Microsoft SC-300 Practice Test 1

Question 1

A university employs regional helpdesk operators who may reset ordinary students' passwords in the West campus but must not administer East campus users. Which proposed configuration or implementation directly meets the stated requirement?

Assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.
Create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators.
Use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization.
Inspect all active role assignments including group-based and scoped grants before deciding effective directory administrative permissions.

Explanation

Correct Answer

Assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators. The solution acts at the intended identity, policy or application scope. A successful result is testable: reset a test West user password and confirm the same operator is denied a test East user reset. The competing configuration error is: the Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope.

Incorrect Answers

That action implements the separate role-assignable group protection decision. It is appropriate when a security team wants a group that can receive a sensitive Microsoft Entra administrator role without letting an ordinary Groups Administrator add unauthorized members. The present case instead requires the specific delegated password reset by administrative unit change: assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.

That action implements the separate administrative unit membership versus isolation decision. It is appropriate when a retailer delegates user management to regional teams and assumes administrative units also hide all directory objects from users in other regions. The present case instead requires the specific delegated password reset by administrative unit change: assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.

That action implements the separate built-in role evaluation decision. It is appropriate when a service-desk analyst has User Administrator through one group and Reports Reader directly; an auditor must determine the analyst's actual capabilities. The present case instead requires the specific delegated password reset by administrative unit change: assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.

Question 2

A university employs regional helpdesk operators who may reset ordinary students' passwords in the West campus but must not administer East campus users. The proposed change is: Assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators. After applying the intended configuration, which observation most directly proves that the required behavior works?

Test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility.
Change a test employee's maintained location and confirm the AU membership and delegated-management scope recalculate.
Open the applicable Entra sign-in experience in a private browser session and confirm approved visuals and helpdesk text.
Reset a test West user password and confirm the same operator is denied a test East user reset.

Explanation

Correct Answer

Reset a test West user password and confirm the same operator is denied a test East user reset. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators. Failure would be evident in this case: an operator can reset an East student password despite the intended regional restriction.

Incorrect Answers

The proposed observation checks the different administrative unit membership versus isolation scenario. Even a successful test would not establish the requested outcome here: reset a test West user password and confirm the same operator is denied a test East user reset.

The proposed observation checks the different administrative unit dynamic scoping scenario. Even a successful test would not establish the requested outcome here: reset a test West user password and confirm the same operator is denied a test East user reset.

The proposed observation checks the different company branding and sign-in experience scenario. Even a successful test would not establish the requested outcome here: reset a test West user password and confirm the same operator is denied a test East user reset.

Question 3

An operator can reset an East student password despite the intended regional restriction. Which root cause best explains the described result rather than merely treating its symptoms?

Administrative units constrain supported administrator roles but are not universal directory data isolation boundaries.
The Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope.
The privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group.
The membership rule was configured as static or the source location attribute was not updated and reevaluated.

Explanation

Correct Answer

The Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope. This is the causal explanation of the observed behavior: an operator can reset an East student password despite the intended regional restriction. Address the underlying mechanism with: assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators. Then confirm: reset a test West user password and confirm the same operator is denied a test East user reset.

Incorrect Answers

This diagnosis fits a separate administrative unit membership versus isolation incident: Cross-region users still appear in directory searches although management edits are correctly restricted. It does not explain this case's observed failure; the Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope.

This diagnosis fits a separate role-assignable group protection incident: An ordinary group owner unexpectedly adds a user who inherits a directory administrator role. It does not explain this case's observed failure; the Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope.

This diagnosis fits a separate administrative unit dynamic scoping incident: Transferred staff remain in the previous unit, so former regional administrators can still manage them. It does not explain this case's observed failure; the Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope.

Question 4

A university employs regional helpdesk operators who may reset ordinary students' passwords in the West campus but must not administer East campus users. Select TWO complementary decisions: the correct technical implementation and the ongoing preventive control. Evidence-only tests and controls for a different scenario are not substitutes for those two responsibilities.

Assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.
Inspect all active role assignments including group-based and scoped grants before deciding effective directory administrative permissions.
Document that scope limits administration, not every read or authentication path, and test visibility separately.
Create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators.
Review role assignment scope when operators change campuses and use test identities from both units.

Explanation

Correct Answers

Review role assignment scope when operators change campuses and use test identities from both units. This reduces future drift after the initial control is deployed: assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators. Recheck the actual behavior with: reset a test West user password and confirm the same operator is denied a test East user reset.

Incorrect Answers

This control manages future administrative unit membership versus isolation drift, but it does not reduce the continuing exposure in the described delegated password reset by administrative unit case. The correct safeguard is: review role assignment scope when operators change campuses and use test identities from both units.

Question 5

A security team wants a group that can receive a sensitive Microsoft Entra administrator role without letting an ordinary Groups Administrator add unauthorized members. Which proposed configuration or implementation directly meets the stated requirement?

Create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators.
Assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.
Create a custom Microsoft Entra role containing only supported required permissions and assign it at the narrowest supported scope.
Configure a supported dynamic user membership rule for the administrative unit and protect the underlying location attributes from unauthorized edits.

Explanation

Correct Answer

Create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators. The solution acts at the intended identity, policy or application scope. A successful result is testable: attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference. The competing configuration error is: the privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group.

Incorrect Answers

That action implements the separate delegated password reset by administrative unit decision. It is appropriate when a university employs regional helpdesk operators who may reset ordinary students' passwords in the West campus but must not administer East campus users. The present case instead requires the specific role-assignable group protection change: create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators.

That action implements the separate custom role restricted administration decision. It is appropriate when a department needs a delegate to update selected group properties but not tenant-wide Conditional Access or role assignments. The present case instead requires the specific role-assignable group protection change: create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators.

That action implements the separate administrative unit dynamic scoping decision. It is appropriate when a hospital wants a regional administrative unit populated by eligible employees based on maintained location attributes instead of manually updating membership on each transfer. The present case instead requires the specific role-assignable group protection change: create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators.

Question 6

A security team wants a group that can receive a sensitive Microsoft Entra administrator role without letting an ordinary Groups Administrator add unauthorized members. The proposed change is: Create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators. After applying the intended configuration, which observation most directly proves that the required behavior works?

Review both direct and group-derived assignments and test a permitted user operation versus an unrelated forbidden control.
Attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference.
Open the applicable Entra sign-in experience in a private browser session and confirm approved visuals and helpdesk text.
Check the custom role's effective actions on an allowed group operation and attempt a prohibited role change.

Explanation

Correct Answer

Attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators. Failure would be evident in this case: an ordinary group owner unexpectedly adds a user who inherits a directory administrator role.

Incorrect Answers

The proposed observation checks the different built-in role evaluation scenario. Even a successful test would not establish the requested outcome here: attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference.

The proposed observation checks the different company branding and sign-in experience scenario. Even a successful test would not establish the requested outcome here: attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference.

The proposed observation checks the different custom role restricted administration scenario. Even a successful test would not establish the requested outcome here: attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference.

Question 7

An ordinary group owner unexpectedly adds a user who inherits a directory administrator role. Which root cause best explains the described result rather than merely treating its symptoms?

A broader built-in role was additionally assigned, expanding effective permissions beyond the custom role.
The privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group.
The Password Administrator role was assigned at tenant scope rather than the intended West administrative unit scope.
The analyst's group-derived User Administrator entitlement was omitted from the effective-role evaluation.

Explanation

Correct Answer

The privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group. This is the causal explanation of the observed behavior: an ordinary group owner unexpectedly adds a user who inherits a directory administrator role. Address the underlying mechanism with: create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators. Then confirm: attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference.

Incorrect Answers

This diagnosis fits a separate custom role restricted administration incident: A departmental delegate can modify a privileged tenant-wide policy after receiving the supposed custom group role. It does not explain this case's observed failure; the privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group.

This diagnosis fits a separate delegated password reset by administrative unit incident: An operator can reset an East student password despite the intended regional restriction. It does not explain this case's observed failure; the privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group.

This diagnosis fits a separate built-in role evaluation incident: An auditor reports the analyst is read-only because only direct role assignments were examined. It does not explain this case's observed failure; the privileged role was assigned to an unrestricted ordinary security group rather than a protected role-assignable group.

Question 8

A security team wants a group that can receive a sensitive Microsoft Entra administrator role without letting an ordinary Groups Administrator add unauthorized members. The initial implementation works. Which continuing control most directly prevents the same failure or drift from recurring?

Reconcile direct, group, PIM activation and scope evidence before certifying privileged access.
Monitor rule processing and control changes to attributes used by privileged scope decisions.
Periodically inventory additive role assignments; assess the union of grants instead of reading the custom role alone.
Audit membership and group-role assignments, maintaining separate approval for privileged group ownership.

Explanation

Correct Answer

Audit membership and group-role assignments, maintaining separate approval for privileged group ownership. This reduces future drift after the initial control is deployed: create an appropriately restricted role-assignable security group and delegate membership changes only to privileged authorized operators. Recheck the actual behavior with: attempt membership modification as a Groups Administrator and as an approved Privileged Role Administrator, checking the expected difference.

Incorrect Answers

This control manages future built-in role evaluation drift, but it does not reduce the continuing exposure in the described role-assignable group protection case. The correct safeguard is: audit membership and group-role assignments, maintaining separate approval for privileged group ownership.

This control manages future administrative unit dynamic scoping drift, but it does not reduce the continuing exposure in the described role-assignable group protection case. The correct safeguard is: audit membership and group-role assignments, maintaining separate approval for privileged group ownership.

This control manages future custom role restricted administration drift, but it does not reduce the continuing exposure in the described role-assignable group protection case. The correct safeguard is: audit membership and group-role assignments, maintaining separate approval for privileged group ownership.

Question 9

A retailer delegates user management to regional teams and assumes administrative units also hide all directory objects from users in other regions. Which proposed configuration or implementation directly meets the stated requirement?

Inspect all active role assignments including group-based and scoped grants before deciding effective directory administrative permissions.
Create a custom Microsoft Entra role containing only supported required permissions and assign it at the narrowest supported scope.
Use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization.
Assign the Password Administrator role scoped to the West administrative unit to the appropriate regional helpdesk operators.

Explanation

Correct Answer

Use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization. The solution acts at the intended identity, policy or application scope. A successful result is testable: test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility. The competing configuration error is: administrative units constrain supported administrator roles but are not universal directory data isolation boundaries.

Incorrect Answers

That action implements the separate built-in role evaluation decision. It is appropriate when a service-desk analyst has User Administrator through one group and Reports Reader directly; an auditor must determine the analyst's actual capabilities. The present case instead requires the specific administrative unit membership versus isolation change: use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization.

That action implements the separate custom role restricted administration decision. It is appropriate when a department needs a delegate to update selected group properties but not tenant-wide Conditional Access or role assignments. The present case instead requires the specific administrative unit membership versus isolation change: use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization.

That action implements the separate delegated password reset by administrative unit decision. It is appropriate when a university employs regional helpdesk operators who may reset ordinary students' passwords in the West campus but must not administer East campus users. The present case instead requires the specific administrative unit membership versus isolation change: use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization.

Question 10

A retailer delegates user management to regional teams and assumes administrative units also hide all directory objects from users in other regions. The proposed change is: Use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization. After applying the intended configuration, which observation most directly proves that the required behavior works?

Change a test employee's maintained location and confirm the AU membership and delegated-management scope recalculate.
Reset a test West user password and confirm the same operator is denied a test East user reset.
Test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility.
Review both direct and group-derived assignments and test a permitted user operation versus an unrelated forbidden control.

Explanation

Correct Answer

Test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: use administrative-unit-scoped role assignments for administrative operations and separately evaluate directory visibility and application authorization. Failure would be evident in this case: cross-region users still appear in directory searches although management edits are correctly restricted.

Incorrect Answers

The proposed observation checks the different administrative unit dynamic scoping scenario. Even a successful test would not establish the requested outcome here: test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility.

The proposed observation checks the different delegated password reset by administrative unit scenario. Even a successful test would not establish the requested outcome here: test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility.

The proposed observation checks the different built-in role evaluation scenario. Even a successful test would not establish the requested outcome here: test a scoped admin's management operation outside its unit and independently test ordinary directory read visibility.