Free Preparation Discussions
MENU
Microsoft SC-300 Exam Questions
- Topic 1: Implement authentication and access management: This module covers how to plan and manage user authentication methods, set up multi-factor authentication and self-service password reset, adopt and manage Conditional Access policies. The topic also focuses on utilizing Microsoft Entra ID Protection for risk management, and managing access to Azure resources using roles.
- Topic 2: Plan and implement workload identities: This module covers how to choose and create appropriate identities for apps and Azure workloads, incorporate and monitor enterprise applications. In this topic, you also get information about app registrations and permissions.
- Topic 3: Implement and manage user identities: This topic focuses on configuring and managing a Microsoft Entra tenant. It also explains how to implement and manage identities for external users and tenants.
- Topic 4: Plan and implement identity governance: This section of the exam covers how to set up and manage entitlement management, Conduct and manage access reviews, adopt privileged access management. Moreover, it focuses on monitoring identity activity using logs and reports, Microsoft Entra Permissions Management to evaluate and reduce risks.
Free Microsoft SC-300 Exam Actual Questions
Note: Premium Questions for SC-300 were last updated On Mar. 08, 2026 (see below)
You have a Microsoft Entra tenant that contains the users shown in the following table:
User1 is the owner of Group1.
You create an access review that has the following settings:
What to review: Teams + Groups
Scope: All users
Group: Group1
Reviewers: Users review their own access
Which users can perform access reviews for User3?
Comprehensive and Detailed In-Depth
Let's break this down step by step based on the Microsoft Entra access review settings and the principles outlined in Microsoft Identity and Access Administrator documentation.
Understanding the Access Review Settings:
What to review: Teams + GroupsThis indicates that the access review is evaluating memberships in Teams and Groups within the Microsoft Entra tenant. Since the group specified is Group1, the review focuses on Group1 membership.
Scope: All usersThe scope defines who is being reviewed. 'All users' in this
Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect.
Attire AD Connect is installed on a server named Server 1.
You deploy a new server named Server? that runs Windows Server 2019.
You need to implement a failover server for Azure AD Connect. The solution must minimize how long it takes to fail over if Server1 fails.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
You have an Azure Active Directory (Azure AD) tenant.
For the tenant. Users can register applications Is set to No.
A user named Admin1 must deploy a new cloud app named App1.
You need to ensure that Admin1 can register App1 in Azure AD. The solution must use the principle of least privilege.
Which role should you assign to Admin1?
https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles
You have an Azure subscription that contains a user named User1 and an Azure Key Vault named Vault1.
You need to ensure that User1 can read the metadata of certificates, keys, and secrets stored in Vault1. The solution must follow the principle of least privilege.
Which role should you assign to User1?
Comprehensive and Detailed In-Depth
Let's break this down step by step based on Azure Key Vault roles, permissions, and the principle of least privilege, as outlined in Microsoft Identity and Access Administrator documentation.
Understanding Azure Key Vault and the Requirement:
Azure Key Vault is a service that securely stores and manages cryptographic keys, secrets, and certificates. It uses role-based access control (RBAC) to manage permissions for users, groups, and applications.
The question requires that User1 canread the metadataof certificates, keys, and secrets in Vault1. In Azure Key Vault, 'metadata' refers to the properties of these objects (e.g., name, creation date, expiration date), not the actual content (e.g., the secret value, key value, or certificate private key).
The solution must follow theprinciple of least privilege, meaning User1 should be granted the minimum permissions necessary to perform the task, without access to unnecessary actions (e.g., modifying or deleting objects).
Azure Key Vault RBAC Roles and Permissions:
Azure Key Vault supports built-in RBAC roles that define specific permissions for managing keys, secrets, and certificates. Let's examine each role in the options:
Key Vault Crypto User:
This role allows a user to perform cryptographic operations using keys (e.g., encrypt, decrypt, sign, verify) and to read key metadata.
Permissions include: Microsoft.KeyVault/vaults/keys/read (read key metadata) and cryptographic operations like encrypt, decrypt, etc.
However, this role does not grant permissions to read metadata for secrets or certificates, and it includes cryptographic operation permissions, which are not needed for the task.
Key Vault Crypto Officer:
This role is designed for managing keys and performing cryptographic operations. It includes permissions to create, delete, update, and read keys, as well as perform cryptographic operations.
Permissions include: Microsoft.KeyVault/vaults/keys/* (full control over keys).
This role does not grant access to secrets or certificates and provides more permissions than needed (e.g., create, delete), violating the principle of least privilege.
Key Vault Reader:
This role provides read-only access to the metadata of all objects in the Key Vault (keys, secrets, and certificates).
Permissions include: Microsoft.KeyVault/vaults/read (read vault properties) and Microsoft.KeyVault/vaults/*/read (read metadata for keys, secrets, and certificates).
Importantly, this role does not allow access to the actual content of the objects (e.g., the secret value, key value, or certificate private key), only the metadata. It also does not allow write operations (e.g., create, update, delete).
This aligns perfectly with the requirement to 'read the metadata' and follows the principle of least privilege.
Key Vault Secrets User:
This role allows a user to read the content of secrets (not just metadata) and perform operations like getting the secret value.
Permissions include: Microsoft.KeyVault/vaults/secrets/get (read secret values) and Microsoft.KeyVault/vaults/secrets/read (read secret metadata).
This role does not grant access to keys or certificates, and it provides more access than needed (reading the secret value, not just metadata), violating the principle of least privilege.
Applying the Principle of Least Privilege:
The task requires User1 to read the metadata of certificates, keys, and secrets, but not to access their content or perform any write operations.
Key Vault Readeris the most appropriate role because:
It grants read-only access to the metadata of all objects (keys, secrets, certificates).
It does not allow access to the content of the objects (e.g., secret values), which is not required.
It does not allow write operations (e.g., create, delete), adhering to the principle of least privilege.
The other roles either provide too much access (e.g., Key Vault Crypto Officer, Key Vault Secrets User) or do not cover all required objects (e.g., Key Vault Crypto User, Key Vault Secrets User).
Analysis of the Options:
A . Key Vault Crypto User:
Incorrect. This role only allows reading key metadata and performing cryptographic operations, but it does not provide access to secrets or certificates metadata. It also grants unnecessary cryptographic permissions.
B . Key Vault Crypto Officer:
Incorrect. This role provides full control over keys, which is far more than needed, and does not grant access to secrets or certificates metadata.
C . Key Vault Reader:
Correct. This role provides read-only access to the metadata of keys, secrets, and certificates, exactly matching the requirement while following the principle of least privilege.
D . Key Vault Secrets User:
Incorrect. This role allows reading secret values (not just metadata) and does not provide access to keys or certificates metadata. It grants more access than needed.
Additional Considerations:
If the question had asked for User1 to read the content of secrets (not just metadata), the Key Vault Secrets User role might be considered, but it still wouldn't cover keys and certificates.
Custom RBAC roles could be created to fine-tune permissions, but the question asks for a built-in role, and Key Vault Reader is the best fit.
The question does not specify whether User1 needs to perform other actions (e.g., cryptographic operations, managing the vault). If additional permissions were needed, a combination of roles or a custom role might be required, but the principle of least privilege guides us to the minimal role.
Conclusion:To ensure User1 can read the metadata of certificates, keys, and secrets in Vault1 while following the principle of least privilege, theKey Vault Readerrole should be assigned. This role provides the exact permissions needed without granting unnecessary access. Therefore, the correct answer isC.
Azure Key Vault documentation: 'Azure Key Vault RBAC roles' (Microsoft Learn:https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide)
Azure Key Vault documentation: 'Secure access to a key vault' (Microsoft Learn:https://learn.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault)
Microsoft Identity and Access Administrator (SC-300) exam study guide, which covers Azure Key Vault access control and the principle of least privilege.
You have a Microsoft 365 subscription that contains the following:
* An Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium P2 license
* A Microsoft SharePoint Online site named Site1
* A Microsoft Teams team named Team1
You need to create an entitlement management workflow to manage Site1 and Team1. What should you do first?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Verda
7 days agoHobert
14 days agoClarinda
22 days agoTiffiny
29 days agoShanda
1 month agoLuann
1 month agoFrederica
2 months agoEvangelina
2 months agoTheola
2 months agoLilli
2 months agoVilma
3 months agoValentin
3 months agoJin
3 months agoBonita
3 months agoBuck
4 months agoDick
4 months agoMarshall
4 months agoMarjory
4 months agoEric
5 months agoFausto
5 months agoErinn
5 months agoBrent
5 months agoTerrilyn
6 months agoArgelia
6 months agoOdelia
6 months agoEliz
6 months agoStephaine
8 months agoTarra
9 months agoCarlton
11 months agoArminda
12 months agoElli
1 year agoMari
1 year agoSusy
1 year agoSharen
1 year agoMona
1 year agoAn
1 year agoAntione
1 year agoLilli
1 year agoGertude
1 year agoAllene
1 year agoMattie
1 year agoJacqueline
1 year agoEden
1 year agoJuan
1 year agoCherilyn
2 years agoMatthew
2 years agoEladia
2 years agoShaunna
2 years agoHyman
2 years agoFanny
2 years agoArtie
2 years agoRoyce
2 years agoIesha
2 years agoLorriane
2 years ago