Your organization has a policy that users can consent to low-impact permissions, but all high-impact permissions require admin approval. You have classified permissions accordingly. A user attempts to consent to an app that requests both User.Read (low impact) and Group.Read.All (high impact). What happens?

The user is allowed to consent to User.Read, and Group.Read.All is ignored.

The user is allowed to consent to both permissions because User.Read is low impact.

The user is allowed to consent to User.Read, and the app silently receives Group.Read.All.

The user is blocked from consenting, and an admin consent request is sent to the admin.

You are publishing an on-premises app via Application Proxy. The app is accessed by users both inside and outside the network. You need to ensure that users outside the network are prompted for MFA, but users inside the network are not. What is the most efficient way to achieve this?

Create two Application Proxy apps, one for internal and one for external, and require MFA only on the external one.

Enable MFA on the connector server for external requests.

Create a conditional access policy that targets the Application Proxy app and requires MFA for all locations, then exclude the corporate network IPs.

Configure the Application Proxy app to require MFA only for external users.

A SaaS app is integrated with Microsoft Entra ID. The app requests permissions that are classified as high impact. You want to require that all consent requests for this app go through an approval process. You also want to ensure that if the request is approved, the consent is granted automatically. What should you configure?

Create a conditional access policy that requires an approval before access.

Use the admin consent workflow and configure the approvers to have the Application Administrator role.

Enable the admin consent workflow and configure the app as requiring admin consent.

Grant admin consent for the app upfront.

Microsoft Certified:Identity and Access Administrator Associate

Domain 3Objective 2

Plan, Implement, and Monitor the Integration of Enterprise Applications SC-300 Practice Questions (Page 2)

Part of the Plan and implement workload identities domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

20–25%of the exam

Questions 6–10

6foundation · easy
An administrator needs to grant an application access to Microsoft Graph for all users in the tenant. What type of consent is required?
Select an answer first
7foundation · easy
As an identity administrator, you need to configure a setting that applies to all enterprise applications in your Microsoft Entra tenant. Which setting should you configure?
Select an answer first
8expert · medium
Your organization has a policy that users can consent to low-impact permissions, but all high-impact permissions require admin approval. You have classified permissions accordingly. A user attempts to consent to an app that requests both User.Read (low impact) and Group.Read.All (high impact). What happens?
Select an answer first
9expert · medium
You are publishing an on-premises app via Application Proxy. The app is accessed by users both inside and outside the network. You need to ensure that users outside the network are prompted for MFA, but users inside the network are not. What is the most efficient way to achieve this?
Select an answer first
10expert · hard
A SaaS app is integrated with Microsoft Entra ID. The app requests permissions that are classified as high impact. You want to require that all consent requests for this app go through an approval process. You also want to ensure that if the request is approved, the consent is granted automatically. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.

Plan, Implement, and Monitor the Integration of Enterprise Applications SC-300 Practice Questions (Page 2)

Questions 6–10

An administrator needs to grant an application access to Microsoft Graph for all users in the tenant. What type of consent is required?

As an identity administrator, you need to configure a setting that applies to all enterprise applications in your Microsoft Entra tenant. Which setting should you configure?

You are publishing an on-premises app via Application Proxy. The app is accessed by users both inside and outside the network. You need to ensure that users outside the network are prompted for MFA, but users inside the network are not. What is the most efficient way to achieve this?

Keep studying — Plan and implement workload identities