Microsoft SC-300 App Registrations Authentication and API Authorization Practice Test

 

Topic 11 covers app registrations, authentication, and api authorization for the Microsoft Certified: Identity and Access Administrator Associate certification. These original practice questions apply the verified SC-300 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the SC-300 Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

The current configuration of an application deciding which tenants may sign in is otherwise acceptable. The unresolved requirement is: the correct tenant audience for the app registration. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Choose the app registration supported account type that matches whether only the home tenant or multiple tenants must sign in.
2. Inspect the issued token and correct the API permission, consent, or assignment that should produce the required scope or role claim.
3. Use the application/client ID for protocol configuration and the object ID when addressing the specific directory object.
4. Use app-registration settings, token claims, consent grants, and the target API response to distinguish authentication failure from api authorization failure.
5. Prefer a certificate or federated credential over a long-lived client secret when the client can support it.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides the appropriate single-tenant versus multitenant registration. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of scope or role absent from issued token. The scenario instead requires the appropriate single-tenant versus multitenant registration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between application ID and object ID. The scenario instead requires the appropriate single-tenant versus multitenant registration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between authentication failure and API authorization failure. The scenario instead requires the appropriate single-tenant versus multitenant registration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate certificate versus secret for confidential authentication. The scenario instead requires the appropriate single-tenant versus multitenant registration, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 2

A troubleshooting review of an application registration and API integration confirms that the next action must address: separation of development and production registration boundaries. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Configure ownership without granting tenant-wide administration in app registration and API authorization and verify the effective result.
2. Overlap old and new application credentials long enough to validate the new credential before retiring the old one.
3. Treat configured API permissions and the tenant consent grant as separate prerequisites.
4. Use separate app registrations/credentials for development and production security boundaries.
5. Use delegated API permissions when the application calls the API in the signed-in user context.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides separation of development and production registration boundaries. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of ownership without granting tenant-wide administration. The scenario instead requires separation of development and production registration boundaries, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a controlled plan for credential rotation with overlap and expiry. The scenario instead requires separation of development and production registration boundaries, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between permission configuration and consent grant. The scenario instead requires separation of development and production registration boundaries, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate delegated permissions for user-context API call. The scenario instead requires separation of development and production registration boundaries, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 3

A staged rollout of an application registration and API integration cannot proceed until the team can demonstrate: the appropriate supported account types for user population. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Configure a federated identity credential for the trusted external workload issuer/subject instead of storing a secret.
2. Reconcile api audience with requested permission using app-registration settings, token claims, consent grants, and the target API response and preserve the intended security boundary.
3. Configure the supported account types to match the intended tenant/user population.
4. Check whether the service principal/enterprise application exists in the tenant and create or consent to it through a supported flow if required.
5. Use application permissions for unattended app-only access and grant the required admin consent.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides the appropriate supported account types for user population. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of federated credential for external workload trust. The scenario instead requires the appropriate supported account types for user population, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is reconciliation of API audience with requested permission. The scenario instead requires the appropriate supported account types for user population, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of missing enterprise object after registration scenario. The scenario instead requires the appropriate supported account types for user population, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate application permissions for unattended API access. The scenario instead requires the appropriate supported account types for user population, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 4

The team compares supported controls for an application registration and API integration. The deciding condition is: a controlled plan for app ownership and credential stewardship. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Choose the app registration supported account type that matches whether only the home tenant or multiple tenants must sign in.
2. Treat app-only token authorization from user delegation as separate control boundaries and verify each with app-registration settings, token claims, consent grants, and the target API response.
3. Assign accountable application owners without granting unrelated tenant-wide application administration.
4. Select the narrowest Microsoft Graph/API permission that supports the required operation.
5. Register the exact redirect URI for the client platform and protocol flow.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides a controlled plan for app ownership and credential stewardship. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate single-tenant versus multitenant registration. The scenario instead requires a controlled plan for app ownership and credential stewardship, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is separation of app-only token authorization from user delegation. The scenario instead requires a controlled plan for app ownership and credential stewardship, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate least-privilege permission matching requested operation. The scenario instead requires a controlled plan for app ownership and credential stewardship, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is register correct redirect URI for client platform. The scenario instead requires a controlled plan for app ownership and credential stewardship, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 5

The identity architect is reviewing an application deciding which tenants may sign in. The required outcome is: creation of registration in correct home tenant. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Create the app registration in the tenant that should own the application object.
2. Expose an OAuth delegated scope on the resource API for client applications that act for a user.
3. Select an OAuth/OIDC interactive flow supported by the client type instead of using a flow that assumes a confidential client or daemon.
4. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
5. Classify the client as public or confidential based on whether it can securely hold credentials.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides creation of registration in correct home tenant. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is expose scope for consuming client application. The scenario instead requires creation of registration in correct home tenant, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate supported interactive flow for client capabilities. The scenario instead requires creation of registration in correct home tenant, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is definition of app role with correct allowed member types. The scenario instead requires creation of registration in correct home tenant, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate public versus confidential client behavior. The scenario instead requires creation of registration in correct home tenant, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 6

The change owner has limited the remediation for an application registration and API integration to this outcome: a clear distinction between application ID and object ID. The tenant has the licensing required for the named capability. Choose TWO actions that together implement and verify the requirement.

1. Choose role value consumed by application code in app registration and API authorization and verify the resulting behavior.
2. Use the application/client ID for protocol configuration and the object ID when addressing the specific directory object.
3. Inspect the issued token claims and API response to confirm the registration, consent, and permission configuration behaves as intended.
4. Use app-registration settings, token claims, consent grants, and the target API response to distinguish authentication failure from api authorization failure.
5. Inspect the issued token and correct the API permission, consent, or assignment that should produce the required scope or role claim.
6. Prefer a certificate or federated credential over a long-lived client secret when the client can support it.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because This action directly provides a clear distinction between application ID and object ID at the correct Microsoft Entra control boundary.

Answer C is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate role value consumed by application code. It does not implement or verify a clear distinction between application ID and object ID in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between authentication failure and API authorization failure. It does not implement or verify a clear distinction between application ID and object ID in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of scope or role absent from issued token. It does not implement or verify a clear distinction between application ID and object ID in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is the appropriate certificate versus secret for confidential authentication. It does not implement or verify a clear distinction between application ID and object ID in this scenario.

 

Question 7

A change request for an application deciding which tenants may sign in will be accepted only when the following is true: correct configuration of ownership without granting tenant-wide administration. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
2. Treat configured API permissions and the tenant consent grant as separate prerequisites.
3. Overlap old and new application credentials long enough to validate the new credential before retiring the old one.
4. Configure ownership without granting tenant-wide administration in app registration and API authorization and verify the effective result.
5. Use delegated API permissions when the application calls the API in the signed-in user context.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides correct configuration of ownership without granting tenant-wide administration. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between app role and delegated OAuth scope. The scenario instead requires correct configuration of ownership without granting tenant-wide administration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between permission configuration and consent grant. The scenario instead requires correct configuration of ownership without granting tenant-wide administration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for credential rotation with overlap and expiry. The scenario instead requires correct configuration of ownership without granting tenant-wide administration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate delegated permissions for user-context API call. The scenario instead requires correct configuration of ownership without granting tenant-wide administration, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 8

The implementation of an application registration and API integration is complete except for this requirement: diagnosis of missing enterprise object after registration scenario. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Reconcile api audience with requested permission using app-registration settings, token claims, consent grants, and the target API response and preserve the intended security boundary.
2. Check whether the service principal/enterprise application exists in the tenant and create or consent to it through a supported flow if required.
3. Use application permissions for unattended app-only access and grant the required admin consent.
4. Use app-registration settings, token claims, consent grants, and the target API response to diagnose missing roles claim after assignment.
5. Configure a federated identity credential for the trusted external workload issuer/subject instead of storing a secret.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides diagnosis of missing enterprise object after registration scenario. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is reconciliation of API audience with requested permission. The scenario instead requires diagnosis of missing enterprise object after registration scenario, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate application permissions for unattended API access. The scenario instead requires diagnosis of missing enterprise object after registration scenario, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of missing roles claim after assignment. The scenario instead requires diagnosis of missing enterprise object after registration scenario, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correct configuration of federated credential for external workload trust. The scenario instead requires diagnosis of missing enterprise object after registration scenario, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 9

The support team has ruled out unrelated causes in a web or native client returning from Microsoft Entra sign-in. The remaining issue is: register correct redirect URI for client platform. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Select the narrowest Microsoft Graph/API permission that supports the required operation.
2. Register the exact redirect URI for the client platform and protocol flow.
3. Treat app-only token authorization from user delegation as separate control boundaries and verify each with app-registration settings, token claims, consent grants, and the target API response.
4. Use the application/client ID for protocol configuration and the object ID when addressing the specific directory object.
5. Choose the app registration supported account type that matches whether only the home tenant or multiple tenants must sign in.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides register correct redirect URI for client platform. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate least-privilege permission matching requested operation. The scenario instead requires register correct redirect URI for client platform, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is separation of app-only token authorization from user delegation. The scenario instead requires register correct redirect URI for client platform, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between application ID and object ID. The scenario instead requires register correct redirect URI for client platform, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate single-tenant versus multitenant registration. The scenario instead requires register correct redirect URI for client platform, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 10

A readiness check of an application registration and API integration leaves one unresolved condition: the appropriate public versus confidential client behavior. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Select an OAuth/OIDC interactive flow supported by the client type instead of using a flow that assumes a confidential client or daemon.
2. Use separate app registrations/credentials for development and production security boundaries.
3. Classify the client as public or confidential based on whether it can securely hold credentials.
4. Expose an OAuth delegated scope on the resource API for client applications that act for a user.
5. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides the appropriate public versus confidential client behavior. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate supported interactive flow for client capabilities. The scenario instead requires the appropriate public versus confidential client behavior, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is separation of development and production registration boundaries. The scenario instead requires the appropriate public versus confidential client behavior, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is expose scope for consuming client application. The scenario instead requires the appropriate public versus confidential client behavior, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is definition of app role with correct allowed member types. The scenario instead requires the appropriate public versus confidential client behavior, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 11

Testing of a confidential application replacing a long-lived secret is successful except for this condition: the appropriate certificate versus secret for confidential authentication. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Use app-registration settings, token claims, consent grants, and the target API response to distinguish authentication failure from api authorization failure.
2. Choose role value consumed by application code in app registration and API authorization and verify the resulting behavior.
3. Prefer a certificate or federated credential over a long-lived client secret when the client can support it.
4. Inspect the issued token and correct the API permission, consent, or assignment that should produce the required scope or role claim.
5. Configure the supported account types to match the intended tenant/user population.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides the appropriate certificate versus secret for confidential authentication. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between authentication failure and API authorization failure. The scenario instead requires the appropriate certificate versus secret for confidential authentication, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate role value consumed by application code. The scenario instead requires the appropriate certificate versus secret for confidential authentication, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of scope or role absent from issued token. The scenario instead requires the appropriate certificate versus secret for confidential authentication, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate supported account types for user population. The scenario instead requires the appropriate certificate versus secret for confidential authentication, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 12

The organization wants the least-disruptive correction to an application registration and API integration. It must provide: a controlled plan for credential rotation with overlap and expiry. The organization requires a supported Microsoft-managed control. Choose TWO actions that together implement and verify the requirement.

1. Treat configured API permissions and the tenant consent grant as separate prerequisites.
2. Overlap old and new application credentials long enough to validate the new credential before retiring the old one.
3. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
4. Use delegated API permissions when the application calls the API in the signed-in user context.
5. Assign accountable application owners without granting unrelated tenant-wide application administration.
6. Inspect the issued token claims and API response to confirm the registration, consent, and permission configuration behaves as intended.

Correct Answers: B, F

 

Correct Answers

Answer B is correct because This action directly provides a controlled plan for credential rotation with overlap and expiry at the correct Microsoft Entra control boundary.

Answer F is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between permission configuration and consent grant. It does not implement or verify a controlled plan for credential rotation with overlap and expiry in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between app role and delegated OAuth scope. It does not implement or verify a controlled plan for credential rotation with overlap and expiry in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate delegated permissions for user-context API call. It does not implement or verify a controlled plan for credential rotation with overlap and expiry in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is a controlled plan for app ownership and credential stewardship. It does not implement or verify a controlled plan for credential rotation with overlap and expiry in this scenario.

 

Question 13

A design review of an external workload using OIDC federation identifies one remaining requirement: correct configuration of federated credential for external workload trust. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Use application permissions for unattended app-only access and grant the required admin consent.
2. Reconcile api audience with requested permission using app-registration settings, token claims, consent grants, and the target API response and preserve the intended security boundary.
3. Use app-registration settings, token claims, consent grants, and the target API response to diagnose missing roles claim after assignment.
4. Create the app registration in the tenant that should own the application object.
5. Configure a federated identity credential for the trusted external workload issuer/subject instead of storing a secret.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides correct configuration of federated credential for external workload trust. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate application permissions for unattended API access. The scenario instead requires correct configuration of federated credential for external workload trust, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is reconciliation of API audience with requested permission. The scenario instead requires correct configuration of federated credential for external workload trust, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of missing roles claim after assignment. The scenario instead requires correct configuration of federated credential for external workload trust, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is creation of registration in correct home tenant. The scenario instead requires correct configuration of federated credential for external workload trust, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 14

Current evidence from a web or native client returning from Microsoft Entra sign-in shows that this requirement is not yet met: diagnosis of redirect URI mismatch during sign-in. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Choose the app registration supported account type that matches whether only the home tenant or multiple tenants must sign in.
2. Treat app-only token authorization from user delegation as separate control boundaries and verify each with app-registration settings, token claims, consent grants, and the target API response.
3. Compare the redirect URI sent by the client with the registered URI and correct the exact scheme, host, path, port, and platform mismatch.
4. Use the application/client ID for protocol configuration and the object ID when addressing the specific directory object.
5. Select the narrowest Microsoft Graph/API permission that supports the required operation.

Correct Answer: C

 

Correct Answer

Answer C is correct because This option directly tests diagnose redirect uri mismatch during sign-in at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate single-tenant versus multitenant registration. The scenario instead requires diagnosis of redirect URI mismatch during sign-in, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is separation of app-only token authorization from user delegation. The scenario instead requires diagnosis of redirect URI mismatch during sign-in, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between application ID and object ID. The scenario instead requires diagnosis of redirect URI mismatch during sign-in, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate least-privilege permission matching requested operation. The scenario instead requires diagnosis of redirect URI mismatch during sign-in, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 15

Before expanding an application registration and API integration, the administrator must satisfy this condition: the appropriate supported interactive flow for client capabilities. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Configure ownership without granting tenant-wide administration in app registration and API authorization and verify the effective result.
2. Use separate app registrations/credentials for development and production security boundaries.
3. Select an OAuth/OIDC interactive flow supported by the client type instead of using a flow that assumes a confidential client or daemon.
4. Expose an OAuth delegated scope on the resource API for client applications that act for a user.
5. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides the appropriate supported interactive flow for client capabilities. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of ownership without granting tenant-wide administration. The scenario instead requires the appropriate supported interactive flow for client capabilities, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is separation of development and production registration boundaries. The scenario instead requires the appropriate supported interactive flow for client capabilities, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is expose scope for consuming client application. The scenario instead requires the appropriate supported interactive flow for client capabilities, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is definition of app role with correct allowed member types. The scenario instead requires the appropriate supported interactive flow for client capabilities, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 16

The administrator is preparing an application registration and API integration for production. The required condition is: a clear distinction between authentication failure and API authorization failure. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Choose role value consumed by application code in app registration and API authorization and verify the resulting behavior.
2. Use app-registration settings, token claims, consent grants, and the target API response to distinguish authentication failure from api authorization failure.
3. Inspect the issued token and correct the API permission, consent, or assignment that should produce the required scope or role claim.
4. Check whether the service principal/enterprise application exists in the tenant and create or consent to it through a supported flow if required.
5. Configure the supported account types to match the intended tenant/user population.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides a clear distinction between authentication failure and API authorization failure. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate role value consumed by application code. The scenario instead requires a clear distinction between authentication failure and API authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of scope or role absent from issued token. The scenario instead requires a clear distinction between authentication failure and API authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of missing enterprise object after registration scenario. The scenario instead requires a clear distinction between authentication failure and API authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate supported account types for user population. The scenario instead requires a clear distinction between authentication failure and API authorization failure, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 17

A production issue involving an application calling an API for a signed-in user has been narrowed to this requirement: the appropriate delegated permissions for user-context API call. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
2. Treat configured API permissions and the tenant consent grant as separate prerequisites.
3. Assign accountable application owners without granting unrelated tenant-wide application administration.
4. Register the exact redirect URI for the client platform and protocol flow.
5. Use delegated API permissions when the application calls the API in the signed-in user context.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate delegated permissions for user-context API call. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between app role and delegated OAuth scope. The scenario instead requires the appropriate delegated permissions for user-context API call, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between permission configuration and consent grant. The scenario instead requires the appropriate delegated permissions for user-context API call, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for app ownership and credential stewardship. The scenario instead requires the appropriate delegated permissions for user-context API call, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is register correct redirect URI for client platform. The scenario instead requires the appropriate delegated permissions for user-context API call, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 18

The security review of an unattended daemon calling an API without a user focuses on one acceptance criterion: the appropriate application permissions for unattended API access. No new standing administrator privilege may be introduced. Choose TWO actions that together implement and verify the requirement.

1. Classify the client as public or confidential based on whether it can securely hold credentials.
2. Use application permissions for unattended app-only access and grant the required admin consent.
3. Reconcile api audience with requested permission using app-registration settings, token claims, consent grants, and the target API response and preserve the intended security boundary.
4. Use app-registration settings, token claims, consent grants, and the target API response to diagnose missing roles claim after assignment.
5. Inspect the issued token claims and API response to confirm the registration, consent, and permission configuration behaves as intended.
6. Create the app registration in the tenant that should own the application object.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because This action directly provides the appropriate application permissions for unattended API access at the correct Microsoft Entra control boundary.

Answer E is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate public versus confidential client behavior. It does not implement or verify the appropriate application permissions for unattended API access in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is reconciliation of API audience with requested permission. It does not implement or verify the appropriate application permissions for unattended API access in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of missing roles claim after assignment. It does not implement or verify the appropriate application permissions for unattended API access in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is creation of registration in correct home tenant. It does not implement or verify the appropriate application permissions for unattended API access in this scenario.

 

Question 19

The team is validating an application registration and API integration. The decisive requirement is: the appropriate least-privilege permission matching requested operation. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Choose the app registration supported account type that matches whether only the home tenant or multiple tenants must sign in.
2. Prefer a certificate or federated credential over a long-lived client secret when the client can support it.
3. Treat app-only token authorization from user delegation as separate control boundaries and verify each with app-registration settings, token claims, consent grants, and the target API response.
4. Use the application/client ID for protocol configuration and the object ID when addressing the specific directory object.
5. Select the narrowest Microsoft Graph/API permission that supports the required operation.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate least-privilege permission matching requested operation. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate single-tenant versus multitenant registration. The scenario instead requires the appropriate least-privilege permission matching requested operation, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate certificate versus secret for confidential authentication. The scenario instead requires the appropriate least-privilege permission matching requested operation, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is separation of app-only token authorization from user delegation. The scenario instead requires the appropriate least-privilege permission matching requested operation, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between application ID and object ID. The scenario instead requires the appropriate least-privilege permission matching requested operation, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 20

Operations staff investigating a custom API exposing delegated permissions have isolated the issue to: expose scope for consuming client application. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Configure ownership without granting tenant-wide administration in app registration and API authorization and verify the effective result.
2. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
3. Overlap old and new application credentials long enough to validate the new credential before retiring the old one.
4. Expose an OAuth delegated scope on the resource API for client applications that act for a user.
5. Use separate app registrations/credentials for development and production security boundaries.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides expose scope for consuming client application. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of ownership without granting tenant-wide administration. The scenario instead requires expose scope for consuming client application, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is definition of app role with correct allowed member types. The scenario instead requires expose scope for consuming client application, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for credential rotation with overlap and expiry. The scenario instead requires expose scope for consuming client application, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is separation of development and production registration boundaries. The scenario instead requires expose scope for consuming client application, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 21

The administrator must correct a custom API exposing delegated permissions without changing adjacent controls. The target condition is: diagnosis of scope or role absent from issued token. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Inspect the issued token and correct the API permission, consent, or assignment that should produce the required scope or role claim.
2. Choose role value consumed by application code in app registration and API authorization and verify the resulting behavior.
3. Check whether the service principal/enterprise application exists in the tenant and create or consent to it through a supported flow if required.
4. Configure a federated identity credential for the trusted external workload issuer/subject instead of storing a secret.
5. Configure the supported account types to match the intended tenant/user population.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides diagnosis of scope or role absent from issued token. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is the appropriate role value consumed by application code. The scenario instead requires diagnosis of scope or role absent from issued token, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of missing enterprise object after registration scenario. The scenario instead requires diagnosis of scope or role absent from issued token, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is correct configuration of federated credential for external workload trust. The scenario instead requires diagnosis of scope or role absent from issued token, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate supported account types for user population. The scenario instead requires diagnosis of scope or role absent from issued token, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 22

An audit of an application registration and API integration identifies this control gap: a clear distinction between permission configuration and consent grant. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
2. Assign accountable application owners without granting unrelated tenant-wide application administration.
3. Treat configured API permissions and the tenant consent grant as separate prerequisites.
4. Register the exact redirect URI for the client platform and protocol flow.
5. Select the narrowest Microsoft Graph/API permission that supports the required operation.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides a clear distinction between permission configuration and consent grant. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between app role and delegated OAuth scope. The scenario instead requires a clear distinction between permission configuration and consent grant, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a controlled plan for app ownership and credential stewardship. The scenario instead requires a clear distinction between permission configuration and consent grant, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is register correct redirect URI for client platform. The scenario instead requires a clear distinction between permission configuration and consent grant, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate least-privilege permission matching requested operation. The scenario instead requires a clear distinction between permission configuration and consent grant, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 23

The documented success criterion for an application registration and API integration is: reconciliation of API audience with requested permission. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Create the app registration in the tenant that should own the application object.
2. Request the token for the target API audience, grant permissions on that same API, and verify the issued aud, scp, or roles claims before changing application logic.
3. Classify the client as public or confidential based on whether it can securely hold credentials.
4. Select an OAuth/OIDC interactive flow supported by the client type instead of using a flow that assumes a confidential client or daemon.
5. Use app-registration settings, token claims, consent grants, and the target API response to diagnose missing roles claim after assignment.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly resolves reconcile api audience with requested permission at the evidence or control boundary described by the scenario, rather than substituting a neighboring identity workflow.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is creation of registration in correct home tenant. The scenario instead requires reconciliation of API audience with requested permission, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate public versus confidential client behavior. The scenario instead requires reconciliation of API audience with requested permission, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate supported interactive flow for client capabilities. The scenario instead requires reconciliation of API audience with requested permission, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of missing roles claim after assignment. The scenario instead requires reconciliation of API audience with requested permission, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 24

The current configuration of an application registration and API integration is otherwise acceptable. The unresolved requirement is: separation of app-only token authorization from user delegation. Existing working access outside the stated scope must remain unchanged. Choose TWO actions that together implement and verify the requirement.

1. Use app-registration settings, token claims, consent grants, and the target API response to distinguish authentication failure from api authorization failure.
2. Choose the app registration supported account type that matches whether only the home tenant or multiple tenants must sign in.
3. Treat app-only token authorization from user delegation as separate control boundaries and verify each with app-registration settings, token claims, consent grants, and the target API response.
4. Prefer a certificate or federated credential over a long-lived client secret when the client can support it.
5. Use the application/client ID for protocol configuration and the object ID when addressing the specific directory object.
6. Inspect the issued token claims and API response to confirm the registration, consent, and permission configuration behaves as intended.

Correct Answers: C, F

 

Correct Answers

Answer C is correct because This action directly provides separation of app-only token authorization from user delegation at the correct Microsoft Entra control boundary.

Answer F is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between authentication failure and API authorization failure. It does not implement or verify separation of app-only token authorization from user delegation in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate single-tenant versus multitenant registration. It does not implement or verify separation of app-only token authorization from user delegation in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate certificate versus secret for confidential authentication. It does not implement or verify separation of app-only token authorization from user delegation in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between application ID and object ID. It does not implement or verify separation of app-only token authorization from user delegation in this scenario.

 

Question 25

A troubleshooting review of an application that authorizes users or workloads by role claims confirms that the next action must address: definition of app role with correct allowed member types. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Define an app role for application authorization when the application needs role claims rather than delegated OAuth scopes.
2. Use delegated API permissions when the application calls the API in the signed-in user context.
3. Use separate app registrations/credentials for development and production security boundaries.
4. Configure ownership without granting tenant-wide administration in app registration and API authorization and verify the effective result.
5. Overlap old and new application credentials long enough to validate the new credential before retiring the old one.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides definition of app role with correct allowed member types. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is the appropriate delegated permissions for user-context API call. The scenario instead requires definition of app role with correct allowed member types, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is separation of development and production registration boundaries. The scenario instead requires definition of app role with correct allowed member types, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is correct configuration of ownership without granting tenant-wide administration. The scenario instead requires definition of app role with correct allowed member types, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a controlled plan for credential rotation with overlap and expiry. The scenario instead requires definition of app role with correct allowed member types, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 26

A staged rollout of an application registration and API integration cannot proceed until the team can demonstrate: the appropriate role value consumed by application code. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Check whether the service principal/enterprise application exists in the tenant and create or consent to it through a supported flow if required.
2. Choose role value consumed by application code in app registration and API authorization and verify the resulting behavior.
3. Configure the supported account types to match the intended tenant/user population.
4. Use application permissions for unattended app-only access and grant the required admin consent.
5. Configure a federated identity credential for the trusted external workload issuer/subject instead of storing a secret.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides the appropriate role value consumed by application code. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of missing enterprise object after registration scenario. The scenario instead requires the appropriate role value consumed by application code, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate supported account types for user population. The scenario instead requires the appropriate role value consumed by application code, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate application permissions for unattended API access. The scenario instead requires the appropriate role value consumed by application code, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correct configuration of federated credential for external workload trust. The scenario instead requires the appropriate role value consumed by application code, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 27

The team compares supported controls for an application calling an API for a signed-in user. The deciding condition is: a clear distinction between app role and delegated OAuth scope. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Use app roles when authorization should arrive as role claims, and use delegated OAuth scopes when an API is authorizing delegated access on behalf of a user.
2. Select the narrowest Microsoft Graph/API permission that supports the required operation.
3. Assign accountable application owners without granting unrelated tenant-wide application administration.
4. Register the exact redirect URI for the client platform and protocol flow.
5. Treat app-only token authorization from user delegation as separate control boundaries and verify each with app-registration settings, token claims, consent grants, and the target API response.

Correct Answer: A

 

Correct Answer

Answer A is correct because This option directly tests distinguish app role from delegated oauth scope at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is the appropriate least-privilege permission matching requested operation. The scenario instead requires a clear distinction between app role and delegated OAuth scope, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for app ownership and credential stewardship. The scenario instead requires a clear distinction between app role and delegated OAuth scope, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is register correct redirect URI for client platform. The scenario instead requires a clear distinction between app role and delegated OAuth scope, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is separation of app-only token authorization from user delegation. The scenario instead requires a clear distinction between app role and delegated OAuth scope, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 28

The identity architect is reviewing an application registration and API integration. The required outcome is: diagnosis of missing roles claim after assignment. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Use app-registration settings, token claims, consent grants, and the target API response to diagnose missing roles claim after assignment.
2. Select an OAuth/OIDC interactive flow supported by the client type instead of using a flow that assumes a confidential client or daemon.
3. Expose an OAuth delegated scope on the resource API for client applications that act for a user.
4. Classify the client as public or confidential based on whether it can securely hold credentials.
5. Create the app registration in the tenant that should own the application object.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides diagnosis of missing roles claim after assignment. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is the appropriate supported interactive flow for client capabilities. The scenario instead requires diagnosis of missing roles claim after assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is expose scope for consuming client application. The scenario instead requires diagnosis of missing roles claim after assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate public versus confidential client behavior. The scenario instead requires diagnosis of missing roles claim after assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is creation of registration in correct home tenant. The scenario instead requires diagnosis of missing roles claim after assignment, so this option would solve an adjacent identity problem rather than the documented gap.