Plan and implement workload identities
Domain 3 of SC-300 accounts for 20-25% of the exam. EarnYourCert has 103 original questions for this domain, all with explanations: 67 multiple choice, 14 yes/no and 22 completion or ordering items, like the real exam.
Domain 3 sample questions
8 questions from our 103-question bank for this domain. Try to answer before revealing the solution.
1. What is the difference between a system-assigned and a user-assigned managed identity?
- User-assigned identities cannot access Key Vault, so system-assigned is required for secrets
- System-assigned follows one resource's lifecycle; user-assigned is standalone and shareable
- There is no difference
- System-assigned identities can be used only by users, while user-assigned ones serve apps
Show answer
Correct answer: B. Use user-assigned identities when multiple resources need the same identity or when you need to pre-authorize access.
2. An application running on a virtual machine needs to call the Azure Resource Manager API without credentials in code. What is the correct sequence?
- Enable a managed identity on the VM and grant it an Azure role
- Create a guest user for the app and store its password on the VM
- Store an administrator password in the app configuration file
- Disable Azure RBAC on the subscription
Show answer
Correct answer: A. The app gets tokens from the instance metadata endpoint without handling secrets.
3. Which authentication approach lets a GitHub Actions workflow access Azure resources without storing a secret?
- SMS verification
- A long-lived client secret in the repository
- A shared admin password
- Workload identity federation using OpenID Connect
Show answer
Correct answer: D. Federated credentials trust tokens from external identity providers.
4. What does the Microsoft Entra Application Proxy connector require regarding network connectivity?
- Outbound access to the Application Proxy service; no inbound ports
- A public IP address on the server
- Inbound access from the internet to the server
- A dedicated ExpressRoute
Show answer
Correct answer: A. Outbound-only connections reduce attack surface.
5. An app registration is configured for a single-page application. Which setting must be added so Entra ID can return tokens to the app after sign-in?
- A redirect URI of the SPA type
- A DNS TXT record
- A custom banned password
- A dynamic group rule
Show answer
Correct answer: A. Redirect URIs define where tokens or authorization codes are sent after authentication.
6. Which Defender for Cloud Apps capability helps you manage risky OAuth apps that have access to company data?
- App governance and OAuth app policies
- BitLocker policies for the managed endpoints
- Teams meeting policies for external attendees
- Azure Bastion hosts in the virtual network
Show answer
Correct answer: A. OAuth app policies detect overprivileged or suspicious apps and allow remediation.
7. You mark a cloud app as unsanctioned in Defender for Cloud Apps. What can you do next?
- Reset all user passwords for the app
- Block it through Defender for Endpoint or a network appliance
- Delete the app's registration and all of its service principals
- Disable MFA for the users who accessed the app last month
Show answer
Correct answer: B. Unsanctioning can be enforced with endpoint or network integration.
8. Which Defender for Cloud Apps capability gives detailed insight into OAuth apps' data access and lets you set policies on unusual behavior, such as an app suddenly reading many emails?
- Log collector
- App governance
- Cloud Discovery
- Conditional Access app control with session policies
Show answer
Correct answer: B. App governance monitors Graph API usage of OAuth apps and can automatically disable risky apps.