An auditor requires a report of all changes to user accounts, including who made the change and when, for the last 6 months. The organization has a Log Analytics workspace with a retention of 180 days. The audit logs are currently only available in the Microsoft Entra admin center. What should the administrator do to provide the report?

Use the audit logs blade in the Microsoft Entra admin center to export the last 6 months of data.

Ask the auditor to accept a report of the last 30 days only.

Configure diagnostic settings to send AuditLogs to the Log Analytics workspace, then query the AuditLogs table for the last 6 months.

Create a workbook in the Microsoft Entra admin center that displays audit logs for the last 6 months.

A security administrator notices that the Identity Secure Score has decreased over the past week. They need to identify which specific changes caused the decrease and take corrective action. What should they do first?

Review the Identity Secure Score recommendations and compare with recent audit logs.

Check the sign-in logs for failed sign-ins that might indicate a security incident.

Create a custom workbook to visualize sign-in trends.

Run a KQL query on provisioning logs to see if user provisioning changed.

An organization needs to keep Microsoft Entra sign-in logs for more than the default retention period. Which solution should they configure?

Diagnostic settings to export logs to a storage account

Identity Secure Score recommendations

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 4

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 2)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20–25%of the exam

Questions 6–10

6expert · hard
An auditor requires a report of all changes to user accounts, including who made the change and when, for the last 6 months. The organization has a Log Analytics workspace with a retention of 180 days. The audit logs are currently only available in the Microsoft Entra admin center. What should the administrator do to provide the report?
Select an answer first
7foundation · easy
Which Microsoft Entra log is specifically designed to show the synchronization and provisioning actions performed by a provisioning service, such as creating or updating user accounts?
Select an answer first
8application · medium
A security administrator notices that the Identity Secure Score has decreased over the past week. They need to identify which specific changes caused the decrease and take corrective action. What should they do first?
Select an answer first
9foundation · easy
An organization needs to keep Microsoft Entra sign-in logs for more than the default retention period. Which solution should they configure?
Select an answer first
10foundation · easy
Which Microsoft Entra tool provides interactive, customizable dashboards that combine data from multiple sources, such as sign-in logs and audit logs, to provide insights into identity management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 2)

Questions 6–10

Which Microsoft Entra log is specifically designed to show the synchronization and provisioning actions performed by a provisioning service, such as creating or updating user accounts?

A security administrator notices that the Identity Secure Score has decreased over the past week. They need to identify which specific changes caused the decrease and take corrective action. What should they do first?

An organization needs to keep Microsoft Entra sign-in logs for more than the default retention period. Which solution should they configure?

Which Microsoft Entra tool provides interactive, customizable dashboards that combine data from multiple sources, such as sign-in logs and audit logs, to provide insights into identity management?

Keep studying — Plan and automate identity governance