Free SC-300 flashcards

Which synchronisation technology suits disconnected multi-forest Active Directory environments needing a lightweight, Microsoft-managed service?

Microsoft Entra Cloud Sync. It places a lightweight provisioning agent in each forest and runs the synchronisation logic in a Microsoft-managed cloud service, so forests with no trust between them sync to one tenant without deploying a full sync server per forest.

Which hybrid sign-in method validates passwords against on-premises Active Directory while storing no password hash in the cloud?

Pass-through authentication. On-premises agents validate each sign-in against Active Directory in real time, so no password hash is ever placed in Microsoft Entra ID. Installing two or more authentication agents removes the single point of failure if one goes offline.

Common misconceptionThat re-hashing a password hash before upload means no usable credential reaches the cloud. Password hash sync still stores a credential derivative there.

Which Conditional Access control forces a user to reauthenticate at a fixed interval, and can it be limited to one application?

The sign-in frequency session control sets how long a token stays valid before reauthentication is required. By scoping a Conditional Access policy to a single application and setting a periodic value such as one hour, the recurring prompt applies only to that resource and leaves every other app untouched.

Which Conditional Access grant control restricts an app to managed devices that are healthy in Microsoft Intune?

The require device marked as compliant grant control reads the Microsoft Intune compliance state during evaluation and blocks access from devices that are not enrolled and compliant. It is the simplest control that ties access directly to device health.

Common misconceptionThat requiring MFA proves a device is managed and compliant. MFA verifies identity only; device health needs the compliant device grant control.

Which workload identity is created and deleted together with a single Azure resource and needs no managed credential?

A system-assigned managed identity is provisioned in Microsoft Entra ID directly on one Azure resource and shares its lifecycle, appearing when the resource is enabled and disappearing when it is deleted. The platform rotates the underlying credential, so an app like a VM reading Azure Key Vault secrets acquires tokens with no secret on disk and nothing separate to clean up.

Which workload identity can be created and granted roles before any compute exists and shared across many Azure resources with one role assignment?

A user-assigned managed identity is a standalone Microsoft Entra resource that lives independently of any compute. It can be created and granted Azure RBAC permissions before VMs or Azure Functions are deployed, then attached to many resources, so a single identity and a single role assignment can serve a whole fleet reaching the same storage account and Azure SQL database.

Common misconceptionThat reusing one app registration's client secret across a whole VM fleet is a reasonable shortcut. It just spreads the same stored secret to every resource instead of removing it.

In a Microsoft Entra access review, how do you make external guests attest to their own continued need and automatically lose access if they ignore the review each quarter?

Set the reviewer to users review their own access so each guest self-attests, use a quarterly recurrence, and configure apply results to remove access from non-responders. The self-review reviewer type forces members to confirm their own need, and applying results with removal revokes access from anyone who does not reply.

To review eligible and active assignments to the Global Administrator role on a recurring schedule, targeting the role itself, which Microsoft Entra tool creates the access review?

Create an access review for the Microsoft Entra role in Privileged Identity Management, scoped to Global Administrator. PIM reviews target the directory role directly, enumerate both eligible and active assignments, and support a quarterly recurrence, which group, application, and access-package reviews cannot do.

Common misconceptionThat reviewing the security group holding role members is the same as reviewing the role assignment. Group membership can drift from actual role holders.