Microsoft SC-300 Workload Identity Selection and Managed Identities Practice Test

 

Topic 09 covers workload identity selection and managed identities for the Microsoft Certified: Identity and Access Administrator Associate certification. These original practice questions apply the verified SC-300 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the SC-300 Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

The administrator must correct an Azure-hosted workload that must access another Azure resource without changing adjacent controls. The target condition is: a credential-free identity model supported by the Azure workload. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose token acquisition versus authorization failure.
2. Choose the workload identity model that minimizes stored credentials while remaining supported by the hosting environment.
3. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose missing assignment authority at identity scope.
4. Use a managed identity instead of storing an application secret on the supported Azure workload.
5. Plan identity reuse across resource replacement within workload identity and Azure RBAC, including scope, prerequisites, and rollback.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides the appropriate managed identity for supported Azure workload. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of token acquisition versus authorization failure. The scenario instead requires the appropriate managed identity for supported Azure workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is assessment of credential management under workload hosting constraints. The scenario instead requires the appropriate managed identity for supported Azure workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of missing assignment authority at identity scope. The scenario instead requires the appropriate managed identity for supported Azure workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a controlled plan for identity reuse across resource replacement. The scenario instead requires the appropriate managed identity for supported Azure workload, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 2

An audit of an application workload running outside Azure identifies this control gap: the appropriate service principal for external execution environment. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
2. Use a Microsoft Entra service principal/app registration for an external workload that cannot use an Azure managed identity.
3. Treat identity creation from permission assignment as separate control boundaries and verify each with token claims, identity assignments, Azure RBAC, and target-resource access evidence.
4. Treat Azure management-plane RBAC and service data-plane permissions as separate authorization layers.
5. Remove identity assignment without deleting shared identity only after token claims, identity assignments, Azure RBAC, and target-resource access evidence confirms the replacement or remaining access path.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides the appropriate service principal for external execution environment. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate system-assigned identity tied to resource lifetime. The scenario instead requires the appropriate service principal for external execution environment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is separation of identity creation from permission assignment. The scenario instead requires the appropriate service principal for external execution environment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between management-plane and data-plane permissions. The scenario instead requires the appropriate service principal for external execution environment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is removal of identity assignment without deleting shared identity. The scenario instead requires the appropriate service principal for external execution environment, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 3

The documented success criterion for an application workload that needs Microsoft Entra access is: evaluation of user-account suitability for unattended workload. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
2. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
3. Allow for role-assignment propagation and retest the workload identity before changing credentials.
4. Reconcile deployment configuration with intended identity using token claims, identity assignments, Azure RBAC, and target-resource access evidence and preserve the intended security boundary.
5. Do not use a human user account for unattended workload authentication; use a workload identity.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides evaluation of user-account suitability for unattended workload. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is enablement of system-assigned identity on supported resource. The scenario instead requires evaluation of user-account suitability for unattended workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate user-assigned identity shared across resources. The scenario instead requires evaluation of user-account suitability for unattended workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is resolution of role propagation timing under new assignment. The scenario instead requires evaluation of user-account suitability for unattended workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is reconciliation of deployment configuration with intended identity. The scenario instead requires evaluation of user-account suitability for unattended workload, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 4

The current configuration of an application workload that needs Microsoft Entra access is otherwise acceptable. The unresolved requirement is: the appropriate managed service account for domain service dependency. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Grant target-resource data access to workload identity at the narrowest supported scope and verify effective access.
2. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
3. Remove the legacy shared secret only after managed/federated identity access is verified end to end.
4. Treat creation/lifecycle of the workload identity and authorization to the target resource as separate configuration steps.
5. Choose managed service account for domain service dependency in workload identity and Azure RBAC and verify the resulting behavior.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate managed service account for domain service dependency. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is grant target-resource data access to workload identity. The scenario instead requires the appropriate managed service account for domain service dependency, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is creation of user-assigned identity before resource deployment. The scenario instead requires the appropriate managed service account for domain service dependency, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is removal of shared secret after validated identity-based access. The scenario instead requires the appropriate managed service account for domain service dependency, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between identity lifecycle and resource authorization. The scenario instead requires the appropriate managed service account for domain service dependency, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 5

A troubleshooting review of an application workload that needs Microsoft Entra access confirms that the next action must address: a clear distinction between identity lifecycle and resource authorization. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Request a token for the exact target resource audience that will validate the token.
2. Grant the administrator only the management-plane permission required to create or attach the workload identity, then retry the identity operation.
3. Treat creation/lifecycle of the workload identity and authorization to the target resource as separate configuration steps.
4. Use a managed identity instead of storing an application secret on the supported Azure workload.
5. Select among multiple attached identities explicitly in workload identity and Azure RBAC and verify the resulting behavior.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides a clear distinction between identity lifecycle and resource authorization. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate correct token audience for target service. The scenario instead requires a clear distinction between identity lifecycle and resource authorization, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of identity creation denied by management permissions. The scenario instead requires a clear distinction between identity lifecycle and resource authorization, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate managed identity for supported Azure workload. The scenario instead requires a clear distinction between identity lifecycle and resource authorization, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate among multiple attached identities explicitly. The scenario instead requires a clear distinction between identity lifecycle and resource authorization, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 6

A staged rollout of an application workload that needs Microsoft Entra access cannot proceed until the team can demonstrate: assessment of credential management under workload hosting constraints. The organization requires a supported Microsoft-managed control. Choose TWO actions that together implement and verify the requirement.

1. Choose the workload identity model that minimizes stored credentials while remaining supported by the hosting environment.
2. Use a Microsoft Entra service principal/app registration for an external workload that cannot use an Azure managed identity.
3. Plan identity reuse across resource replacement within workload identity and Azure RBAC, including scope, prerequisites, and rollback.
4. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose token acquisition versus authorization failure.
5. Acquire a token from the intended workload identity and verify the target resource authorizes the assigned role.
6. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose missing assignment authority at identity scope.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because This action directly provides assessment of credential management under workload hosting constraints at the correct Microsoft Entra control boundary.

Answer E is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is the appropriate service principal for external execution environment. It does not implement or verify assessment of credential management under workload hosting constraints in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for identity reuse across resource replacement. It does not implement or verify assessment of credential management under workload hosting constraints in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of token acquisition versus authorization failure. It does not implement or verify assessment of credential management under workload hosting constraints in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is diagnosis of missing assignment authority at identity scope. It does not implement or verify assessment of credential management under workload hosting constraints in this scenario.

 

Question 7

The team compares supported controls for an Azure VM whose identity should share the VM lifecycle. The deciding condition is: the appropriate system-assigned identity tied to resource lifetime. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Do not use a human user account for unattended workload authentication; use a workload identity.
2. Remove identity assignment without deleting shared identity only after token claims, identity assignments, Azure RBAC, and target-resource access evidence confirms the replacement or remaining access path.
3. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
4. Treat Azure management-plane RBAC and service data-plane permissions as separate authorization layers.
5. Treat identity creation from permission assignment as separate control boundaries and verify each with token claims, identity assignments, Azure RBAC, and target-resource access evidence.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides the appropriate system-assigned identity tied to resource lifetime. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is evaluation of user-account suitability for unattended workload. The scenario instead requires the appropriate system-assigned identity tied to resource lifetime, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is removal of identity assignment without deleting shared identity. The scenario instead requires the appropriate system-assigned identity tied to resource lifetime, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between management-plane and data-plane permissions. The scenario instead requires the appropriate system-assigned identity tied to resource lifetime, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is separation of identity creation from permission assignment. The scenario instead requires the appropriate system-assigned identity tied to resource lifetime, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 8

The identity architect is reviewing several Azure resources that must share one identity. The required outcome is: the appropriate user-assigned identity shared across resources. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Reconcile deployment configuration with intended identity using token claims, identity assignments, Azure RBAC, and target-resource access evidence and preserve the intended security boundary.
2. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
3. Allow for role-assignment propagation and retest the workload identity before changing credentials.
4. Choose managed service account for domain service dependency in workload identity and Azure RBAC and verify the resulting behavior.
5. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate user-assigned identity shared across resources. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is reconciliation of deployment configuration with intended identity. The scenario instead requires the appropriate user-assigned identity shared across resources, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is enablement of system-assigned identity on supported resource. The scenario instead requires the appropriate user-assigned identity shared across resources, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is resolution of role propagation timing under new assignment. The scenario instead requires the appropriate user-assigned identity shared across resources, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate managed service account for domain service dependency. The scenario instead requires the appropriate user-assigned identity shared across resources, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 9

The change owner has limited the remediation for several Azure resources that must share one identity to this outcome: creation of user-assigned identity before resource deployment. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Grant the administrator only the management-plane permission required to create or attach the workload identity, then retry the identity operation.
2. Remove the legacy shared secret only after managed/federated identity access is verified end to end.
3. Grant target-resource data access to workload identity at the narrowest supported scope and verify effective access.
4. Create the user-assigned managed identity independently so it can exist before any one workload and later be attached to multiple supported resources.
5. Treat creation/lifecycle of the workload identity and authorization to the target resource as separate configuration steps.

Correct Answer: D

 

Correct Answer

Answer D is correct because This option directly tests create user-assigned identity before resource deployment at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of identity creation denied by management permissions. The scenario instead requires creation of user-assigned identity before resource deployment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is removal of shared secret after validated identity-based access. The scenario instead requires creation of user-assigned identity before resource deployment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is grant target-resource data access to workload identity. The scenario instead requires creation of user-assigned identity before resource deployment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between identity lifecycle and resource authorization. The scenario instead requires creation of user-assigned identity before resource deployment, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 10

A change request for an application workload that needs Microsoft Entra access will be accepted only when the following is true: diagnosis of identity creation denied by management permissions. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Choose the workload identity model that minimizes stored credentials while remaining supported by the hosting environment.
2. Grant the administrator only the management-plane permission required to create or attach the workload identity, then retry the identity operation.
3. Use a managed identity instead of storing an application secret on the supported Azure workload.
4. Select among multiple attached identities explicitly in workload identity and Azure RBAC and verify the resulting behavior.
5. Request a token for the exact target resource audience that will validate the token.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides diagnosis of identity creation denied by management permissions. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is assessment of credential management under workload hosting constraints. The scenario instead requires diagnosis of identity creation denied by management permissions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate managed identity for supported Azure workload. The scenario instead requires diagnosis of identity creation denied by management permissions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate among multiple attached identities explicitly. The scenario instead requires diagnosis of identity creation denied by management permissions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate correct token audience for target service. The scenario instead requires diagnosis of identity creation denied by management permissions, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 11

The implementation of an application workload that needs Microsoft Entra access is complete except for this requirement: a controlled plan for identity reuse across resource replacement. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
2. Plan identity reuse across resource replacement within workload identity and Azure RBAC, including scope, prerequisites, and rollback.
3. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose token acquisition versus authorization failure.
4. Use a Microsoft Entra service principal/app registration for an external workload that cannot use an Azure managed identity.
5. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose missing assignment authority at identity scope.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides a controlled plan for identity reuse across resource replacement. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate system-assigned identity tied to resource lifetime. The scenario instead requires a controlled plan for identity reuse across resource replacement, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of token acquisition versus authorization failure. The scenario instead requires a controlled plan for identity reuse across resource replacement, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate service principal for external execution environment. The scenario instead requires a controlled plan for identity reuse across resource replacement, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of missing assignment authority at identity scope. The scenario instead requires a controlled plan for identity reuse across resource replacement, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 12

The support team has ruled out unrelated causes in an application workload that needs Microsoft Entra access. The remaining issue is: separation of identity creation from permission assignment. No new standing administrator privilege may be introduced. Choose TWO actions that together implement and verify the requirement.

1. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
2. Treat Azure management-plane RBAC and service data-plane permissions as separate authorization layers.
3. Treat identity creation from permission assignment as separate control boundaries and verify each with token claims, identity assignments, Azure RBAC, and target-resource access evidence.
4. Remove identity assignment without deleting shared identity only after token claims, identity assignments, Azure RBAC, and target-resource access evidence confirms the replacement or remaining access path.
5. Acquire a token from the intended workload identity and verify the target resource authorizes the assigned role.
6. Do not use a human user account for unattended workload authentication; use a workload identity.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because This action directly provides separation of identity creation from permission assignment at the correct Microsoft Entra control boundary.

Answer E is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate user-assigned identity shared across resources. It does not implement or verify separation of identity creation from permission assignment in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between management-plane and data-plane permissions. It does not implement or verify separation of identity creation from permission assignment in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is removal of identity assignment without deleting shared identity. It does not implement or verify separation of identity creation from permission assignment in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is evaluation of user-account suitability for unattended workload. It does not implement or verify separation of identity creation from permission assignment in this scenario.

 

Question 13

A readiness check of an Azure VM whose identity should share the VM lifecycle leaves one unresolved condition: enablement of system-assigned identity on supported resource. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Choose managed service account for domain service dependency in workload identity and Azure RBAC and verify the resulting behavior.
2. Enable the system-assigned managed identity on the supported Azure resource so the identity is created and removed with that resource.
3. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
4. Allow for role-assignment propagation and retest the workload identity before changing credentials.
5. Reconcile deployment configuration with intended identity using token claims, identity assignments, Azure RBAC, and target-resource access evidence and preserve the intended security boundary.

Correct Answer: B

 

Correct Answer

Answer B is correct because This option directly tests enable system-assigned identity on supported resource at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate managed service account for domain service dependency. The scenario instead requires enablement of system-assigned identity on supported resource, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is creation of user-assigned identity before resource deployment. The scenario instead requires enablement of system-assigned identity on supported resource, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is resolution of role propagation timing under new assignment. The scenario instead requires enablement of system-assigned identity on supported resource, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is reconciliation of deployment configuration with intended identity. The scenario instead requires enablement of system-assigned identity on supported resource, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 14

Testing of several Azure resources that must share one identity is successful except for this condition: attach existing user-assigned identity to workload. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Treat creation/lifecycle of the workload identity and authorization to the target resource as separate configuration steps.
2. Grant target-resource data access to workload identity at the narrowest supported scope and verify effective access.
3. Grant the administrator only the management-plane permission required to create or attach the workload identity, then retry the identity operation.
4. Attach the existing user-assigned managed identity to the workload, then grant that identity only the target-resource permissions it requires.
5. Remove the legacy shared secret only after managed/federated identity access is verified end to end.

Correct Answer: D

 

Correct Answer

Answer D is correct because This option directly tests attach existing user-assigned identity to workload at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between identity lifecycle and resource authorization. The scenario instead requires attach existing user-assigned identity to workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is grant target-resource data access to workload identity. The scenario instead requires attach existing user-assigned identity to workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of identity creation denied by management permissions. The scenario instead requires attach existing user-assigned identity to workload, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is removal of shared secret after validated identity-based access. The scenario instead requires attach existing user-assigned identity to workload, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 15

The organization wants the least-disruptive correction to an application workload that needs Microsoft Entra access. It must provide: the appropriate among multiple attached identities explicitly. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Select among multiple attached identities explicitly in workload identity and Azure RBAC and verify the resulting behavior.
2. Plan identity reuse across resource replacement within workload identity and Azure RBAC, including scope, prerequisites, and rollback.
3. Request a token for the exact target resource audience that will validate the token.
4. Use a managed identity instead of storing an application secret on the supported Azure workload.
5. Choose the workload identity model that minimizes stored credentials while remaining supported by the hosting environment.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides the appropriate among multiple attached identities explicitly. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is a controlled plan for identity reuse across resource replacement. The scenario instead requires the appropriate among multiple attached identities explicitly, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate correct token audience for target service. The scenario instead requires the appropriate among multiple attached identities explicitly, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate managed identity for supported Azure workload. The scenario instead requires the appropriate among multiple attached identities explicitly, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is assessment of credential management under workload hosting constraints. The scenario instead requires the appropriate among multiple attached identities explicitly, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 16

A design review of an application workload that needs Microsoft Entra access identifies one remaining requirement: diagnosis of missing assignment authority at identity scope. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
2. Use a Microsoft Entra service principal/app registration for an external workload that cannot use an Azure managed identity.
3. Treat identity creation from permission assignment as separate control boundaries and verify each with token claims, identity assignments, Azure RBAC, and target-resource access evidence.
4. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose missing assignment authority at identity scope.
5. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose token acquisition versus authorization failure.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides diagnosis of missing assignment authority at identity scope. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate system-assigned identity tied to resource lifetime. The scenario instead requires diagnosis of missing assignment authority at identity scope, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate service principal for external execution environment. The scenario instead requires diagnosis of missing assignment authority at identity scope, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is separation of identity creation from permission assignment. The scenario instead requires diagnosis of missing assignment authority at identity scope, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of token acquisition versus authorization failure. The scenario instead requires diagnosis of missing assignment authority at identity scope, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 17

Current evidence from an application workload that needs Microsoft Entra access shows that this requirement is not yet met: removal of identity assignment without deleting shared identity. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Treat Azure management-plane RBAC and service data-plane permissions as separate authorization layers.
2. Remove identity assignment without deleting shared identity only after token claims, identity assignments, Azure RBAC, and target-resource access evidence confirms the replacement or remaining access path.
3. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
4. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
5. Do not use a human user account for unattended workload authentication; use a workload identity.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides removal of identity assignment without deleting shared identity. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between management-plane and data-plane permissions. The scenario instead requires removal of identity assignment without deleting shared identity, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate user-assigned identity shared across resources. The scenario instead requires removal of identity assignment without deleting shared identity, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is enablement of system-assigned identity on supported resource. The scenario instead requires removal of identity assignment without deleting shared identity, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is evaluation of user-account suitability for unattended workload. The scenario instead requires removal of identity assignment without deleting shared identity, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 18

Before expanding an application workload that needs Microsoft Entra access, the administrator must satisfy this condition: reconciliation of deployment configuration with intended identity. Existing working access outside the stated scope must remain unchanged. Choose TWO actions that together implement and verify the requirement.

1. Choose managed service account for domain service dependency in workload identity and Azure RBAC and verify the resulting behavior.
2. Acquire a token from the intended workload identity and verify the target resource authorizes the assigned role.
3. Grant target-resource data access to workload identity at the narrowest supported scope and verify effective access.
4. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
5. Allow for role-assignment propagation and retest the workload identity before changing credentials.
6. Reconcile deployment configuration with intended identity using token claims, identity assignments, Azure RBAC, and target-resource access evidence and preserve the intended security boundary.

Correct Answers: B, F

 

Correct Answers

Answer B is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Answer F is correct because This action directly provides reconciliation of deployment configuration with intended identity at the correct Microsoft Entra control boundary.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate managed service account for domain service dependency. It does not implement or verify reconciliation of deployment configuration with intended identity in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is grant target-resource data access to workload identity. It does not implement or verify reconciliation of deployment configuration with intended identity in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is creation of user-assigned identity before resource deployment. It does not implement or verify reconciliation of deployment configuration with intended identity in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is resolution of role propagation timing under new assignment. It does not implement or verify reconciliation of deployment configuration with intended identity in this scenario.

 

Question 19

The administrator is preparing an application workload that needs Microsoft Entra access for production. The required condition is: grant target-resource data access to workload identity. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Remove the legacy shared secret only after managed/federated identity access is verified end to end.
2. Treat creation/lifecycle of the workload identity and authorization to the target resource as separate configuration steps.
3. Grant the administrator only the management-plane permission required to create or attach the workload identity, then retry the identity operation.
4. Grant target-resource data access to workload identity at the narrowest supported scope and verify effective access.
5. Select among multiple attached identities explicitly in workload identity and Azure RBAC and verify the resulting behavior.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides grant target-resource data access to workload identity. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is removal of shared secret after validated identity-based access. The scenario instead requires grant target-resource data access to workload identity, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between identity lifecycle and resource authorization. The scenario instead requires grant target-resource data access to workload identity, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of identity creation denied by management permissions. The scenario instead requires grant target-resource data access to workload identity, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate among multiple attached identities explicitly. The scenario instead requires grant target-resource data access to workload identity, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 20

A production issue involving a workload receiving a token rejected by the target API has been narrowed to this requirement: the appropriate correct token audience for target service. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose missing assignment authority at identity scope.
2. Request a token for the exact target resource audience that will validate the token.
3. Choose the workload identity model that minimizes stored credentials while remaining supported by the hosting environment.
4. Plan identity reuse across resource replacement within workload identity and Azure RBAC, including scope, prerequisites, and rollback.
5. Use a managed identity instead of storing an application secret on the supported Azure workload.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides the appropriate correct token audience for target service. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of missing assignment authority at identity scope. The scenario instead requires the appropriate correct token audience for target service, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is assessment of credential management under workload hosting constraints. The scenario instead requires the appropriate correct token audience for target service, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a controlled plan for identity reuse across resource replacement. The scenario instead requires the appropriate correct token audience for target service, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate managed identity for supported Azure workload. The scenario instead requires the appropriate correct token audience for target service, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 21

The security review of an application workload that needs Microsoft Entra access focuses on one acceptance criterion: diagnosis of token acquisition versus authorization failure. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Use token claims, identity assignments, Azure RBAC, and target-resource access evidence to diagnose token acquisition versus authorization failure.
2. Treat identity creation from permission assignment as separate control boundaries and verify each with token claims, identity assignments, Azure RBAC, and target-resource access evidence.
3. Use a Microsoft Entra service principal/app registration for an external workload that cannot use an Azure managed identity.
4. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
5. Remove identity assignment without deleting shared identity only after token claims, identity assignments, Azure RBAC, and target-resource access evidence confirms the replacement or remaining access path.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides diagnosis of token acquisition versus authorization failure. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is separation of identity creation from permission assignment. The scenario instead requires diagnosis of token acquisition versus authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate service principal for external execution environment. The scenario instead requires diagnosis of token acquisition versus authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate system-assigned identity tied to resource lifetime. The scenario instead requires diagnosis of token acquisition versus authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is removal of identity assignment without deleting shared identity. The scenario instead requires diagnosis of token acquisition versus authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 22

The team is validating a workload that has Azure management access but cannot read service data. The decisive requirement is: a clear distinction between management-plane and data-plane permissions. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Do not use a human user account for unattended workload authentication; use a workload identity.
2. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.
3. Use a system-assigned managed identity when the identity should share the lifecycle of one Azure resource.
4. Treat Azure management-plane RBAC and service data-plane permissions as separate authorization layers.
5. Reconcile deployment configuration with intended identity using token claims, identity assignments, Azure RBAC, and target-resource access evidence and preserve the intended security boundary.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides a clear distinction between management-plane and data-plane permissions. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is evaluation of user-account suitability for unattended workload. The scenario instead requires a clear distinction between management-plane and data-plane permissions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate user-assigned identity shared across resources. The scenario instead requires a clear distinction between management-plane and data-plane permissions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is enablement of system-assigned identity on supported resource. The scenario instead requires a clear distinction between management-plane and data-plane permissions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is reconciliation of deployment configuration with intended identity. The scenario instead requires a clear distinction between management-plane and data-plane permissions, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 23

Operations staff investigating an application workload that needs Microsoft Entra access have isolated the issue to: resolution of role propagation timing under new assignment. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Choose managed service account for domain service dependency in workload identity and Azure RBAC and verify the resulting behavior.
2. Grant target-resource data access to workload identity at the narrowest supported scope and verify effective access.
3. Remove the legacy shared secret only after managed/federated identity access is verified end to end.
4. Allow for role-assignment propagation and retest the workload identity before changing credentials.
5. Use a user-assigned managed identity when the same identity must be attached to multiple resources or survive one resource lifecycle.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides resolution of role propagation timing under new assignment. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate managed service account for domain service dependency. The scenario instead requires resolution of role propagation timing under new assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is grant target-resource data access to workload identity. The scenario instead requires resolution of role propagation timing under new assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is removal of shared secret after validated identity-based access. The scenario instead requires resolution of role propagation timing under new assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is creation of user-assigned identity before resource deployment. The scenario instead requires resolution of role propagation timing under new assignment, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 24

The administrator must correct an application workload that needs Microsoft Entra access without changing adjacent controls. The target condition is: removal of shared secret after validated identity-based access. Resource permissions outside the identity control are already correct. Choose TWO actions that together implement and verify the requirement.

1. Treat creation/lifecycle of the workload identity and authorization to the target resource as separate configuration steps.
2. Select among multiple attached identities explicitly in workload identity and Azure RBAC and verify the resulting behavior.
3. Grant the administrator only the management-plane permission required to create or attach the workload identity, then retry the identity operation.
4. Acquire a token from the intended workload identity and verify the target resource authorizes the assigned role.
5. Request a token for the exact target resource audience that will validate the token.
6. Remove the legacy shared secret only after managed/federated identity access is verified end to end.

Correct Answers: D, F

 

Correct Answers

Answer D is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Answer F is correct because This action directly provides removal of shared secret after validated identity-based access at the correct Microsoft Entra control boundary.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between identity lifecycle and resource authorization. It does not implement or verify removal of shared secret after validated identity-based access in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate among multiple attached identities explicitly. It does not implement or verify removal of shared secret after validated identity-based access in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of identity creation denied by management permissions. It does not implement or verify removal of shared secret after validated identity-based access in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate correct token audience for target service. It does not implement or verify removal of shared secret after validated identity-based access in this scenario.