[Q161-Q177] Free Sample Questions to Practice SC-300 Certification Test Engine [Apr-2026]

SC-300 Microsoft

admin -

April 16, 2026

4.5/5 - (4 votes)

Free Sample Questions to Practice SC-300 Certification Test Engine [Apr-2026]

2026 Valid SC-300 Real Exam Questions, practice Microsoft Certified: Identity and Access Administrator Associate

To pass the Microsoft SC-300 exam, candidates must demonstrate their ability to implement and manage Azure Active Directory, configure access management for Azure resources, and implement multi-factor authentication. They must also be able to monitor and troubleshoot identity and access solutions, as well as implement conditional access policies in Azure. SC-300 exam consists of multiple-choice questions and requires a passing score of 700 out of 1000. Passing the Microsoft SC-300 exam is a great way to demonstrate your expertise in identity and access management in Azure, and can help you advance your career in this field.

NO.161 You have a Microsoft 365 tenant.
Sometimes, users use external, third-party applications that require limited access to the Microsoft 365 data of the respective user. The users register the applications in Azure Active Directory (Azure AD).
You need to receive an alert if a registered application gains read and write access to the users’ email.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/cloud-app-security/app-permission-policy

NO.162 You have an Azure AD tenant that contains the users shown in the following table.

You have the Azure AD Identity Protection policies shown in the following table.

You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation

NO.163 You have a Microsoft Entra tenant named contoso.com that contains an administrative unit named AU1 and two users named User1 and User2. User1 is a member of AU1.
You need to perform the following role assignments:
* User1: Security Administrator
* User2: User Administrator
For which scopes can each user be assigned the role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

NO.164 Hotspot Question
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.
User1 has the devices shown in the following table.

On November 5, 2020, you create and enforce terms of use in contoso.com that has the following settings:
– Name: Terms1
– Display name: Contoso terms of use
– Require users to expand the terms of use: On
– Require users to consent on every device: On
– Expire consents: On
– Expire starting on: December 10, 2020
– Frequency: Monthly
On November 15, 2020, User1 accepts Terms1 on Device3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:
Box 1: Yes
Because User1 has not yet accepted the terms on Device1.
Box 2: Yes
Because User1 has not yet accepted the terms on Device2. User1 will be prompted to register the device before the terms can be accepted.
Box 3: No
Because User1 has already accepted the terms on Device3. The terms do not expire until December 10th and then monthly after that.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/terms-of-use

NO.165 You have Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1.
Department has the users shown in the Users exhibit. (Click the Users tab.)

Department1 has the groups shown in the Groups exhibit (Click the Groups tab.)

The User Administrator role assignments are shown in the Assignments exhibit. (Click the Assignments tab.)

The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:

NO.166 You have a Microsoft Entra tenant that has a Microsoft Entra ID P1 license.
You need to review the Microsoft Entra ID sign-in logs to investigate sign-ins that occurred in the past.
For how long does Microsoft Entra ID store events in the sign-in logs?

14 days

30 days

90days

365 days

Let’s break this down step by step based on Microsoft Entra’s sign-in log retention policies as outlined in Microsoft Identity and Access Administrator documentation.
Understanding Microsoft Entra Sign-In Logs and Licensing:
Microsoft Entra ID (formerly Azure Active Directory) provides sign-in logs as part of its auditing and reporting capabilities. These logs track user and application sign-in activities, which are critical for security monitoring and compliance.
The question specifies that the tenant has a Microsoft Entra ID P1 license. Licensing is a key factor in determining the retention period for sign-in logs in Microsoft Entra.
Retention Period Based on License Tier:
Microsoft Entra ID has different editions: Free, P1, and P2. Each edition offers different capabilities and retention periods for audit and sign-in logs.
Free Tier:The Free edition of Microsoft Entra ID retains sign-in logs for7 days.
P1 Tier:With a Microsoft Entra ID P1 license (as mentioned in the question), sign-in logs are retained for30 days. This is a standard feature of the P1 license, which provides enhanced security and monitoring capabilities compared to the Free tier.
P2 Tier:The P2 license also retains sign-in logs for30 days, but it includes additional features like risk-based conditional access and identity protection, which are not relevant to the retention period.
Analysis of the Options:
A . 14 days:This is incorrect. Microsoft Entra ID does not have a 14-day retention period for sign-in logs under any license tier. This might be confused with other types of logs or services, but it does not apply here.
B . 30 days:This is correct. As stated, with a P1 license, Microsoft Entra retains sign-in logs for 30 days.
C . 90 days:This is incorrect. Microsoft Entra ID does not retain sign-in logs for 90 days, even with a P1 or P2 license. To retain logs for longer periods (e.g., 90 days or more), you would need to export the logs to a storage solution like Azure Monitor Logs or a SIEM system (e.g., Microsoft Sentinel), which allows for custom retention periods.
D . 365 days:This is incorrect for the same reason as option C. Microsoft Entra ID’s default retention for sign-in logs is 30 days with a P1 or P2 license. Achieving a 365-day retention would require exporting logs to an external storage solution.
Additional Considerations:
If the tenant integrates Microsoft Entra logs with Azure Monitor or Microsoft Sentinel, the retention period can be extended based on the configuration of those services. However, the question specifically asks about Microsoft Entra’s default retention, not an extended retention through integration.
The retention period for audit logs (which track changes to the directory, like user or group modifications) also follows the same pattern: 7 days for Free, 30 days for P1/P2. However, this question is about sign-in logs, not audit logs.
Conclusion:Given that the tenant has a Microsoft Entra ID P1 license, the sign-in logs are retained for 30 days. Therefore, the correct answer isB.
Reference:
Microsoft Entra ID documentation: “Audit and sign-in logs retention” (Microsoft Learn:https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-sign-in-logs#how-long-are-logs-retained) Microsoft Entra ID P1 and P2 feature comparison: “Editions of Microsoft Entra ID” (Microsoft Learn:https://learn.microsoft.com/en-us/entra/fundamentals/licensing) Microsoft Identity and Access Administrator (SC-300) exam study guide, which covers monitoring and reporting capabilities, including log retention periods.

NO.167 You have an Azure AD tenant and an Azure web app named App1.
You need to provide guest users with self-service sign-up for App1. The solution must meet the following requirements:
* Guest users must be able to sign up by using a one-time password.
* The users must provide their first name, last name, city, and email address during the sign-up process.
What should you configure in the Azure Active Directory admin center for each requirement? To answer, select the appropriate options in the answer are a.
NOTE: Each correct selection is worth one point.

NO.168 You have a Microsoft 365 tenant named contoso.com.
Guest user access is enabled.
Users are invited to collaborate with contoso.com as shown in the following table.

From the External collaboration settings in the Azure Active Directory admin center, you configure the Collaboration restrictions settings as shown in the following exhibit.

From a Microsoft SharePoint Online site, a user invites [email protected] to the site.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE:Each correct selection is worth one point.

Explanation:

Box 1: Yes
Invitations can only be sent to outlook.com. Therefore, User1 can accept the invitation and access the application.
Box 2. Yes
Invitations can only be sent to outlook.com. However, User2 has already received and accepted an invitation so User2 can access the application.
Box 3. No
Invitations can only be sent to outlook.com. Therefore, User3 will not receive an invitation.
Based on the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module
“Manage external collaboration settings in Azure AD”, Azure Active Directory provides granular control over external collaboration through External collaboration settings and Collaboration restrictions. These settings control which external domains can receive guest invitations.
The configuration in the exhibit shows:
“Allow invitations only to the specified domains (most restrictive)”
Target Domain: Outlook.com
This means invitations can only be sent to users whose email domains are explicitly listed (in this case, Outlook.com). Any other external domain (like fabrikam.com or adatum.com) is not permitted to receive or accept invitations.
[email protected]
* Domain Outlook.com is listed under allowed domains.
* Although the invitation was initially not accepted, since the domain is allowed, User1 can accept the invitation and gain access.# Answer: Yes [email protected]
* The domain fabrikam.com is not listed in the allowed domains list.
* However, this user already accepted the invitation before the restriction was configured.
* Once a guest has accepted the invitation, they are an existing guest object in Azure AD and retain access unless explicitly removed.# Answer: Yes [email protected]
* Domain adatum.com is not listed under allowed domains.
* Therefore, this user cannot receive or accept new invitations for collaboration resources like SharePoint Online.# Answer: No Summary from Microsoft documentation:
“When collaboration restrictions are set to allow invitations only to specified domains, invitations to all other domains are blocked. Existing guest users who have already accepted invitations remain unaffected.” (Source: Microsoft Learn – Configure external collaboration settings in Azure AD)

NO.169 You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.

Which objects can you add as members to Group3?

User2 and Group2 only

User2, Group1, and Group2 only

User1, User2, Group1 and Group2

User1 and User2 only

User2 only

Reference:
https://bitsizedbytes.wordpress.com/2018/12/10/distribution-security-and-office-365-groups-nesting/

NO.170 You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.
An administrator deletes User1.
You need to identity the following:
* How many days after the account of User1 is deleted can you restore the account?
* Which is the least privileged role that can be used to restore User1?
What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation:

NO.171 You have an Azure Active Directory (Azure AD) tenant that contains an administrative unit named Department1.
Department1 has the users shown in the Users exhibit. (Click the Users tab.)

Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)

Department1 has the user administrator assignments shown in the Assignments exhibit. (Click the Assignments tab.)

The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units

NO.172 You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.
From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?

the Administrative units blade in the Azure Active Directory admin center

the Set-AzureAdUser cmdlet

the Groups blade in the Azure Active Directory admin center

the Sec-MsolUserLicense cmdlet

Reference:
https://docs.microsoft.com/en-us/powershell/module/msonline/set-msoluserlicense?view=azureadps-1.0

NO.173 You have an Azure AD tenant named contoso.com that contains the resources shown in the following table.

You create a user named Admin1.
You need to ensure that Admin1 can enable Security defaults for contoso.com.
What should you do first?

Delete Package1.

Delete CAPolicy1.

Assign Admin1 the Authentication Administrator role for Au1.

Configure Identity Governance.

To configure security defaults in your directory, you must be assigned at least the Security Administrator role. By default the first account in any directory is assigned a higher privileged role known as Global Administrator.
Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults. (Imply that Conditional Access policies has conflict with security defaults)
https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

NO.174 You need to meet the technical requirements for the probability that user identifies were compromised.
What should the users do first, and what should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.175 You have a Microsoft Entra tenant that contains the identities shown in the following table.

Group1 has the following configurations:
* Owners: User1, User4
* Members: User1, Managed2, Gioup2
You create an access review that has the following settings:
* Name: Review1
* Review scope: Select Teams + Groups
* Group: Group1
* Scope: All users
* Select reviewers: Group owner(s)
The Fallback reviewers: setting is NOT configured.

Explanation:

NO.176 You have a Microsoft 365 tenant.
You need to Identity users who have leaked credentials. The solution must meet the following requirements:
* Identity sign-ms by users who are suspected of having leaked credentials.
* Flag the sign-ins as a high-risk event.
* Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.
What should you use? To answer, select the appropriate options m the answer area.

Explanation:

NO.177 You have a Microsoft 365 E5 subscription.
You need to create a dynamic user group that will include all the users that do NOT have a department defined in their user profile.
How should you complete the membership rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Loading …

Passing the Microsoft SC-300 Certification Exam demonstrates that an IT professional has the skills and knowledge necessary to manage identity and access in Microsoft environments. It is a valuable certification for those who work with AAD and Microsoft 365, as it shows potential employers that the individual is capable of implementing and managing identity and access solutions in a secure and efficient manner. Additionally, certified professionals can expect to earn a higher salary and have more career opportunities than those who are not certified in this area.

Genuine SC-300 Exam Dumps Free Demo Valid QA’s: https://www.dumpstests.com/SC-300-latest-test-dumps.html