Open the app

Free Microsoft Identity and Access Administrator Associate (SC-300) practice questions

10 free sample questions for the Microsoft Identity and Access Administrator Associate (SC-300) exam, each with an explanation that starts with why a wrong answer is wrong. No account needed. Try the first one now.

Identity and Access Administrator Associate sample10 free questions
An architect proposes relying on Conditional Access as the first line of defense against a denial-of-service attack on the sign-in page. Is that appropriate?

Why that one is wrong. Policies run after the first factor is satisfied, not before.

Why that one is wrong. Named locations are a signal for access decisions and do not make it a network-edge defense.

Why that one is wrong. It evaluates modern sign-ins, and it can also block legacy authentication.

Why D is right. Conditional Access uses signals from such events but is applied once first-factor authentication completes.

Conditional Access is a Zero Trust policy engine enforced after first-factor authentication. It is not a frontline defense against denial-of-service.

What the exam covers

  • Implement and manage user identities (23.7%)
  • Implement authentication and access management (28.9%)
  • Plan and implement workload identities (23.7%)
  • Plan and automate identity governance (23.7%)

A few more sample questions

Sample question 1. Which TWO object types can be added as members of a restricted management administrative unit? (Choose two.)

  1. User accounts
  2. Microsoft 365 groups
  3. Devices
  4. Mail-enabled security groups
  5. Distribution groups

Sample question 2. A vendor publishes a multitenant app. Customers configure SAML SSO, which needs signing certificates on the service principal in their tenant. The vendor wants to stop anyone in a customer tenant from adding client-credential secrets or certificates to that service principal, without breaking SAML setup. What should the vendor configure on its app registration?

  1. Enable app instance property lock and select All properties so every sensitive property is protected in customer tenants
  2. Enable app instance property lock and lock only Credentials used for verification, leaving signing keys unlocked
  3. Enable app instance property lock and lock Credentials used for signing tokens and the token encryption key ID
  4. Add a tenant-wide Block password addition app management policy in the vendor tenant to cover customer tenants

Sample question 3. An analyst investigates a risky sign-in that occurred 60 days ago in a tenant licensed with Microsoft Entra ID P2. Where does the data stand?

  1. It is gone, because risky sign-ins are retained for only 30 days at every license level
  2. It is still available, because risky sign-ins are retained for 90 days with P2
  3. It is retained indefinitely, because risky sign-ins have no retention limit
  4. It is available only if diagnostic settings were exporting it to a storage account at the time

Answer them with explanations

Get the Identity and Access Administrator Associate Cert Pass

$19.99 once. No subscription.

  • 277 practice questions with explained answers, 5 full timed practice tests, 277 flashcards and 3 study games.
  • Any 2 for $34.99. Any 3 for $49.99.
  • 25% off with code LAUNCH25: first 250 buyers, ends December 31, 2026.
  • Refund within 24 hours of a website purchase. See the Terms.
Get the Identity and Access Administrator Associate Cert Pass

How to trust this practice

  • Every answer explains why, and cites its source.
  • Practice tests are built around the vendor’s published exam domains.
  • These are practice questions, not real exam questions.

See the free sample questions for every certification

Take it with you

  • Download on the App Store
  • Get it on Google Play