Microsoft Certified: Identity and Access Administrator Associate SC-300 Syllabus Exam Questions Answers

Answer is

This question asks you to apply the stated Technical Requirements for Self-Service Password Reset (SSPR) to complete the form. The specific scenario about " User3 " is a distraction, as the configuration applies to all users.

The relevant technical requirements are:

" Users must provide one authentication method to reset their password by using SSPR. "

This directly dictates the value for the Number of authentication methods required , which is 1 .

" Available methods must include: Email, Phone, Security questions, The Microsoft Authenticator app "

This lists all the options that are configured to be available for SSPR, which determines the value for Authentication methods that can be used : Email , Phone , Security   questions , The   Microsoft   Authenticator   app .

The requirement is:

“Require admin approval for application access to organizational data.”

According to the Microsoft SC-300 exam guide and Microsoft documentation on “Configure consent settings for applications”, Azure AD provides User consent settings under Enterprise applications → Consent and permissions to control how applications can request permissions to access organizational data.

By default, users can consent to allow apps to access organizational data on their behalf, which can create security risks. To ensure tighter control, administrators can:

Disable user consent entirely, or

Require admin consent workflow so that when users try to grant an app access, it must first be approved by an administrator.

The SC-300 study materials explicitly describe:

“To require administrator approval before an app can access organizational data, configure the User consent settings to use the admin consent workflow.”

This aligns perfectly with the stated requirement — to ensure admin approval is required before apps gain access to organizational data.

Other options are incorrect:

Authentication methods manage MFA and SSPR, not app consent.

Access packages are part of Identity Governance for resource access, not app consent.

Application Proxy publishes on-premises apps, not related to app consent permissions.

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module “Implement and manage synchronization for Azure AD” , Azure AD Connect Cloud Sync is the preferred solution when you need to synchronize objects from multiple Active Directory (AD DS) forests without establishing forest trusts .

The scenario specifies that trust relationships must NOT be established between adatum.com and litware.com , but A. Datum must still sync the AD DS users and groups of litware.com to their existing Azure AD tenant (adatum.com).

The SC-300 training materials clarify:

“Azure AD Connect cloud sync enables syncing from multiple AD forests to a single Azure AD tenant without the need for forest trusts or a full Azure AD Connect installation in each forest.”

Unlike staging mode (which provides a standby sync server for failover) or extending the same Azure AD Connect instance to another domain (which requires trust relationships and network connectivity between forests), Azure AD Connect Cloud Sync uses lightweight agents and does not depend on forest trust.

Therefore, to meet the requirement of syncing Litware’s AD DS to A. Datum’s Azure AD tenant without creating a trust , the correct choice is to configure Azure AD Connect Cloud Sync between the Azure AD tenant and the litware.com domain.

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module “Publish on-premises apps for remote access using Azure AD Application Proxy”, Azure AD Application Proxy enables secure remote access to internal, on-premises web applications without requiring VPN access.

In the scenario, App1 is an on-premises application hosted within the Litware network, and the technical requirements specify that it must be securely accessible to both internal and external users — including Fabrikam guest accounts — through Azure AD authentication.

Microsoft’s official documentation states:

“Azure AD Application Proxy provides secure remote access to on-premises web applications, integrating with Azure AD for single sign-on (SSO) and conditional access policies.”

Given that the environment already includes a server (SERVER1) running the Azure AD Application Proxy connector, and that Litware wants to enforce Azure AD Conditional Access and MFA for App1, Azure AD Application Proxy is the correct implementation.

The other options are not suitable:

A. Policy set in Microsoft Endpoint Manager: Used for device compliance and app management, not for publishing on-premises apps.

B. App configuration policy in Endpoint Manager: Used for mobile app configuration (e.g., MAM policies), not for access publishing.

C. App registration in Azure AD: Used for modern cloud or SaaS apps integration, but App1 is on-premises and needs proxy access.

Correct Answer: D. Azure AD Application Proxy