Free SC-300 flashcards

Which synchronisation technology suits disconnected multi-forest Active Directory environments needing a lightweight, Microsoft-managed service?

Microsoft Entra Cloud Sync. It places a lightweight provisioning agent in each forest and runs the synchronisation logic in a Microsoft-managed cloud service, so forests with no trust between them sync to one tenant without deploying a full sync server per forest.

Microsoft Entra Connect Sync is the lightweight Microsoft-managed agent service for syncing disconnected forests.

Connect Sync can serve multiple forests, but it requires a full synchronisation server with network reachability and is not a lightweight Microsoft-managed agent. Microsoft Entra Cloud Sync is the lightweight agent-based service for disconnected multi-forest topologies.

Which Conditional Access control forces a user to reauthenticate at a fixed interval, and can it be limited to one application?

The sign-in frequency session control sets how long a token stays valid before reauthentication is required. By scoping a Conditional Access policy to a single application and setting a periodic value such as one hour, the recurring prompt applies only to that resource and leaves every other app untouched.

Setting sign-in frequency to one hour for all cloud apps is the cleanest way to force hourly reauthentication in just one sensitive app.

Targeting all cloud apps applies the hourly reauthentication tenant-wide, disrupting every application instead of the one that needs it. To limit the interval to a single resource, scope the Conditional Access policy to that one application.

Which workload identity is created and deleted together with a single Azure resource and needs no managed credential?

A system-assigned managed identity is provisioned in Microsoft Entra ID directly on one Azure resource and shares its lifecycle, appearing when the resource is enabled and disappearing when it is deleted. The platform rotates the underlying credential, so an app like a VM reading Azure Key Vault secrets acquires tokens with no secret on disk and nothing separate to clean up.

A user-assigned managed identity is automatically deleted when the virtual machine it is attached to is deleted.

A user-assigned managed identity has its own independent lifecycle and is not removed when an attached resource is deleted. It remains as a standalone Microsoft Entra object that must be cleaned up separately, so it does not satisfy a no-leftover-object requirement; a system-assigned managed identity does.

In a Microsoft Entra access review, how do you make external guests attest to their own continued need and automatically lose access if they ignore the review each quarter?

Set the reviewer to users review their own access so each guest self-attests, use a quarterly recurrence, and configure apply results to remove access from non-responders. The self-review reviewer type forces members to confirm their own need, and applying results with removal revokes access from anyone who does not reply.

Setting group owners as the access review reviewer satisfies a requirement that guests self-attest to their own access.

Group owners attest on behalf of the guests, not as the guests. To meet a self-attestation requirement the reviewer type must be users review their own access; the recurrence and removal action can be correct but the reviewer choice still fails the requirement.