An organization wants to build custom KQL queries and interactive reports for sign-in and audit logs. They need to retain the data for at least two years for compliance. Which configuration should they use?

Stream logs to an Azure Event Hub and consume them with a custom application.

Stream logs to a Log Analytics workspace and set the retention period to 730 days.

Stream logs to an Azure Storage account and use Azure Storage Explorer to query them.

Use the default Microsoft Entra admin center reports and export them monthly to CSV.

A company uses Microsoft Entra ID to provision users from multiple HR sources. They notice that some users are not being provisioned correctly. They need to identify which HR source is causing the most failures and see the trend over time. They have provisioning logs streaming to Log Analytics. What should they do?

Create a separate alert rule for each HR source.

Use the audit logs to see provisioning failures.

Review the provisioning logs in the admin center for each HR source.

Run a KQL query on ProvisioningLogs that groups by source and status, and visualize it in a workbook.

An organization's Identity Secure Score dropped by 20 points overnight. The security team needs to identify the root cause quickly and prevent it from happening again. They have audit logs streaming to Log Analytics. What should they do first?

Check the sign-in logs for a spike in failed sign-ins.

Run a KQL query on AuditLogs for the last 24 hours to find changes to security settings.

Review the Identity Secure Score recommendations to see which ones are now failing.

Create a workbook to visualize the score over time.

A security analyst needs to create a custom dashboard that shows sign-in failures by application and also wants to set up an alert when the number of failures exceeds a threshold. The sign-in logs are in a Log Analytics workspace. What should the analyst do?

Use the built-in sign-in logs report and set an alert on it.

Create a workbook with a KQL query for failures by application, and create a log alert rule based on a similar query.

Create a log alert rule and use the alert email as the dashboard.

Create a workbook and set an alert on the workbook itself.

Microsoft Certified:Identity and Access Administrator Associate

Domain 4Objective 4

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 6)

Part of the Plan and automate identity governance domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20–25%of the exam

Questions 26–30

26application · medium
An organization wants to build custom KQL queries and interactive reports for sign-in and audit logs. They need to retain the data for at least two years for compliance. Which configuration should they use?
Select an answer first
27foundation · easy
Which Microsoft Entra feature allows an administrator to route sign-in logs and audit logs to a Log Analytics workspace, storage account, or Azure Event Hubs?
Select an answer first
28expert · hard
A company uses Microsoft Entra ID to provision users from multiple HR sources. They notice that some users are not being provisioned correctly. They need to identify which HR source is causing the most failures and see the trend over time. They have provisioning logs streaming to Log Analytics. What should they do?
Select an answer first
29expert · hard
An organization's Identity Secure Score dropped by 20 points overnight. The security team needs to identify the root cause quickly and prevent it from happening again. They have audit logs streaming to Log Analytics. What should they do first?
Select an answer first
30expert · hard
A security analyst needs to create a custom dashboard that shows sign-in failures by application and also wants to set up an alert when the number of failures exceeds a threshold. The sign-in logs are in a Log Analytics workspace. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.

Monitor Identity Activity by Using Logs, Workbooks, and Reports SC-300 Practice Questions (Page 6)

Questions 26–30

An organization wants to build custom KQL queries and interactive reports for sign-in and audit logs. They need to retain the data for at least two years for compliance. Which configuration should they use?

Which Microsoft Entra feature allows an administrator to route sign-in logs and audit logs to a Log Analytics workspace, storage account, or Azure Event Hubs?

An organization's Identity Secure Score dropped by 20 points overnight. The security team needs to identify the root cause quickly and prevent it from happening again. They have audit logs streaming to Log Analytics. What should they do first?

A security analyst needs to create a custom dashboard that shows sign-in failures by application and also wants to set up an alert when the number of failures exceeds a threshold. The sign-in logs are in a Log Analytics workspace. What should the analyst do?

Keep studying — Plan and automate identity governance