Microsoft SC-300 Korean Actual Tests : Microsoft Identity and Access Administrator (SC-300 Korean Version)

Correct Answer: B  🗳️

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

Correct Answer:

Explanation:
User1 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = Yes User2 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = Yes User3 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = No Comprehensive and Detailed Explanation with all Microsoft SC-300: Identity and Access Administrator documents : = In Conditional Access, enforcement is determined by Assignments # Users or workload identities (which specify who the policy applies to) and Target resources (which specify what apps/resources are protected).
When a policy's Grant control is set to Require multifactor authentication , all identities included in the policy's user assignment scope must perform MFA when accessing the targeted resources. Being a member of multiple groups does not weaken enforcement; if a user is in any included group, the policy applies.
Conversely, users not included in the policy's user assignment scope are not prompted by that policy, even if they hold privileged roles. Holding the Global Administrator role does not automatically force MFA unless the tenant uses Security defaults or a Conditional Access policy targets that admin account or its group.
Applying this to the scenario: Policy1 targets All cloud apps (so the apps side is universal), and-given the group context-its user assignment is scoped to Group1 . User1 (Group1) and User2 (Group1 and Group2) are both in scope and therefore must perform MFA. User3 is only in Group2 ; since Group2 is not within the policy's user assignment, Policy1 does not apply to User3, despite the Global Administrator role. Hence:
Yes for User1, Yes for User2, and No for User3.

Correct Answer:

Explanation:

In Azure AD Entitlement Management , the tenant-level lifecycle settings govern what happens to external users when their last access package assignment ends. The SC-300 materials explain that when "Block external users from signing in to this directory = Yes," a guest whose final assignment expires or is removed is immediately blocked from sign-in to the resource directory. With "Remove external user = Yes" and a configured period (here 30 days ), the guest account is deleted from the directory after that interval provided the user has no other active access package assignments . These lifecycle actions are tied to access package assignments , not to unrelated memberships or role grants that were not delivered via entitlement management.
Applying the timelines: Guest1 and Guest2 received Package1 on Mar 1 with an assignment expiration of Apr 1 . On Apr 1 , their last assignment ended, so they were blocked the same day, and then removed after
30 days -on or about May 1 . Therefore, on May 5 , neither Guest1 nor Guest2 remains in the directory .
The fact that Guest1 was granted a Reports reader role on Mar 2 does not prevent lifecycle removal because it is not an access package assignment . Guest3 , however, was invited on Apr 1 and added to the All Company group on Apr 4 outside of entitlement management; since there was no access package assignment to expire , the lifecycle removal policy does not apply , so Guest3 is still present on May 5 .

Correct Answer:

Explanation:

According to the Microsoft SC-300 Study Guide, Exam Ref SC-300, and Microsoft Entra (Azure AD B2B collaboration) documentation, when a guest is invited to an Azure AD tenant and the setting "Email one-time passcode for guests" is enabled, Azure AD determines the authentication method based on the guest's account type.
Here's how the logic applies:
* Guest1 (adatum.com - Azure AD account)
* Because adatum.com is an Azure AD-managed domain, Guest1 will authenticate using their own organization's Azure AD credentials.
* The guest sign-in will federate to their home tenant, and therefore no one-time passcode (OTP) is sent.
* Guest2 (outlook.com - Microsoft account)
* A user with an @outlook.com email has a Microsoft account (MSA).
* Microsoft accounts can authenticate directly via Microsoft's identity system.
* Hence, no one-time passcode is sent - the user signs in using their Microsoft account credentials.
* Guest3 (gmail.com - Personal Google account)
* A @gmail.com address is not a Microsoft account and not linked to any Azure AD tenant by default.
* In this case, because the tenant's setting "Email one-time passcode for guests" is enabled, Azure AD automatically sends a one-time passcode (OTP) to the guest's email address for authentication.
* The Microsoft documentation specifies that the OTP is valid for 30 minutes and is single-use.
After expiration, a new code is issued upon the next authentication attempt.
This is confirmed in Microsoft's official Entra ID documentation:
"When the Email one-time passcode for guests setting is enabled, guests who do not have an Azure AD or Microsoft account will authenticate using a one-time passcode that is valid for 30 minutes."

Correct Answer:

Explanation:
Yes
NO
No
This question tests understanding of Azure Managed Identities - both system-assigned and user-assigned - and their regional restrictions and role assignment capabilities.
Let's break it down carefully based on official Microsoft documentation and SC-300 study material:
* VM1 Region: East US
* System-assigned Managed Identity: Disabled (so we can only use user-assigned identities)
* Managed Identities available:
* Managed1 - East US
* Managed2 - East US
* Managed3 - West US
According to Microsoft documentation:
"A user-assigned managed identity can be used only by resources in the same Azure region as the managed identity." That means:
* A VM in East US can use user-assigned managed identities that are also located in East US only.
* A VM in East US cannot use a user-assigned managed identity created in West US.
Therefore:
* # Managed2 (East US) # can be assigned to VM1 (East US).
* # Managed3 (West US) # cannot be assigned to VM1 (East US).
The question also includes:
"You can assign VM1 the Owner role for RG1."
Per Azure RBAC design and SC-300 guidelines:
* Azure roles (such as Owner, Contributor, Reader) can only be assigned to Azure AD security principals, which include users, groups, service principals, and managed identities - but not to Azure resources themselves (like a VM directly).
* Therefore, you cannot assign a role to VM1 as an object; you can only assign roles to VM1's managed identity (if it had one enabled).
Since VM1's system-assigned identity is disabled and the user-assigned identity (Managed1) already attached cannot represent the VM itself for new role assignments, VM1 cannot directly hold the Owner role for RG1.