Plan and Automate Identity Governance

Plan and implement entitlement management, access reviews, privileged access with PIM, and identity monitoring using logs, workbooks, and reports.

5 minutes 5 Questions

Plan and Automate Identity Governance is a critical component of the Microsoft Identity and Access Administrator (SC-300) exam that focuses on managing the identity lifecycle, access decisions, and compliance within an organization using Microsoft Entra ID (formerly Azure AD) tools. **Key Componen…

Concepts covered
Catalogs and Access PackagesEntitlement Management PlanningExternal User Lifecycle and Connected OrganizationsAccess Review Monitoring and ResponsePIM for Azure ResourcesPIM Audit History and ReportsSign-In, Audit, and Provisioning Log AnalysisKQL Queries and Workbook AnalysisAccess Requests and Terms of UseAccess Reviews Planning and ConfigurationPIM for Microsoft Entra RolesPIM Groups and Approval ProcessesBreak-Glass Accounts ManagementDiagnostic Settings and Log Analytics ConfigurationIdentity Secure Score Monitoring
Test mode:
Start practice test

SC-300 - Plan and Automate Identity Governance Example Questions

Test your knowledge of Plan and Automate Identity Governance

Question 1

In KQL, what does the 'where' operator do?

Correct Answer: Filters rows based on a specified condition or predicate

The 'where' operator in KQL (Kusto Query Language) filters a table to only include rows that satisfy a specified Boolean condition or predicate, similar to the WHERE clause in SQL.

Grouping rows based on columns and aggregation describes the 'summarize' operator. Sorting rows in ascending or descending order describes the 'sort by' or 'order by' operator. Projecting and renaming columns describes the 'project' or 'project-rename' operator.

The key concept tested is understanding the fundamental KQL operators used in Microsoft Sentinel, Log Analytics, and other Azure monitoring tools for querying and filtering log data.

Question 2

A new IT administrator at a company needs to check whether a specific user successfully signed in to Microsoft Entra ID yesterday. Where in the Microsoft Entra admin center should the administrator look first?

Correct Answer: Navigate to the Sign-in logs under the Monitoring section of Microsoft Entra ID

The Sign-in logs under the Monitoring section of Microsoft Entra ID record all authentication events, including successful and failed sign-in attempts, making it the correct place to verify whether a specific user successfully signed in yesterday.

Audit logs track directory changes such as user creation, role assignments, and policy modifications, not authentication events. Usage and insights reports provide aggregated views of application usage and authentication method trends, not individual sign-in details. Provisioning logs track automated user account provisioning and deprovisioning activities to and from external applications.

The key concept tested is understanding the purpose of different Microsoft Entra ID log types under the Monitoring section.

Question 3

An organization uses Azure AD Entitlement Management. A user named Alex is assigned the Catalog Owner role for a catalog called 'Sales Resources.' Alex tries to add an Azure AD security group to a different catalog called 'Engineering Resources' but receives an error. Alex is not assigned any role in the Engineering Resources catalog. What should be done so Alex can add the security group to the Engineering Resources catalog?

Correct Answer: Assign Alex a Catalog Owner or Catalog Reader role in the Engineering Resources catalog, then have a Catalog Owner add the resource

In Azure AD Entitlement Management, catalog roles are scoped per catalog, so Alex must be assigned a role such as Catalog Owner in the Engineering Resources catalog to add resources to it; a Catalog Reader role would at minimum allow visibility, but a Catalog Owner in that catalog could then add the resource on Alex's behalf.

Assigning Global Administrator is excessive and violates least privilege. Resources cannot be transferred between catalogs, so moving the group from one catalog to another is not a valid operation. Security groups do not need to be re-created; they are existing Azure AD objects added as resources to catalogs.

The key concept tested is the per-catalog scope of Entitlement Management roles.

More Plan and Automate Identity Governance questions
627 questions (total)
Practice 100 questions
One session at a time, always new questions