CertifyDeckCargando contenido…
SC-300 · Sample questions
8 real questions from the CertifyDeck SC-300 bank, spread across the domains of the official Microsoft Identity and Access Administrator skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: A. Change the connected organization's state to Blocked
A connected organization can be set to a Blocked state, which prevents any new requests from users of that organization while preserving the connected organization configuration and existing assignment history. Deleting the connected organization (B) removes the configuration entirely and is not easily reversible for investigation purposes. Removing guest users (C) destroys identities and breaks existing assignments/audit trail. Disabling the access package for all requestors (D) is overly broad, blocking legitimate internal or other-partner requestors too.
Correct answer: D. An access package that includes a resource role from each of the three resources
An access package is the bundle of resource roles that an identity receives together, and its policies define who can request it, who approves and when the assignment expires. A catalog is only a container of resources and access packages used for delegation, so it defines no request or approval flow. A connected organization represents an external directory or domain, not a bundle of resources. An access review recertifies access that already exists; it does not provide a request workflow.
Correct answer: A. Built-in roles have a fixed set of permissions defined by Microsoft and cannot be modified, while custom roles let administrators combine specific permissions to meet unique needs
Built-in roles ship with predefined, immutable permission sets curated by Microsoft, whereas custom roles are assembled by administrators from granular permissions to fit unique requirements. Custom roles require a P1/P2 license (not free), built-in roles can be assigned at tenant or administrative unit scope, and custom roles do not expire automatically.
Correct answer: A. Global Administrator
Global Administrator can reset passwords for every user in the tenant, including other administrators, and is treated as the most privileged role requiring the strongest protections such as mandatory MFA and PIM. The other three roles are read-only or narrowly scoped and do not carry this level of risk.
Correct answer: A. WS-Federation or SAML
Federated sign-in with AD FS typically uses WS-Federation (or SAML) to redirect the browser to the on-premises federation server, which authenticates the user and returns a security token to Microsoft Entra ID. SMTP is an email protocol, RDP is for remote desktop sessions, and FTP is for file transfer — none are used for federated authentication redirects.
Correct answer: A. The named location condition in the policy only matches the corporate network, so from an external network the policy grant no longer applies and another policy requiring MFA takes effect
Conditional Access policies evaluate all applicable conditions, including named locations. If a policy that grants access without MFA is scoped to a specific trusted network location, signing in from outside that location means the policy simply does not apply, and any other applicable policy requiring MFA (or the tenant baseline) will govern the sign-in. Security defaults and Conditional Access are mutually exclusive (a tenant uses one or the other), so option B is false. SSPR and password expiry are unrelated to this MFA prompt behavior.
Correct answer: A. Sign-in risk
Sign-in risk is calculated per authentication attempt, reflecting signals like unfamiliar sign-in properties, anonymized IP addresses, or atypical travel for that specific session. User risk, by contrast, reflects the probability that the user identity itself has been compromised, aggregated across detections over time rather than tied to a single sign-in. Device compliance risk and application risk are not Identity Protection risk categories.
Correct answer: A. Dismiss the user risk, since the administrator has determined the account is not currently at risk
Dismiss user risk is the correct action when an administrator investigates and confirms the flagged risk does not represent a current threat (for example, credentials were already rotated before the detection), closing the risk state without further requiring the user to take action. Confirm compromised is the opposite action, used when risk is validated as real. Deleting the account is a disproportionate and destructive response to a resolved risk signal. Simply ignoring the detection leaves it in an unresolved state and does not reflect the completed investigation outcome.
Answer each question before opening the explanation, and write down why you discarded the other options. On SC-300, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 8 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official SC-300 format.