Microsoft SC-300 Practice Test 31

Question 300

A sensitive enterprise app should be accessible only to staff explicitly assigned to it, not every authenticated tenant user. The proposed change is: Set assignment required for the enterprise application and assign authorized users/groups to available app roles. After applying the intended configuration, which observation most directly proves that the required behavior works?

Inspect provisioning logs for create, update and deprovision operations for a controlled test user.
From outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.
Open My Apps as a pilot employee and verify the collection appears while existing app access remains unchanged.
Verify an unassigned test employee is denied while an assigned employee can sign in.

Explanation

Correct Answer

Verify an unassigned test employee is denied while an assigned employee can sign in. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: set assignment required for the enterprise application and assign authorized users/groups to available app roles. Failure would be evident in this case: an employee can authenticate to the app even though they are not in the approved access roster.

Incorrect Answers

The proposed observation checks the different scim application provisioning scenario. Even a successful test would not establish the requested outcome here: verify an unassigned test employee is denied while an assigned employee can sign in.

The proposed observation checks the different application proxy on-premises app scenario. Even a successful test would not establish the requested outcome here: verify an unassigned test employee is denied while an assigned employee can sign in.

The proposed observation checks the different enterprise app collections scenario. Even a successful test would not establish the requested outcome here: verify an unassigned test employee is denied while an assigned employee can sign in.

Question 301

An employee can authenticate to the app even though they are not in the approved access roster. Which root cause best explains the described result rather than merely treating its symptoms?

The provisioning credential or endpoint authorization has expired or become invalid.
Delegated user consent did not authorize the requested application-only roles in the customer tenant.
SAML sign-in configuration alone does not enable SCIM provisioning or scope the user into it.
The enterprise application has no user assignment requirement, allowing broader sign-in than intended.

Explanation

Correct Answer

The enterprise application has no user assignment requirement, allowing broader sign-in than intended. This is the causal explanation of the observed behavior: an employee can authenticate to the app even though they are not in the approved access roster. Address the underlying mechanism with: set assignment required for the enterprise application and assign authorized users/groups to available app roles. Then confirm: verify an unassigned test employee is denied while an assigned employee can sign in.

Incorrect Answers

This diagnosis fits a separate provisioning log troubleshooting incident: User assignment is correct but the application SCIM request repeatedly returns unauthorized. It does not explain this case's observed failure; the enterprise application has no user assignment requirement, allowing broader sign-in than intended.

This diagnosis fits a separate application tenant-wide admin consent incident: A developer's individual user consent succeeds for delegated access but an unattended daemon still lacks application permissions. It does not explain this case's observed failure; the enterprise application has no user assignment requirement, allowing broader sign-in than intended.

This diagnosis fits a separate scim application provisioning incident: The user can SSO to the app but no SaaS account is created through lifecycle provisioning. It does not explain this case's observed failure; the enterprise application has no user assignment requirement, allowing broader sign-in than intended.

Question 302

A sensitive enterprise app should be accessible only to staff explicitly assigned to it, not every authenticated tenant user. Select TWO complementary decisions: the correct technical implementation and the ongoing preventive control. Evidence-only tests and controls for a different scenario are not substitutes for those two responsibilities.

Monitor provisioning failures and offboarding deprovisioning separately from SSO success.
Assign an unrestricted All Employees group to the enterprise app Approver role while assuming the Reader-only policy will still be enforced.
Have an authorized administrator evaluate and grant the precise tenant-wide permissions for the application service principal.
Set assignment required for the enterprise application and assign authorized users/groups to available app roles.
Reconcile application group assignments with HR departures and access reviews.

Explanation

Correct Answers

Set assignment required for the enterprise application and assign authorized users/groups to available app roles. The solution acts at the intended identity, policy or application scope. A successful result is testable: verify an unassigned test employee is denied while an assigned employee can sign in. The competing configuration error is: the enterprise application has no user assignment requirement, allowing broader sign-in than intended.

Reconcile application group assignments with HR departures and access reviews. This reduces future drift after the initial control is deployed: set assignment required for the enterprise application and assign authorized users/groups to available app roles. Recheck the actual behavior with: verify an unassigned test employee is denied while an assigned employee can sign in.

Incorrect Answers

This control manages future scim application provisioning drift, but it does not reduce the continuing exposure in the described enterprise app user assignment requirement case. The correct safeguard is: reconcile application group assignments with HR departures and access reviews.

This would grant excessive Approver access instead of restricting sign-in to explicitly authorized staff; it cannot replace assignment-required enforcement.

That action implements the separate application tenant-wide admin consent decision. It is appropriate when a multitenant enterprise app requests Microsoft Graph application permissions and the tenant must grant them only after an authorized security review. The present case instead requires the specific enterprise app user assignment requirement change: set assignment required for the enterprise application and assign authorized users/groups to available app roles.

Question 303

A legacy intranet HTTP application must be published to remote users without exposing its internal server directly to the Internet. Which proposed configuration or implementation directly meets the stated requirement?

Deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication.
Enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy.
Configure supported automatic provisioning with an application SCIM endpoint, credentials and scoped user/group assignments.
Assign the user's approved group to the Reader app role on the enterprise application.

Explanation

Correct Answer

Deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication. The solution acts at the intended identity, policy or application scope. A successful result is testable: from outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow. The competing configuration error is: the Application Proxy connector cannot reach the internal application or lacks a healthy alternative.

Incorrect Answers

That action implements the separate application proxy preauthentication decision. It is appropriate when a published intranet app is reachable through Application Proxy, but the organization expects Microsoft Entra Conditional Access checks before it loads. The present case instead requires the specific application proxy on-premises app change: deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication.

That action implements the separate scim application provisioning decision. It is appropriate when new employees should automatically receive and remove accounts in a SaaS application based on their assigned Entra group. The present case instead requires the specific application proxy on-premises app change: deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication.

That action implements the separate application app role assignment decision. It is appropriate when a custom enterprise app exposes Reader and Approver roles, and a user must receive only Reader privileges. The present case instead requires the specific application proxy on-premises app change: deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication.

Question 304

A legacy intranet HTTP application must be published to remote users without exposing its internal server directly to the Internet. The proposed change is: Deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication. After applying the intended configuration, which observation most directly proves that the required behavior works?

Verify an unassigned test employee is denied while an assigned employee can sign in.
Inspect provisioning logs for create, update and deprovision operations for a controlled test user.
Attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.
From outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.

Explanation

Correct Answer

From outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication. Failure would be evident in this case: external users see a gateway failure after the only on-premises connector loses network access to the intranet app.

Incorrect Answers

The proposed observation checks the different enterprise app user assignment requirement scenario. Even a successful test would not establish the requested outcome here: from outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.

The proposed observation checks the different scim application provisioning scenario. Even a successful test would not establish the requested outcome here: from outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.

The proposed observation checks the different application proxy preauthentication scenario. Even a successful test would not establish the requested outcome here: from outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.

Question 305

External users see a gateway failure after the only on-premises connector loses network access to the intranet app. Which root cause best explains the described result rather than merely treating its symptoms?

The group was associated with the wrong application role instead of Reader.
The enterprise application has no user assignment requirement, allowing broader sign-in than intended.
The Application Proxy connector cannot reach the internal application or lacks a healthy alternative.
The published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication.

Explanation

Correct Answer

The Application Proxy connector cannot reach the internal application or lacks a healthy alternative. This is the causal explanation of the observed behavior: external users see a gateway failure after the only on-premises connector loses network access to the intranet app. Address the underlying mechanism with: deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication. Then confirm: from outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.

Incorrect Answers

This diagnosis fits a separate application app role assignment incident: A user appears assigned to the application but receives Approver permissions after group reassignment. It does not explain this case's observed failure; the Application Proxy connector cannot reach the internal application or lacks a healthy alternative.

This diagnosis fits a separate enterprise app user assignment requirement incident: An employee can authenticate to the app even though they are not in the approved access roster. It does not explain this case's observed failure; the Application Proxy connector cannot reach the internal application or lacks a healthy alternative.

This diagnosis fits a separate application proxy preauthentication incident: An unauthenticated Internet visitor reaches the backend sign-in page directly through the proxy without an Entra prompt. It does not explain this case's observed failure; the Application Proxy connector cannot reach the internal application or lacks a healthy alternative.

Question 306

A legacy intranet HTTP application must be published to remote users without exposing its internal server directly to the Internet. The initial implementation works. Which continuing control most directly prevents the same failure or drift from recurring?

Review preauthentication settings and avoid bypassing policy checks during backend SSO migrations.
Run multiple supported connectors and monitor internal DNS, proxy connectivity and capacity.
Monitor provisioning error rates and credential rotation for connected apps.
Monitor provisioning failures and offboarding deprovisioning separately from SSO success.

Explanation

Correct Answer

Run multiple supported connectors and monitor internal DNS, proxy connectivity and capacity. This reduces future drift after the initial control is deployed: deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication. Recheck the actual behavior with: from outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.

Incorrect Answers

This control manages future application proxy preauthentication drift, but it does not reduce the continuing exposure in the described application proxy on-premises app case. The correct safeguard is: run multiple supported connectors and monitor internal DNS, proxy connectivity and capacity.

This control manages future provisioning log troubleshooting drift, but it does not reduce the continuing exposure in the described application proxy on-premises app case. The correct safeguard is: run multiple supported connectors and monitor internal DNS, proxy connectivity and capacity.

This control manages future scim application provisioning drift, but it does not reduce the continuing exposure in the described application proxy on-premises app case. The correct safeguard is: run multiple supported connectors and monitor internal DNS, proxy connectivity and capacity.

Question 307

A published intranet app is reachable through Application Proxy, but the organization expects Microsoft Entra Conditional Access checks before it loads. Which proposed configuration or implementation directly meets the stated requirement?

Deploy Microsoft Entra Application Proxy with a healthy connector group and configure the published app's internal/external URLs and preauthentication.
Create appropriate enterprise application collections and include the relevant finance apps for targeted users.
Enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy.
Investigate enterprise application provisioning logs and synchronization scope/error status for that identity.

Explanation

Correct Answer

Enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy. The solution acts at the intended identity, policy or application scope. A successful result is testable: attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds. The competing configuration error is: the published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication.

Incorrect Answers

That action implements the separate application proxy on-premises app decision. It is appropriate when a legacy intranet HTTP application must be published to remote users without exposing its internal server directly to the Internet. The present case instead requires the specific application proxy preauthentication change: enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy.

That action implements the separate enterprise app collections decision. It is appropriate when employees see a cluttered My Apps portal and want related finance applications grouped for easier discovery without changing who is authorized. The present case instead requires the specific application proxy preauthentication change: enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy.

That action implements the separate provisioning log troubleshooting decision. It is appropriate when an employee was assigned to an enterprise application yesterday but their SaaS account is missing, and the sign-in log contains no provisioning details. The present case instead requires the specific application proxy preauthentication change: enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy.

Question 308

A published intranet app is reachable through Application Proxy, but the organization expects Microsoft Entra Conditional Access checks before it loads. The proposed change is: Enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy. After applying the intended configuration, which observation most directly proves that the required behavior works?

Find the user's create/update job record and the target endpoint result rather than assuming SSO events prove provisioning.
From outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.
Attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.
Inspect provisioning logs for create, update and deprovision operations for a controlled test user.

Explanation

Correct Answer

Attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds. This directly tests the effective outcome, not merely that a configuration exists. It establishes whether the intended change works: enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy. Failure would be evident in this case: an unauthenticated Internet visitor reaches the backend sign-in page directly through the proxy without an Entra prompt.

Incorrect Answers

The proposed observation checks the different provisioning log troubleshooting scenario. Even a successful test would not establish the requested outcome here: attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.

The proposed observation checks the different application proxy on-premises app scenario. Even a successful test would not establish the requested outcome here: attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.

The proposed observation checks the different scim application provisioning scenario. Even a successful test would not establish the requested outcome here: attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.

Question 309

An unauthenticated Internet visitor reaches the backend sign-in page directly through the proxy without an Entra prompt. Which root cause best explains the described result rather than merely treating its symptoms?

Application collection organization does not create enterprise application authorization or assignments.
The Application Proxy connector cannot reach the internal application or lacks a healthy alternative.
The group was associated with the wrong application role instead of Reader.
The published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication.

Explanation

Correct Answer

The published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication. This is the causal explanation of the observed behavior: an unauthenticated Internet visitor reaches the backend sign-in page directly through the proxy without an Entra prompt. Address the underlying mechanism with: enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy. Then confirm: attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.

Incorrect Answers

This diagnosis fits a separate enterprise app collections incident: An app collection is visible but a user still receives AccessDenied when launching an unassigned finance app. It does not explain this case's observed failure; the published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication.

This diagnosis fits a separate application proxy on-premises app incident: External users see a gateway failure after the only on-premises connector loses network access to the intranet app. It does not explain this case's observed failure; the published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication.

This diagnosis fits a separate application app role assignment incident: A user appears assigned to the application but receives Approver permissions after group reassignment. It does not explain this case's observed failure; the published application is set to passthrough preauthentication instead of Microsoft Entra preauthentication.

Question 310

A published intranet app is reachable through Application Proxy, but the organization expects Microsoft Entra Conditional Access checks before it loads. Select THREE distinct actions: implement the required change, obtain direct evidence it works, and maintain a continuing protection against drift. Actions that solve a different identity-management problem do not meet those responsibilities.

From outside the corporate network, verify an assigned user reaches the internal app through a Microsoft Entra authenticated proxy flow.
Attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.
Run multiple supported connectors and monitor internal DNS, proxy connectivity and capacity.
Review preauthentication settings and avoid bypassing policy checks during backend SSO migrations.
Create a new Application Proxy connector group but leave the existing published application on passthrough preauthentication and with no applicable Conditional Access policy.
Enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy.

Explanation

Correct Answers

Review preauthentication settings and avoid bypassing policy checks during backend SSO migrations. This reduces future drift after the initial control is deployed: enable Microsoft Entra preauthentication for the Application Proxy application and scope the relevant access policy. Recheck the actual behavior with: attempt access with a blocked test identity and verify Conditional Access is evaluated before the app responds.

Incorrect Answers

This control manages future application proxy on-premises app drift, but it does not reduce the continuing exposure in the described application proxy preauthentication case. The correct safeguard is: review preauthentication settings and avoid bypassing policy checks during backend SSO migrations.

Connector topology alone does not impose Microsoft Entra preauthentication. The existing passthrough setting would continue to bypass the expected sign-in policy gate.

Microsoft Identity and Access Administrator (SC-300) Practice Tests

Microsoft SC-300 Practice Test 29 - 10 Questions (Last Reviewed 09-Oct-2026)
Microsoft SC-300 Practice Test 30 - 10 Questions (Last Reviewed 08-Oct-2026)
Microsoft SC-300 Practice Test 31 - 10 Questions (Last Reviewed 07-Oct-2026)
Microsoft SC-300 Practice Test 32 - 10 Questions (Last Reviewed 06-Oct-2026)
Microsoft SC-300 Practice Test 33 - 10 Questions (Last Reviewed 05-Oct-2026)

Pass Your Microsoft SC-300 Exam Easy!

Question 300

Explanation

Correct Answer

Incorrect Answers

Question 301

Explanation

Correct Answer

Incorrect Answers

Question 302

Explanation

Correct Answers

Incorrect Answers

Question 303

Explanation

Correct Answer

Incorrect Answers

Question 304

Explanation

Correct Answer

Incorrect Answers

Question 305

Explanation

Correct Answer

Incorrect Answers

Question 306

Explanation

Correct Answer

Incorrect Answers

Question 307

Explanation

Correct Answer

Incorrect Answers

Question 308

Explanation

Correct Answer

Incorrect Answers

Question 309

Explanation

Correct Answer

Incorrect Answers

Question 310

Explanation

Correct Answers

Incorrect Answers

Microsoft Identity and Access Administrator (SC-300) Practice Tests