An identity team wants to create a reusable, interactive dashboard that shows sign-in failures by application and user for the last 30 days. The dashboard should be accessible to other team members and update automatically. What should they use?

Use the Microsoft Entra admin center sign-in logs blade and apply filters.

Create an Azure Workbook that queries SigninLogs in Log Analytics.

Create a Power BI report that connects directly to Microsoft Graph sign-in logs.

Export sign-in logs to a CSV file and share it via email weekly.

A multinational company has a compliance requirement to keep sign-in logs for five years. They also need to provide auditors with a KQL queryable interface for the last 90 days. They are concerned about the cost of storing all data in a hot Log Analytics workspace. What should they do?

Stream all sign-in logs to a storage account and use Azure Data Explorer for queries.

Export logs to a third-party SIEM and rely on that for queries.

Use Log Analytics with a 90-day interactive retention and archive the rest for five years.

Keep all logs in Log Analytics with a five-year interactive retention.

To run KQL queries against Microsoft Entra ID sign-in logs, where must the logs be sent first?

To an Azure Event Hubs instance

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 4

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 3)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20–25%of the exam

Questions 11–15

11application · medium
An identity team wants to create a reusable, interactive dashboard that shows sign-in failures by application and user for the last 30 days. The dashboard should be accessible to other team members and update automatically. What should they use?
Select an answer first
12foundation · easy
Which query language is used to write queries against Microsoft Entra ID logs in a Log Analytics workspace?
Select an answer first
13expert · hard
A multinational company has a compliance requirement to keep sign-in logs for five years. They also need to provide auditors with a KQL queryable interface for the last 90 days. They are concerned about the cost of storing all data in a hot Log Analytics workspace. What should they do?
Select an answer first
14foundation · easy
Which Microsoft Entra log should an administrator review to see who changed a user's password or updated a group's membership?
Select an answer first
15foundation · easy
To run KQL queries against Microsoft Entra ID sign-in logs, where must the logs be sent first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 3)

Questions 11–15

An identity team wants to create a reusable, interactive dashboard that shows sign-in failures by application and user for the last 30 days. The dashboard should be accessible to other team members and update automatically. What should they use?

Which query language is used to write queries against Microsoft Entra ID logs in a Log Analytics workspace?

A multinational company has a compliance requirement to keep sign-in logs for five years. They also need to provide auditors with a KQL queryable interface for the last 90 days. They are concerned about the cost of storing all data in a hot Log Analytics workspace. What should they do?

Which Microsoft Entra log should an administrator review to see who changed a user's password or updated a group's membership?

To run KQL queries against Microsoft Entra ID sign-in logs, where must the logs be sent first?

Keep studying — Plan and automate identity governance