The hard set (4 questions)
The hardest SC-300 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.
You are designing a VerifiedEmployee credential and want to be able to revoke a departed employee's credential later. At issuance time, what must you configure so the credential can be found and revoked afterward, and what is the key limitation?
Correct answer: D. Index exactly one claim in the rules definition; only that claim can be searched, and only credentials issued after the index existed are revocable
Verified ID implements W3C StatusList2021 for revocation. Because Microsoft does not store credential data, the issuer must index exactly one claim (which is salted and hashed) to make credentials searchable. Only one claim can be indexed, and any credentials issued before an index existed cannot be searched or revoked.
Why the other options are wrong:
- A. allowRevoked is a verifier-side presentation setting that decides whether to accept an already-revoked credential; it does not enable the issuer to revoke.
- B. Only ONE claim can be indexed per credential, not all of them.
- C. Verified ID does not store credential data; Key Vault holds the signing keys, not credential attribute values.
Memory hook: To revoke, index ONE claim up front - hashed and searchable, one only.
Microsoft Learn: Issuer revoke
In PIM you create an access review of the Security Administrator Microsoft Entra role. You want reviewers to attest only to users who can elevate into the role via just-in-time access, and you want to exclude anyone who holds the role as a standing (permanent/active) assignment. Which setting achieves this?
Correct answer: C. Assignment type = Eligible assignments only.
When creating a PIM role access review, the Assignment type scope lets you review 'eligible assignments only' (principals who can activate the role, regardless of current activation status), 'active assignments only', or 'all active and eligible assignments'. Choosing eligible assignments only reviews the just-in-time-capable users and excludes standing active assignments.
Why the other options are wrong:
- A. 'All active and eligible' includes the active standing assignments you want to exclude.
- B. The inactive-users scope filters by sign-in inactivity, not by eligible-versus-active assignment type.
- D. 'Active assignments only' reviews standing/activated holders, the opposite of what is wanted.
Memory hook: Eligible = can elevate; Active = standing power.
Microsoft Learn: PIM create roles and resource roles review
An Identity Governance Administrator creates an access package in a catalog for an application. An internal user requests access. The policy is configured with Manager as the first approver and a fallback approver, with a 14-day request window. On day 7, neither the manager nor the fallback approver has responded. What happens to the request if alternate approvers are NOT configured?
Correct answer: B. The request is automatically denied because it was not approved within the 14-day window at expiry.
In Microsoft Entra Entitlement Management, if no approver approves or denies a request within the configured approval period, the request automatically expires and is denied. The user must submit a new request. Alternate approvers can be configured to receive the request after a specified number of days if the primary approvers have not acted, but forwarding to alternate approvers can only begin after the request reaches its half-life (day 7 in a 14-day window) and requires at least a 4-day timeout. Without alternate approvers configured, the request simply expires at day 14 without approval.
Why the other options are wrong:
- A. There is no automatic escalation to the Identity Governance Administrator when approvers are unresponsive. The request expires unless alternate approvers are configured.
- C. Forwarding to a second-level manager is an option only when alternate approvers are configured and the 'Second level manager as alternate approver' option is selected. Without alternate approver configuration, no forwarding occurs.
- D. Entitlement Management does not auto-approve requests when no response is received. Approval requires an explicit approval action from a designated approver.
Memory hook: No approver response = request EXPIRES at the deadline. Auto-deny. Not auto-approve, not escalate - it just runs out of time.
Microsoft Learn: Entitlement management access package create
You enable 'Require approval to activate' on the Global Administrator role in PIM but do not specify any approvers. All Global Administrators and Privileged Role Administrators currently hold eligible (not active) assignments. What is the risk?
Correct answer: C. Because no approvers are specified, active Privileged Role Administrators/Global Administrators become the default approvers - but since all of them are only eligible (none active), no one can approve and the tenant can be locked out; configure specific approvers and emergency access accounts.
When approval is required but no approvers are configured, the default approvers are the active Privileged Role Administrators/Global Administrators. If all of them are only eligible and none are active, there is no one to approve activations, which can lock you out of the tenant. Microsoft recommends configuring specific approvers and maintaining emergency access (break-glass) accounts.
Why the other options are wrong:
- A. Requiring approval does not auto-approve on justification; a human approver (or default approver) must act.
- B. PIM lets you enable approval without explicit approvers, which is exactly what creates the lockout risk.
- D. PIM does not auto-activate eligible admins to approve; eligibility alone cannot approve when all are inactive.
Memory hook: Approval + no approvers + all-eligible admins = lockout; keep break-glass accounts.
Microsoft Learn: PIM change default settings
