   • B. The user principal name because it is human readable
   • C. The on-premises SAM account name from the legacy domain
   • D. The user's current job title stored in Active Directory
   Show answer

   Correct: A. ms-DS-ConsistencyGuid is the recommended immutable source anchor because it remains stable even when objects move between forests, preventing duplicate cloud accounts. UPN is wrong because it can change and is not immutable. SAM account names are not unique across forests, and job title is mutable descriptive data unsuitable as an identity anchor.

Last updated: 2026-10-19

SC-300 practice test FAQ

Related practice tests

• Microsoft SC-200 practice test
• Microsoft SC-100 practice test
• Microsoft SC-900 practice test
• Entra Conditional Access troubleshooting practice test
• Okta Certified Professional practice test
• Azure AZ-500 practice test