EarnYourCert
Open the app
Exams › SC-300 › Domain 1 of 4
SC-300 · Domain 1 of 4 · 20-25% of the exam

Implement and manage user identities

Domain 1 of SC-300 accounts for 20-25% of the exam. EarnYourCert has 98 original questions for this domain, all with explanations: 67 multiple choice, 13 yes/no and 18 completion or ordering items, like the real exam.

Practice domain 1 for free →No sign-up. Choose how many questions you want.

Domain 1 sample questions

8 questions from our 98-question bank for this domain. Try to answer before revealing the solution.

1. Which role can manage the roles and role assignments of all other administrators, including Global Administrators' MFA settings?

  1. Directory Readers with elevated scope
  2. User Administrator for all units
  3. Privileged Role Administrator
  4. Guest Inviter
Show answer

Correct answer: C. Privileged roles are needed to manage authentication methods and role assignments of admins.

2. Your organization has acquired another company and wants users to sign in with both contoso.com and fabrikam.com. What should you do?

  1. Add and verify both custom domains; one is primary
  2. Use only the onmicrosoft.com domain for every user
  3. Use guest accounts only
  4. Create a second tenant for each acquired domain
Show answer

Correct answer: A. A tenant can host multiple verified custom domains.

3. An administrative unit must automatically include every user whose Country is 'Spain'. What should you configure?

  1. A Conditional Access policy that targets the Spain named location
  2. Restricted management
  3. A naming policy
  4. Dynamic membership rules on the administrative unit
Show answer

Correct answer: D. Administrative units support dynamic membership rules for users or devices (requires P1).

4. You want group membership to update automatically when a user's Department attribute changes to Sales. What type of group should you create?

  1. A security group with assigned membership
  2. A mail-enabled security group only
  3. A distribution list
  4. A security group with dynamic user membership
Show answer

Correct answer: D. Dynamic membership rules evaluate attributes and add or remove members automatically.

5. Which dynamic membership rule would add all devices running Windows to a group?

  1. (user.country -eq "Windows")
  2. (user.jobTitle -contains "PC")
  3. (group.type -eq "Windows")
  4. (device.deviceOSType -eq "Windows")
Show answer

Correct answer: D. Device dynamic groups evaluate device attributes such as deviceOSType.

6. Hundreds of devices haven't signed in for over a year. What is the recommended cleanup approach?

  1. Wait for Microsoft to remove them automatically after 90 days
  2. Use the approximate last sign-in timestamp to disable, then delete stale devices
  3. Reset every user's password
  4. Delete all devices immediately
Show answer

Correct answer: B. Disabling first allows recovery if a device is still in use; BitLocker keys are lost when a device is deleted.

7. A guest user does not have a Microsoft account or work account. Which feature lets them sign in with a one-time code sent to their email?

  1. Email one-time passcode
  2. Application Proxy
  3. Pass-through authentication
  4. Windows Hello
Show answer

Correct answer: A. Email OTP is a fallback for guests without another identity provider.

8. A cloud user is matched to an on-premises user with the same email address during first synchronization. What is this behavior called?

  1. Staged rollout
  2. Soft match
  3. Hard delete
  4. Break glass
Show answer

Correct answer: B. Soft match uses attributes such as userPrincipalName or proxyAddresses; hard match uses the immutable ID.

Practice domain 1 for free →

Other SC-300 domains

2Implement authentication and access management25-30% 3Plan and implement workload identities20-25% 4Plan and automate identity governance20-25% SC-300: full practice exam→