[Sep 15, 2026] Prepare For The SC-300 Question Papers In Advance [Q102-Q122]

Rate this post

[Sep 15, 2026] Prepare For The SC-300 Question Papers In Advance

SC-300 PDF Dumps Real 2026 Recently Updated Questions

Microsoft SC-300 Exam is ideal for IT professionals who are responsible for managing identity and access solutions in organizations of all sizes. This includes IT administrators, security analysts, and identity and access managers who are responsible for designing, implementing, and maintaining identity and access solutions based on Microsoft technologies. SC-300 exam is also recommended for individuals who are looking to advance their careers in the field of identity and access management, as it is a globally recognized certification that validates their expertise and knowledge in this area. With the increasing importance of identity and access management in today’s digital world, passing the Microsoft SC-300 Exam is a valuable achievement that can open up new career opportunities for IT professionals.

NO.102 You have an Azure Active Directory (Azure Azure) tenant that contains the objects shown in the following table.
* A device named Device1
* Users named User1, User2, User3, User4, and User5
* Five groups named Group1, Group2, Group3, Ciroup4, and Group5
The groups are configured as shown in the following table.

How many licenses are used if you assign the Microsoft Office 365 Enterprise E5 license to Group1?

NO.103 You have an Azure Active Directory (Azure AD) tenant that contains the groups shown in the following table.

For which groups can you create an access review?

Group1 only

Group1 and Group4 only

Group1 and Group2 only

Group1, Group2, Group4, and Group5 only

Group1, Group2, Group3, Group4 and Group5

NO.104 You have a Microsoft 365 tenant.
The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain. The domain contains the servers shown in the following table.

The domain controllers are prevented from communicating to the internet.
You implement Azure AD Password Protection on Server1 and Server2.
You deploy a new server named Server4 that runs Windows Server 2019.
You need to ensure that Azure AD Password Protection will continue to work if a single server fails.
What should you implement on Server4?

Azure AD Connect

Azure AD Application Proxy

Password Change Notification Service (PCNS)

the Azure AD Password Protection proxy service

NO.105 You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.
From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?

the Identity Governance blade in the Azure Active Directory admin center

the Set-AzureAdUser cmdlet

the Licenses blade in the Azure Active Directory admin center

the Set-WindowsProductKey cmdlet

NO.106 Your network contains an on-premises Active Directory Domain services (AD DS) domain that syncs with an Azure AD tenant. The AD DS domain contains the organizational units (OUs) shown in the following table.

You need to create a break-glass account named BreakGlass.
Where should you create BreakGlass, and which role should you assign to BreakGlass? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.107 You have an Azure Active Directory (Azure AD) tenant that contains the following group:
Name: Group1
Members: User1, User2
Owner: User3
On January 15, 2021, you create an access review as shown in the exhibit. (Click the Exhibit tab.)

Users answer the Review1 question as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

NO.108 You need to meet the planned changes for the User administrator role.
What should you do?

Create an access review.

Modify Role settings

Create an administrator unit.

Modify Active Assignments.

NO.109 You need to meet the technical requirements for the probability that user identities were compromised.
What should the users do first, and what should you configure? To answer, select the appropriate options in the answer area.
NOTE:Each correct selection is worth one point.

NO.110 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 tenant.
All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.
Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.
You need to block the users automatically when they report an MFA request that they did not Initiate.
Solution: From the Azure portal, you configure the Fraud alert settings for multi-factor authentication (MFA).
Does this meet the goal?

Yes

NO.111 You have a Microsoft Entra tenant that contains an administrative unit named AU1. AU1 is configured for assigned membership.
The tenant contains the users shown in the following table.

For AU1, you update the following configurations:
. Membership type: Dynamic User
* Dynamic membership rule: (user.department -eq “hr”)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NO.112 You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.
You discover that users connect to unsanctioned third-party apps.
You need to automatically identify and block the use of unsanctioned apps that have a risk score of 5 or higher and generate more than 200 GB of daily traffic. The solution must minimize administrative effort.
What should you do?

From the Microsoft Defender portal, create an app governance policy.

Create an app discovery policy by using the New popular app template.

From the Microsoft Entra admin center, create a Conditional Access policy.

Create an app discovery policy by using the New risky app template.

NO.113 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 tenant.
You have 100 IT administrators who are organized into 10 departments.
You create the access review shown in the exhibit. (Click theExhibittab.)

You discover that all access review requests are received by Megan Bowen.
You need to ensure that the manager of each department receives the access reviews of their respective department.
Solution: You set Reviewers toMember (self).
Does this meet the goal?

Yes

NO.114 Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant- Users sign in to computers that run Windows 10 and are joined to the domain.
You plan to implement Azure AD Seamless Single Sign-On (Azure AD Seamless SSO).
You need to configure the computers for Azure AD Seamless SSO.
What should you do?

Enable Enterprise State Roaming.

Configure Sign-in options.

Install the Azure AD Connect Authentication Agent.

Modify the Intranet Zone settings.

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn module “Plan and implement Azure AD Seamless Single Sign-On (SSO)”, Azure AD Seamless SSO allows domain-joined Windows devices (that are not necessarily Azure AD-joined) to automatically sign in to Azure AD without requiring users to re-enter their credentials.
When a user tries to access an Azure AD-integrated application (like Microsoft 365, Teams, or SharePoint Online), Azure AD redirects the authentication request to the on-premises Active Directory. The Seamless SSO feature uses a computer account (AZUREADSSOACC) created in Active Directory to authenticate users through Kerberos tickets automatically.
For the Kerberos-based SSO to work properly in a browser or client, the service principal name (SPN) used by Azure AD must be treated as a trusted intranet site. This ensures that Integrated Windows Authentication (IWA) can pass the user’s Kerberos ticket automatically – without prompting for credentials.
To enable automatic SSO without credential prompts, you must:
* Add the following URLs to the Intranet Zone in Internet Explorer or Microsoft Edge (and by extension, Windows Authentication settings):
* https://autologon.microsoftazuread-sso.com
* https://aadg.windows.net.nsatc.net
* Ensure Automatic logon with current user name and password is enabled for the Intranet Zone.
“For Azure AD Seamless SSO to work, the client machines must be on the corporate network and the URLs
‘https://autologon.microsoftazuread-sso.com’ and ‘https://aadg.windows.net.nsatc.net’ must be added to the users’ Intranet zone settings.” Other options are not correct because:
* A. Enable Enterprise State Roaming – Manages user settings across devices, unrelated to SSO.
* B. Configure Sign-in options – User-level authentication preferences, not required for Seamless SSO.
* C. Install Azure AD Connect Authentication Agent – Used for Pass-through Authentication (PTA), not for Seamless SSO.

NO.115 You have an Azure subscription that contains the custom roles shown in the following table.

You need to create a custom Azure subscription role named Role3 by using the Azure portal. Role3 will use the baseline permissions of an existing role. Which roles can you clone to create Role3?

Role1, Role2 built-in Azure subscription roles, and built-in Azure AD roles

Role2 only

built-in Azure subscription roles and built-in Azure AD roles only

built-in Azure subscription roles only

built-in Azure subscription roles and Role2 only

NO.116 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 E5 subscription.
You create a user named User1.
You need to ensure that User1 can update the status of Identity Secure Score improvement actions.
Solution: You assign the Exchange Administrator role to User1.
Does this meet the goal?

Yes

NO.117 You have an Azure Active Directory (Azure AD) tenant that contains the following objects:
A device named Device1
Users named User1, User2, User3, User4, and User5
Groups named Group1, Group2, Group3, Group4, and Group5
The groups are configured as shown in the following table.

To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

Group1 and Group4 only

Group1, Group2, Group3, Group4, and Group5

Group1 and Group2 only

Group1 only

Group1, Group2, Group4, and Group5 only

NO.118 Your on-premises network contains an Active Directory domain that uses Azure AD Connect to sync with an Azure AD tenant. You need to configure Azure AD Connect to meet the following requirements:
* User sign-ins to Azure AD must be authenticated by an Active Directory domain controller.
* Active Directory domain users must be able to use Azure AD self-service password reset (SSPR).
What should you use for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.119 You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

The users are assigned the roles shown in the following table.

For which users can User1 and User4 reset passwords? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.120 You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit.
(Click the Exhibit tab.)

You are evaluating the following passwords:
– Pr0jectlitw@re
– T@ilw1nd
– C0nt0s0
Which passwords will be blocked?

Pr0jectlitw@re and T@ilw1nd only

C0nt0s0 only

C0nt0s0, Pr0jectlitw@re, and T@ilw1nd

C0nt0s0 and T@ilw1nd only

C0nt0s0 and Pr0jectlitw@re only

NO.121 You need to support the planned changes and meet the technical requirements for MFA.
Which feature should you use, and how long before the users must complete the registration? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NO.122 You have an Azure AD tenant that contains the users shown in the following table.

In Azure AD Identity Protection, you configure a user risk policy that has the following settings:
* Assignments:
o Users: Group1
o User risk: Low and above
* Controls:
o Access: Block access
* Enforce policy: On
In Azure AD Identity Protection, you configure a sign-in risk policy that has the following settings:
* Assignments:
o Users: Group2
o Sign-in risk: Low and above
* Controls:
o Access: Require multi-factor authentication
* Enforce policy. On
the following settings:
ng settings:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.