A global administrator at Fabrikam suspects that a recently departed employee's account was used to change a user's password after termination. The admin needs to determine who performed the password change and when. The admin has access to the Microsoft Entra admin center. What should the admin do?

Search the audit logs for 'Change password' activity and filter by the target user.

Run a KQL query on SignInLogs to find password change events.

Review the sign-in logs for the target user's account around the time of termination.

Check the provisioning logs for the target user's account.

A security analyst needs to find all sign-in events in the last 24 hours where the user was from a specific IP address and the sign-in was successful. The logs are already streaming to a Log Analytics workspace. What should the analyst do?

Export the sign-in logs to a CSV file and use Excel to filter the data.

Run a KQL query on the SigninLogs table filtering by IP address and ResultType == 0.

Use the sign-in logs blade in the Microsoft Entra admin center and filter by IP address.

Create a workbook that displays all sign-in events and manually look for the IP address.

A company uses Microsoft Entra ID to provision users from a third-party HR system. Several users report they cannot sign in because their accounts were not created. The provisioning job shows 'Success' for the last run. What should the administrator do to identify the issue?

Examine the provisioning logs for skipped or failed entries for those users.

Check the audit logs for any deletion of the user objects.

Review the sign-in logs for the affected users to see if their sign-ins were blocked.

Run a KQL query against the audit logs for 'Provisioning' activities.

An administrator wants to review a list of failed sign-in attempts to identify potential brute-force attacks. Which Microsoft Entra admin center blade should they open?

Security > Identity Secure Score

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 4

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 5)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20–25%of the exam

Questions 21–25

21foundation · easy
Which Microsoft Entra feature provides a numerical score that reflects an organization's security posture and includes a list of recommended actions to improve it?
Select an answer first
22application · medium
A global administrator at Fabrikam suspects that a recently departed employee's account was used to change a user's password after termination. The admin needs to determine who performed the password change and when. The admin has access to the Microsoft Entra admin center. What should the admin do?
Select an answer first
23application · medium
A security analyst needs to find all sign-in events in the last 24 hours where the user was from a specific IP address and the sign-in was successful. The logs are already streaming to a Log Analytics workspace. What should the analyst do?
Select an answer first
24application · medium
A company uses Microsoft Entra ID to provision users from a third-party HR system. Several users report they cannot sign in because their accounts were not created. The provisioning job shows 'Success' for the last run. What should the administrator do to identify the issue?
Select an answer first
25foundation · easy
An administrator wants to review a list of failed sign-in attempts to identify potential brute-force attacks. Which Microsoft Entra admin center blade should they open?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 5)

Questions 21–25

Which Microsoft Entra feature provides a numerical score that reflects an organization's security posture and includes a list of recommended actions to improve it?

A security analyst needs to find all sign-in events in the last 24 hours where the user was from a specific IP address and the sign-in was successful. The logs are already streaming to a Log Analytics workspace. What should the analyst do?

A company uses Microsoft Entra ID to provision users from a third-party HR system. Several users report they cannot sign in because their accounts were not created. The provisioning job shows 'Success' for the last run. What should the administrator do to identify the issue?

An administrator wants to review a list of failed sign-in attempts to identify potential brute-force attacks. Which Microsoft Entra admin center blade should they open?

Keep studying — Plan and automate identity governance