A security team wants to create a custom alert that triggers when a user signs in from a country outside their usual region. The sign-in logs are in a Log Analytics workspace. What should they do to set up this alert?

Use the Identity Secure Score to detect unusual sign-in locations.

Create a workbook with a visualization of sign-ins by location and set an alert on the workbook.

Write a KQL query that filters sign-in logs by location, then create a log alert rule based on that query.

Use the built-in sign-in logs report and set up an alert on it.

An auditor asks for a report of all changes made to conditional access policies in the last 90 days. The audit logs are only retained for 30 days by default, but the organization has a Log Analytics workspace. What should the administrator do to provide the report?

Create a workbook that displays audit log data from the portal.

Ask the auditor to accept a report of the last 30 days only.

Use the audit logs blade in the Microsoft Entra admin center and filter by date range.

Query the AuditLogs table in Log Analytics for conditional access policy changes.

An organization wants to create a workbook that shows sign-in activity for the last 90 days, but their Log Analytics workspace has a retention of 30 days. They need to extend the retention for this workbook's data. What should they do?

Use the built-in sign-in logs report in the Microsoft Entra admin center instead.

Export the sign-in logs to a storage account and connect the workbook to the storage account.

Create the workbook with a custom query that pulls data from the Microsoft Entra admin center.

Increase the Log Analytics workspace retention policy to 90 days.

A large enterprise has multiple Log Analytics workspaces because different departments manage their own Azure subscriptions. The central identity team needs a single dashboard that shows sign-in anomalies across all departments. They have access to all workspaces. What should they do?

Use the Microsoft Entra admin center sign-in logs blade, which aggregates data across all workspaces.

Create a separate workbook for each workspace and pin them to a shared dashboard.

Ask each department to export their sign-in logs to a shared storage account and then build a workbook on that.

Create a workbook that uses a cross-workspace KQL query to union SigninLogs from all workspaces.

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 4

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 4)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20–25%of the exam

Questions 16–20

16application · medium
A security team wants to create a custom alert that triggers when a user signs in from a country outside their usual region. The sign-in logs are in a Log Analytics workspace. What should they do to set up this alert?
Select an answer first
17application · medium
An auditor asks for a report of all changes made to conditional access policies in the last 90 days. The audit logs are only retained for 30 days by default, but the organization has a Log Analytics workspace. What should the administrator do to provide the report?
Select an answer first
18expert · hard
An organization wants to create a workbook that shows sign-in activity for the last 90 days, but their Log Analytics workspace has a retention of 30 days. They need to extend the retention for this workbook's data. What should they do?
Select an answer first
19foundation · easy
In the Microsoft Entra admin center, which log is the primary resource for reviewing user sign-in activity, including the application used, the device, and the location of each sign-in attempt?
Select an answer first
20expert · hard
A large enterprise has multiple Log Analytics workspaces because different departments manage their own Azure subscriptions. The central identity team needs a single dashboard that shows sign-in anomalies across all departments. They have access to all workspaces. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.