Free Microsoft SC-300 practice questions

10 free Microsoft SC-300 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 463 questions. Work through them, then open each answer to check your reasoning.

Get all 463 questions (US$39) · Download these 10 as a PDF

Question 1

You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.

Several users use their contoso.com email address for self-service sign-up to Azure Active Directory (Azure AD).

You gain global administrator privileges to the Azure AD tenant that contains the sel-igned users.

You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.

Which PowerShell cmdlet should you run?

  1. Set-MsolCompanySettings
  2. Set-MsolDomainFederationSettings
  3. Update-MsolfederatedDomain
  4. Set-MsolDomain
Show answer and explanation

Correct answer: A. Set-MsolCompanySettings

Set-MsolCompanySettings is the correct cmdlet to manage organizational settings in Azure AD, including self-service sign-up policies. This cmdlet allows you to disable sel-ervice sign-up for specific domains, preventing users from creating accounts via sel-ervice registration for Microsoft 365 services.

Why the other options are wrong

  • B. Set-MsolDomainFederationSettings configures federation settings for a domain, not self-service sign-up restrictions.
  • C. Update-MsolfederatedDomain is used to update federated domain properties, not to control self-service sign-up.
  • D. Set-MsolDomain manages domain properties but does not control self-service sig-p policies.

Question 2

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.

You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

What should you use?

  1. the Identity Governance blade in the Azure Active Directory admin center
  2. the Set-AzureAdUser cmdlet
  3. the Licenses blade in the Azure Active Directory admin center
  4. the Set-WindowsProductKey cmdlet
Show answer and explanation

Correct answer: C. the Licenses blade in the Azure Active Directory admin center

The Licenses blade in the Azure AD admin center provides the least administrative effort for bulk license operations. After assigning E5 licenses to users via group-based licensing, you can use the Licenses blade to efficiently remove the E3 licenses from all 2,500 users simultaneously without manual per-user operations.

Why the other options are wrong

  • A. The Identity Governance blade is designed for access reviews and entitlement management, not bulk license removal.
  • B. Set-AzureAdUser cmdlet would require scripting and individual user operations, requiring more administrative effort than using the admin center.
  • D. Set-WindowsProductKey is a local Windows management cmdlet unrelated to Microsoft 365 license management.

Question 3

You have an Azure Active Directory (Azure AD) tenant named contoso.com.

You plan to bulk invite Azure AD business-to-business (B2B) collaboration users.

Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

  1. email address
  2. redirection URL
  3. username
  4. shared key
  5. password
Show answer and explanation

Correct answer: A, B

A. email address B. redirection URL When creating bulk B2B collaboration invitations in Azure AD, you must include the email address of the invited user and a redirection URL that specifies where the invited user should be directed after accepting the invitation. These two parameters are mandatory for the bulk invite process to function properly.

Why the other options are wrong

  • C. Username is not a required parameter for B2B bulk invites; Azure AD uses the email address as the primary identifier.
  • D. A shared key is not part of the B2B bulk invite process.
  • E. Password is not a parameter for B2B invites; invited users set their own credentials upon acceptance.

Question 4

You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.

Which objects can you add as members to Group3?

Exhibit for question 4

  1. User2 and Group2 only
  2. User2, Group1, and Group2 only
  3. User1, User2, Group1 and Group2
  4. User1 and User2 only
  5. User2 only ✅Correct Answer: D, User1 and User2 only Group3 is a mail-enabled security group. Membership of a mail-enabled security group can include user accounts and other mail-enabled groups, but plain Azure AD security groups and Microsoft 365 groups cannot be nested inside it. Assigned licenses are irrelevant to group membership, so the license column is a distractor. That leaves both User1 and User2 as valid members of Group3, while Group1 (a security group) and Group2 (a Microsoft 365 group) cannot be added.
Show answer and explanation

The answer and explanation for this question are in the free sample PDF.

Question 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.

You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

Solution: You configure password writeback.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: B. No

Password writeback synchronizes password changes from Azure AD back to on-premises Active Directory. However, it does not affect the authentication behavior of disabled accounts. The 30-minute delay occurs due to token caching and synchronization intervals, which password writeback does not address. This solution does not meet the goal.

Why the other options are wrong

  • A. Password writeback is unrelated to preventing authentication of disabled accounts; it only handles password synchronization direction.

Question 6

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.

You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

Solution: You configure pass-through authentication.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: A. Yes

Pass-through authentication validates user credentials directly against on-premises Active Directory for every sign-in attempt. When a user account is disabled in Active Directory, pass-through authentication immediately rejects authentication requests since it checks the actual on-premises account status in real-time, eliminating the 30-minute delay caused by token caching.

Why the other options are wrong

  • B. Pass-through authentication directly validates against on-premises AD in real-time, which meets the requirement of immediate prevention of authentication for disabled accounts.

Question 7

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest.

You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

Solution: You configure conditional access policies.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: B. No

Conditional access policies control whether users can access applications based on conditions, but they cannot directly validate real-time account status in on-premises Active Directory. The 30-minute delay stems from token caching in Azure AD, which conditional access policies cannot override. This solution does not address the root cause of the authentication delay.

Why the other options are wrong

  • A. Conditional access policies operate on Azure AD tokens and cached identity information, not on real-time on-premises account status checks.

Question 8

You have an Azure Active Directory (Azure AD) tenant that contains the following objects.

• A device named Device1

• Users named User1, User2, User3, User4, and User5

Five groups named Group1, Group2, Group3, Group4, and Group5

The groups are configured as shown in the following table.

How many licenses are used if you assign the Microsoft 365 Enterprise E5 license to Group1?

Exhibit for question 8

  1. 0
  2. 2
  3. 3
  4. 4
Show answer and explanation

Correct answer: B. 2

When assigning a Microsoft 365 Enterprise E5 license to Group1, the license is consumed only by direct user members who are licensed objects. Group1 contains User1, User3, Group2, and Group4. User1 and User3 are direct users and will consume licenses. Group2 is a Dynamic User group containing User2, but nested group members don't consume licenses from the parent group assignment. Group4 is a Microsoft 365 group, which itself doesn't consume a license. Therefore, only 2 licenses (for User1 and User3) are used when assigning the license to Group1.

Why the other options are wrong

  • A. Zero licenses cannot be correct as Group1 contains direct user members (User1 and User3) who would be assigned the license.
  • C. Three licenses is incorrect because nested members through Group2 and Group4 are not counted; only the 2 direct user members (User1 and User3) consume licenses.
  • D. Four licenses is incorrect as it would require counting all unique users, but nested group membership and device members do not consume licenses in group-based assignment.

Question 9

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1.

A contractor uses the credentials of user1@outlook.com.

You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as user1@outlook.com.

What should you do?

  1. Run the New-AzADUser cmdlet.
  2. Configure the External collaboration settings.
  3. Add a WS-Fed identity provider.
  4. Create a guest user account in contoso.com.
Show answer and explanation

Correct answer: D. Create a guest user account in contoso.com.

To provide a contractor using an external email (user1@outlook.com) access to an Azure AD enterprise application while maintaining their external identity, you must create a guest user account in the contoso.com tenant. This allows the contractor to authenticate as their external identity while being part of the organization's directory for application access.

Why the other options are wrong

  • A. New-AzADUser creates native Azure AD user accounts, not guest accounts for external identities.
  • B. External collaboration settings control guest invitation policies but do not provision access; you still need to create the guest account.
  • C. Configuring a WS-Fed identity provider is used for federated authentication scenarios, not for adding individual guest users.

Question 10

Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect.

You need to prevent the synchronization of users who have the extensionAttribute15 attribute set to NoSync.

What should you do in Azure AD Connect?

  1. Create an inbound synchronization rule for the Windows Azure Active Directory connector.
  2. Configure a Full Import run profile.
  3. Create an inbound synchronization rule for the Active Directory Domain Services connector.
  4. Configure an Export run profile. ✅Correct Answer: C, Create an inbound synchronization rule for the Active Directory Domain Services connector. To stop users with extensionAttribute15 set to NoSync from synchronizing, create an inbound synchronization rule on the Active Directory Domain Services connector. The rule uses a scoping filter on extensionAttribute15 equal to NoSync and sets cloudFiltered to True, so matching on-premises users are filtered out and never provisioned to Azure AD.
Show answer and explanation

Answer and explanation for question 10

That was 10 of 463.

The full Microsoft SC-300 pack has all 463 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack