Contoso's security team needs to investigate a series of failed sign-in attempts for a specific user over the past 30 days. They want to run a KQL query that filters sign-in logs by user principal name and error code, and they need the data to be available in Log Analytics. What should they do first?

Create a custom workbook that queries the audit logs for failed sign-ins.

Use the Microsoft Entra admin center sign-in logs blade and apply a filter for the user.

Enable Azure AD Connect Health to stream sign-in events to Log Analytics.

Configure diagnostic settings to export SignInLogs to the Log Analytics workspace.

A company uses Microsoft Entra ID to provision users from SAP SuccessFactors. The identity team wants to monitor provisioning failures and receive alerts when the failure rate exceeds a threshold. They also want to analyze historical trends. What should they do?

Review the provisioning logs in the admin center daily.

Create a workbook that shows provisioning failures, but do not configure alerts.

Stream provisioning logs to Log Analytics and create a KQL query with an alert rule.

Use the audit logs to monitor provisioning failures.

An organization wants to use Azure Monitor workbooks to visualize sign-in trends and also wants to alert on specific sign-in failures. They already have a Log Analytics workspace. What should they configure to make the data available?

Use the built-in workbooks in the Microsoft Entra admin center without any additional configuration.

Export sign-in logs to a storage account and then import them into Log Analytics manually.

Configure an Event Hub to receive sign-in logs and then connect it to Log Analytics.

Create diagnostic settings for Microsoft Entra ID to send SignInLogs to the Log Analytics workspace.

A security team needs to detect when a global administrator changes another administrator's password. They want to be alerted in near real-time. They have audit logs streaming to Log Analytics. What should they do?

Use the Microsoft Entra admin center audit logs and set up a saved search.

Create a KQL query on AuditLogs that filters for password change activities and create an alert rule on it.

Stream audit logs to an Event Hub and build a custom alerting application.

Create a workbook that shows password changes and review it daily.

A helpdesk manager wants to provide a report to executives showing the number of successful and failed sign-ins per day for the last quarter. The data must be aggregated and visualized. The organization already streams sign-in logs to Log Analytics. What should the manager do?

Create a workbook with a KQL query that summarizes SigninLogs by day and result.

Export sign-in logs to a CSV file and create a pivot table in Excel.

Use the Microsoft Entra admin center sign-in logs blade and manually count entries.

Review the audit logs to count sign-in events.

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 4

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 1)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20–25%of the exam

Questions 1–5

1application · medium
Contoso's security team needs to investigate a series of failed sign-in attempts for a specific user over the past 30 days. They want to run a KQL query that filters sign-in logs by user principal name and error code, and they need the data to be available in Log Analytics. What should they do first?
Select an answer first
2application · medium
A company uses Microsoft Entra ID to provision users from SAP SuccessFactors. The identity team wants to monitor provisioning failures and receive alerts when the failure rate exceeds a threshold. They also want to analyze historical trends. What should they do?
Select an answer first
3application · medium
An organization wants to use Azure Monitor workbooks to visualize sign-in trends and also wants to alert on specific sign-in failures. They already have a Log Analytics workspace. What should they configure to make the data available?
Select an answer first
4expert · hard
A security team needs to detect when a global administrator changes another administrator's password. They want to be alerted in near real-time. They have audit logs streaming to Log Analytics. What should they do?
Select an answer first
5application · medium
A helpdesk manager wants to provide a report to executives showing the number of successful and failed sign-ins per day for the last quarter. The data must be aggregated and visualized. The organization already streams sign-in logs to Log Analytics. What should the manager do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.