Microsoft SC-300 Entitlement Management and Governed External Access Practice Test

 

Topic 13 covers entitlement management and governed external access for the Microsoft Certified: Identity and Access Administrator Associate certification. These original practice questions apply the verified SC-300 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the SC-300 Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

The team compares supported controls for a partner project that needs time-limited access to several resources. The deciding condition is: the appropriate access package for time-limited multi-resource access. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
2. Configure internal and external sponsors in entitlement management and verify the effective result.
3. Choose policy for internal versus external requestors in entitlement management and verify the resulting behavior.
4. Renew the assignment through the existing access-package policy so approval, expiration, and governance controls remain intact.
5. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides the appropriate access package for time-limited multi-resource access. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is correct configuration of internal and external sponsors. The scenario instead requires the appropriate access package for time-limited multi-resource access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate policy for internal versus external requestors. The scenario instead requires the appropriate access package for time-limited multi-resource access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is renew assignment under existing governance constraints. The scenario instead requires the appropriate access package for time-limited multi-resource access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is delegate catalog administration to business owner. The scenario instead requires the appropriate access package for time-limited multi-resource access, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 2

The identity architect is reviewing an access request that requires manager or sponsor approval. The required outcome is: definition of requestor population and required approval. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Require terms acceptance for targeted resource access through the relevant entitlement management control.
3. Use catalog, access-package, request, assignment, and expiration history to diagnose package policy eligibility mismatch.
4. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.
5. Configure the access-package request policy with the intended requestor population and approval stages.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides definition of requestor population and required approval. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of resource unavailable to catalog creator. The scenario instead requires definition of requestor population and required approval, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is enforcement of terms acceptance for targeted resource access. The scenario instead requires definition of requestor population and required approval, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of package policy eligibility mismatch. The scenario instead requires definition of requestor population and required approval, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between access removal and guest account deletion. The scenario instead requires definition of requestor population and required approval, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 3

The change owner has limited the remediation for an entitlement-management access lifecycle to this outcome: a controlled plan for separation of duties across package roles. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Configure reacceptance for changed terms in entitlement management and verify the effective result.
2. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
3. Configure the access-package request policy with the intended requestor population and approval stages.
4. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.
5. Separate catalog/resource ownership from access-package request/approval roles where the governance requirement demands it.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides a controlled plan for separation of duties across package roles. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of reacceptance for changed terms. The scenario instead requires a controlled plan for separation of duties across package roles, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is correct configuration of external-user catalog availability. The scenario instead requires a controlled plan for separation of duties across package roles, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is route request to correct approval stage. The scenario instead requires a controlled plan for separation of duties across package roles, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is handling of guest with another active package assignment. The scenario instead requires a controlled plan for separation of duties across package roles, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 4

A change request for an entitlement-management access lifecycle will be accepted only when the following is true: evaluation of licensing for intended governance capability. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Resolve orphaned external access under stated lifecycle policy in entitlement management without broadening unrelated access.
2. Use catalog, access-package, request, assignment, and expiration history to diagnose terms prompt under user or device context.
3. Correct the access-package approval configuration or alternate approver path rather than bypassing the required approval stage.
4. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
5. Confirm that the tenant has the license required for the specific entitlement-management capability before designing the governed access workflow around it.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly resolves evaluate licensing for intended governance capability at the evidence or control boundary described by the scenario, rather than substituting a neighboring identity workflow.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is resolution of orphaned external access under stated lifecycle policy. The scenario instead requires evaluation of licensing for intended governance capability, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of terms prompt under user or device context. The scenario instead requires evaluation of licensing for intended governance capability, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is handling of missing approver without bypassing policy. The scenario instead requires evaluation of licensing for intended governance capability, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is bundle required resource roles in access package. The scenario instead requires evaluation of licensing for intended governance capability, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 5

The implementation of a governed catalog of finance and collaboration resources is complete except for this requirement: creation of catalog with correct resource ownership. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Use entitlement-management request and assignment history to trace a denied or expired request.
3. Define connected organization for known business partner explicitly in the entitlement management configuration.
4. Configure the access-package request policy with the intended requestor population and approval stages.
5. Set the access-package assignment to expire at the end of the approved project duration.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides creation of catalog with correct resource ownership. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is tracking of denied or expired request through evidence. The scenario instead requires creation of catalog with correct resource ownership, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is definition of connected organization for known business partner. The scenario instead requires creation of catalog with correct resource ownership, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between accepted terms and entitlement approval. The scenario instead requires creation of catalog with correct resource ownership, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the required setting for assignment expiration for project duration. The scenario instead requires creation of catalog with correct resource ownership, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 6

The support team has ruled out unrelated causes in a governed catalog of finance and collaboration resources. The remaining issue is: delegate catalog administration to business owner. Resource permissions outside the identity control are already correct. Choose TWO actions that together implement and verify the requirement.

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Renew the assignment through the existing access-package policy so approval, expiration, and governance controls remain intact.
3. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
4. Review the access-package request, approval, assignment, and expiration history to confirm the entitlement lifecycle.
5. Choose policy for internal versus external requestors in entitlement management and verify the resulting behavior.
6. Configure internal and external sponsors in entitlement management and verify the effective result.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because This action directly provides delegate catalog administration to business owner at the correct Microsoft Entra control boundary.

Answer D is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is renew assignment under existing governance constraints. It does not implement or verify delegate catalog administration to business owner in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is correct configuration of removal when final access package expires. It does not implement or verify delegate catalog administration to business owner in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate policy for internal versus external requestors. It does not implement or verify delegate catalog administration to business owner in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is correct configuration of internal and external sponsors. It does not implement or verify delegate catalog administration to business owner in this scenario.

 

Question 7

A readiness check of a governed catalog of finance and collaboration resources leaves one unresolved condition: diagnosis of resource unavailable to catalog creator. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Require terms acceptance for targeted resource access through the relevant entitlement management control.
2. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.
3. Use catalog, access-package, request, assignment, and expiration history to distinguish connected organization from cross-tenant trust.
4. Correct the catalog/resource ownership or permissions that prevent the intended resource from being added to the entitlement-management catalog.
5. Use catalog, access-package, request, assignment, and expiration history to diagnose package policy eligibility mismatch.

Correct Answer: D

 

Correct Answer

Answer D is correct because This option directly tests diagnose resource unavailable to catalog creator at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is enforcement of terms acceptance for targeted resource access. The scenario instead requires diagnosis of resource unavailable to catalog creator, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between access removal and guest account deletion. The scenario instead requires diagnosis of resource unavailable to catalog creator, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between connected organization and cross-tenant trust. The scenario instead requires diagnosis of resource unavailable to catalog creator, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of package policy eligibility mismatch. The scenario instead requires diagnosis of resource unavailable to catalog creator, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 8

Testing of a governed catalog of finance and collaboration resources is successful except for this condition: correct configuration of external-user catalog availability. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Configure reacceptance for changed terms in entitlement management and verify the effective result.
2. Configure the catalog and access-package policy so the intended external requestors can use the governed resource without making the catalog broadly available.
3. Configure the access-package request policy with the intended requestor population and approval stages.
4. Use catalog, access-package, request, assignment, and expiration history to diagnose partner requester eligibility under package policy.
5. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.

Correct Answer: B

 

Correct Answer

Answer B is correct because This option directly tests configure external-user catalog availability at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of reacceptance for changed terms. The scenario instead requires correct configuration of external-user catalog availability, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is route request to correct approval stage. The scenario instead requires correct configuration of external-user catalog availability, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of partner requester eligibility under package policy. The scenario instead requires correct configuration of external-user catalog availability, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is handling of guest with another active package assignment. The scenario instead requires correct configuration of external-user catalog availability, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 9

The organization wants the least-disruptive correction to a partner project that needs time-limited access to several resources. It must provide: bundle required resource roles in access package. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Resolve orphaned external access under stated lifecycle policy in entitlement management without broadening unrelated access.
2. Use catalog, access-package, request, assignment, and expiration history to diagnose terms prompt under user or device context.
3. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
4. Correct the access-package approval configuration or alternate approver path rather than bypassing the required approval stage.
5. Add the required group, application, or SharePoint resource roles to the access package so one governed assignment grants the intended resource access.

Correct Answer: E

 

Correct Answer

Answer E is correct because This option directly tests bundle required resource roles in access package at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is resolution of orphaned external access under stated lifecycle policy. The scenario instead requires bundle required resource roles in access package, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of terms prompt under user or device context. The scenario instead requires bundle required resource roles in access package, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is delegate catalog administration to business owner. The scenario instead requires bundle required resource roles in access package, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is handling of missing approver without bypassing policy. The scenario instead requires bundle required resource roles in access package, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 10

A design review of a project entitlement with a defined end date identifies one remaining requirement: the required setting for assignment expiration for project duration. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Set the access-package assignment to expire at the end of the approved project duration.
3. Use entitlement-management request and assignment history to trace a denied or expired request.
4. Define connected organization for known business partner explicitly in the entitlement management configuration.
5. Configure the access-package request policy with the intended requestor population and approval stages.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides the required setting for assignment expiration for project duration. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of resource unavailable to catalog creator. The scenario instead requires the required setting for assignment expiration for project duration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is tracking of denied or expired request through evidence. The scenario instead requires the required setting for assignment expiration for project duration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is definition of connected organization for known business partner. The scenario instead requires the required setting for assignment expiration for project duration, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between accepted terms and entitlement approval. The scenario instead requires the required setting for assignment expiration for project duration, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 11

Current evidence from guest users whose access must end with the project shows that this requirement is not yet met: the appropriate policy for internal versus external requestors. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Renew the assignment through the existing access-package policy so approval, expiration, and governance controls remain intact.
2. Configure internal and external sponsors in entitlement management and verify the effective result.
3. Separate catalog/resource ownership from access-package request/approval roles where the governance requirement demands it.
4. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
5. Choose policy for internal versus external requestors in entitlement management and verify the resulting behavior.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate policy for internal versus external requestors. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is renew assignment under existing governance constraints. The scenario instead requires the appropriate policy for internal versus external requestors, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is correct configuration of internal and external sponsors. The scenario instead requires the appropriate policy for internal versus external requestors, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for separation of duties across package roles. The scenario instead requires the appropriate policy for internal versus external requestors, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is correct configuration of removal when final access package expires. The scenario instead requires the appropriate policy for internal versus external requestors, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 12

Before expanding an entitlement-management access lifecycle, the administrator must satisfy this condition: diagnosis of package policy eligibility mismatch. The tenant has the licensing required for the named capability. Choose TWO actions that together implement and verify the requirement.

1. Review the access-package request, approval, assignment, and expiration history to confirm the entitlement lifecycle.
2. Evaluate licensing for intended governance capability using catalog, access-package, request, assignment, and expiration history before changing production configuration.
3. Use catalog, access-package, request, assignment, and expiration history to diagnose package policy eligibility mismatch.
4. Require terms acceptance for targeted resource access through the relevant entitlement management control.
5. Use catalog, access-package, request, assignment, and expiration history to distinguish connected organization from cross-tenant trust.
6. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.

Correct Answers: A, C

 

Correct Answers

Answer A is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Answer C is correct because This action directly provides diagnosis of package policy eligibility mismatch at the correct Microsoft Entra control boundary.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is evaluation of licensing for intended governance capability. It does not implement or verify diagnosis of package policy eligibility mismatch in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is enforcement of terms acceptance for targeted resource access. It does not implement or verify diagnosis of package policy eligibility mismatch in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between connected organization and cross-tenant trust. It does not implement or verify diagnosis of package policy eligibility mismatch in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is a clear distinction between access removal and guest account deletion. It does not implement or verify diagnosis of package policy eligibility mismatch in this scenario.

 

Question 13

The administrator is preparing an access request that requires manager or sponsor approval for production. The required condition is: route request to correct approval stage. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Configure the access-package policy so the request is sent to the required approver or fallback approval stage for that requestor population.
2. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.
3. Use catalog, access-package, request, assignment, and expiration history to diagnose partner requester eligibility under package policy.
4. Configure reacceptance for changed terms in entitlement management and verify the effective result.
5. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.

Correct Answer: A

 

Correct Answer

Answer A is correct because This option directly tests route request to correct approval stage at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is handling of guest with another active package assignment. The scenario instead requires route request to correct approval stage, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of partner requester eligibility under package policy. The scenario instead requires route request to correct approval stage, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is correct configuration of reacceptance for changed terms. The scenario instead requires route request to correct approval stage, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is creation of catalog with correct resource ownership. The scenario instead requires route request to correct approval stage, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 14

A production issue involving an entitlement-management access lifecycle has been narrowed to this requirement: handling of missing approver without bypassing policy. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
3. Correct the access-package approval configuration or alternate approver path rather than bypassing the required approval stage.
4. Use catalog, access-package, request, assignment, and expiration history to diagnose terms prompt under user or device context.
5. Resolve orphaned external access under stated lifecycle policy in entitlement management without broadening unrelated access.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides handling of missing approver without bypassing policy. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is delegate catalog administration to business owner. The scenario instead requires handling of missing approver without bypassing policy, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate access package for time-limited multi-resource access. The scenario instead requires handling of missing approver without bypassing policy, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of terms prompt under user or device context. The scenario instead requires handling of missing approver without bypassing policy, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is resolution of orphaned external access under stated lifecycle policy. The scenario instead requires handling of missing approver without bypassing policy, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 15

The security review of an entitlement-management access lifecycle focuses on one acceptance criterion: tracking of denied or expired request through evidence. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Configure the access-package request policy with the intended requestor population and approval stages.
2. Define connected organization for known business partner explicitly in the entitlement management configuration.
3. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
4. Use entitlement-management request and assignment history to trace a denied or expired request.
5. Use catalog, access-package, request, assignment, and expiration history to diagnose package policy eligibility mismatch.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides tracking of denied or expired request through evidence. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between accepted terms and entitlement approval. The scenario instead requires tracking of denied or expired request through evidence, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is definition of connected organization for known business partner. The scenario instead requires tracking of denied or expired request through evidence, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of resource unavailable to catalog creator. The scenario instead requires tracking of denied or expired request through evidence, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of package policy eligibility mismatch. The scenario instead requires tracking of denied or expired request through evidence, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 16

The team is validating an entitlement-management access lifecycle. The decisive requirement is: renew assignment under existing governance constraints. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Renew the assignment through the existing access-package policy so approval, expiration, and governance controls remain intact.
2. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
3. Separate catalog/resource ownership from access-package request/approval roles where the governance requirement demands it.
4. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
5. Configure internal and external sponsors in entitlement management and verify the effective result.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides renew assignment under existing governance constraints. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is correct configuration of removal when final access package expires. The scenario instead requires renew assignment under existing governance constraints, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a controlled plan for separation of duties across package roles. The scenario instead requires renew assignment under existing governance constraints, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is correct configuration of external-user catalog availability. The scenario instead requires renew assignment under existing governance constraints, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correct configuration of internal and external sponsors. The scenario instead requires renew assignment under existing governance constraints, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 17

Operations staff investigating contractors who must accept terms before receiving access have isolated the issue to: enforcement of terms acceptance for targeted resource access. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Require terms acceptance for targeted resource access through the relevant entitlement management control.
2. Evaluate licensing for intended governance capability using catalog, access-package, request, assignment, and expiration history before changing production configuration.
3. Use catalog, access-package, request, assignment, and expiration history to distinguish connected organization from cross-tenant trust.
4. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
5. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides enforcement of terms acceptance for targeted resource access. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is evaluation of licensing for intended governance capability. The scenario instead requires enforcement of terms acceptance for targeted resource access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between connected organization and cross-tenant trust. The scenario instead requires enforcement of terms acceptance for targeted resource access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is bundle required resource roles in access package. The scenario instead requires enforcement of terms acceptance for targeted resource access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between access removal and guest account deletion. The scenario instead requires enforcement of terms acceptance for targeted resource access, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 18

The administrator must correct contractors who must accept terms before receiving access without changing adjacent controls. The target condition is: correct configuration of reacceptance for changed terms. The organization requires a supported Microsoft-managed control. Choose TWO actions that together implement and verify the requirement.

1. Set the access-package assignment to expire at the end of the approved project duration.
2. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.
3. Use catalog, access-package, request, assignment, and expiration history to diagnose partner requester eligibility under package policy.
4. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
5. Review the access-package request, approval, assignment, and expiration history to confirm the entitlement lifecycle.
6. Configure reacceptance for changed terms in entitlement management and verify the effective result.

Correct Answers: E, F

 

Correct Answers

Answer E is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Answer F is correct because This action directly provides correct configuration of reacceptance for changed terms at the correct Microsoft Entra control boundary.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the required setting for assignment expiration for project duration. It does not implement or verify correct configuration of reacceptance for changed terms in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is handling of guest with another active package assignment. It does not implement or verify correct configuration of reacceptance for changed terms in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of partner requester eligibility under package policy. It does not implement or verify correct configuration of reacceptance for changed terms in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is creation of catalog with correct resource ownership. It does not implement or verify correct configuration of reacceptance for changed terms in this scenario.

 

Question 19

An audit of contractors who must accept terms before receiving access identifies this control gap: diagnosis of terms prompt under user or device context. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
3. Use catalog, access-package, request, assignment, and expiration history to diagnose terms prompt under user or device context.
4. Resolve orphaned external access under stated lifecycle policy in entitlement management without broadening unrelated access.
5. Choose policy for internal versus external requestors in entitlement management and verify the resulting behavior.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides diagnosis of terms prompt under user or device context. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is delegate catalog administration to business owner. The scenario instead requires diagnosis of terms prompt under user or device context, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate access package for time-limited multi-resource access. The scenario instead requires diagnosis of terms prompt under user or device context, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is resolution of orphaned external access under stated lifecycle policy. The scenario instead requires diagnosis of terms prompt under user or device context, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate policy for internal versus external requestors. The scenario instead requires diagnosis of terms prompt under user or device context, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 20

The documented success criterion for an access request that requires manager or sponsor approval is: a clear distinction between accepted terms and entitlement approval. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Define connected organization for known business partner explicitly in the entitlement management configuration.
2. Treat Terms of Use acceptance and entitlement approval as separate gates; require both when the policy calls for both controls.
3. Use catalog, access-package, request, assignment, and expiration history to diagnose package policy eligibility mismatch.
4. Require terms acceptance for targeted resource access through the relevant entitlement management control.
5. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.

Correct Answer: B

 

Correct Answer

Answer B is correct because This option directly tests distinguish accepted terms from entitlement approval at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is definition of connected organization for known business partner. The scenario instead requires a clear distinction between accepted terms and entitlement approval, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is diagnosis of package policy eligibility mismatch. The scenario instead requires a clear distinction between accepted terms and entitlement approval, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is enforcement of terms acceptance for targeted resource access. The scenario instead requires a clear distinction between accepted terms and entitlement approval, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of resource unavailable to catalog creator. The scenario instead requires a clear distinction between accepted terms and entitlement approval, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 21

The current configuration of a partner project that needs time-limited access to several resources is otherwise acceptable. The unresolved requirement is: correct configuration of removal when final access package expires. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Separate catalog/resource ownership from access-package request/approval roles where the governance requirement demands it.
3. Configure internal and external sponsors in entitlement management and verify the effective result.
4. Configure the access-package request policy with the intended requestor population and approval stages.
5. Configure the access-package assignment and external-user lifecycle so access is removed when the final governed entitlement expires.

Correct Answer: E

 

Correct Answer

Answer E is correct because This option directly tests configure removal when final access package expires at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of external-user catalog availability. The scenario instead requires correct configuration of removal when final access package expires, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a controlled plan for separation of duties across package roles. The scenario instead requires correct configuration of removal when final access package expires, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct configuration of internal and external sponsors. The scenario instead requires correct configuration of removal when final access package expires, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is route request to correct approval stage. The scenario instead requires correct configuration of removal when final access package expires, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 22

A troubleshooting review of an entitlement-management access lifecycle confirms that the next action must address: a clear distinction between access removal and guest account deletion. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Use catalog, access-package, request, assignment, and expiration history to distinguish connected organization from cross-tenant trust.
2. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
3. Configure external-user lifecycle settings so guest access expires or is removed when the entitlement ends.
4. Evaluate licensing for intended governance capability using catalog, access-package, request, assignment, and expiration history before changing production configuration.
5. Correct the access-package approval configuration or alternate approver path rather than bypassing the required approval stage.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides a clear distinction between access removal and guest account deletion. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between connected organization and cross-tenant trust. The scenario instead requires a clear distinction between access removal and guest account deletion, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is bundle required resource roles in access package. The scenario instead requires a clear distinction between access removal and guest account deletion, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is evaluation of licensing for intended governance capability. The scenario instead requires a clear distinction between access removal and guest account deletion, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is handling of missing approver without bypassing policy. The scenario instead requires a clear distinction between access removal and guest account deletion, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 23

A staged rollout of an entitlement-management access lifecycle cannot proceed until the team can demonstrate: handling of guest with another active package assignment. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Remove only the entitlement that expired; retain the guest account and any access still justified by another active access-package assignment.
3. Use entitlement-management request and assignment history to trace a denied or expired request.
4. Use catalog, access-package, request, assignment, and expiration history to diagnose partner requester eligibility under package policy.
5. Set the access-package assignment to expire at the end of the approved project duration.

Correct Answer: B

 

Correct Answer

Answer B is correct because This option directly tests handle guest with another active package assignment at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is creation of catalog with correct resource ownership. The scenario instead requires handling of guest with another active package assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is tracking of denied or expired request through evidence. The scenario instead requires handling of guest with another active package assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of partner requester eligibility under package policy. The scenario instead requires handling of guest with another active package assignment, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the required setting for assignment expiration for project duration. The scenario instead requires handling of guest with another active package assignment, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 24

The team compares supported controls for guest users whose access must end with the project. The deciding condition is: resolution of orphaned external access under stated lifecycle policy. No new standing administrator privilege may be introduced. Choose TWO actions that together implement and verify the requirement.

1. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
2. Renew the assignment through the existing access-package policy so approval, expiration, and governance controls remain intact.
3. Resolve orphaned external access under stated lifecycle policy in entitlement management without broadening unrelated access.
4. Review the access-package request, approval, assignment, and expiration history to confirm the entitlement lifecycle.
5. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
6. Choose policy for internal versus external requestors in entitlement management and verify the resulting behavior.

Correct Answers: C, D

 

Correct Answers

Answer C is correct because This action directly provides resolution of orphaned external access under stated lifecycle policy at the correct Microsoft Entra control boundary.

Answer D is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate access package for time-limited multi-resource access. It does not implement or verify resolution of orphaned external access under stated lifecycle policy in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is renew assignment under existing governance constraints. It does not implement or verify resolution of orphaned external access under stated lifecycle policy in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is delegate catalog administration to business owner. It does not implement or verify resolution of orphaned external access under stated lifecycle policy in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is the appropriate policy for internal versus external requestors. It does not implement or verify resolution of orphaned external access under stated lifecycle policy in this scenario.

 

Question 25

The identity architect is reviewing an approved supplier represented as a connected organization. The required outcome is: definition of connected organization for known business partner. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Define connected organization for known business partner explicitly in the entitlement management configuration.
2. Configure the access-package request policy with the intended requestor population and approval stages.
3. Require terms acceptance for targeted resource access through the relevant entitlement management control.
4. Use catalog, access-package, request, assignment, and expiration history to diagnose package policy eligibility mismatch.
5. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides definition of connected organization for known business partner. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is definition of requestor population and required approval. The scenario instead requires definition of connected organization for known business partner, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is enforcement of terms acceptance for targeted resource access. The scenario instead requires definition of connected organization for known business partner, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of package policy eligibility mismatch. The scenario instead requires definition of connected organization for known business partner, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of resource unavailable to catalog creator. The scenario instead requires definition of connected organization for known business partner, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 26

The change owner has limited the remediation for guest users whose access must end with the project to this outcome: correct configuration of internal and external sponsors. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Configure reacceptance for changed terms in entitlement management and verify the effective result.
2. Configure the access-package request policy with the intended requestor population and approval stages.
3. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
4. Configure internal and external sponsors in entitlement management and verify the effective result.
5. Separate catalog/resource ownership from access-package request/approval roles where the governance requirement demands it.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides correct configuration of internal and external sponsors. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is correct configuration of reacceptance for changed terms. The scenario instead requires correct configuration of internal and external sponsors, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is route request to correct approval stage. The scenario instead requires correct configuration of internal and external sponsors, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct configuration of external-user catalog availability. The scenario instead requires correct configuration of internal and external sponsors, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a controlled plan for separation of duties across package roles. The scenario instead requires correct configuration of internal and external sponsors, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 27

A change request for an approved supplier represented as a connected organization will be accepted only when the following is true: a clear distinction between connected organization and cross-tenant trust. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Use an entitlement-management access package to bundle the required resources, request policy, approval, and expiration.
2. Use catalog, access-package, request, assignment, and expiration history to distinguish connected organization from cross-tenant trust.
3. Evaluate licensing for intended governance capability using catalog, access-package, request, assignment, and expiration history before changing production configuration.
4. Correct the access-package approval configuration or alternate approver path rather than bypassing the required approval stage.
5. Use catalog, access-package, request, assignment, and expiration history to diagnose terms prompt under user or device context.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides a clear distinction between connected organization and cross-tenant trust. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is bundle required resource roles in access package. The scenario instead requires a clear distinction between connected organization and cross-tenant trust, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is evaluation of licensing for intended governance capability. The scenario instead requires a clear distinction between connected organization and cross-tenant trust, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is handling of missing approver without bypassing policy. The scenario instead requires a clear distinction between connected organization and cross-tenant trust, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of terms prompt under user or device context. The scenario instead requires a clear distinction between connected organization and cross-tenant trust, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 28

The implementation of an entitlement-management access lifecycle is complete except for this requirement: diagnosis of partner requester eligibility under package policy. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Place the governed resources in the appropriate entitlement-management catalog before creating the access package.
2. Set the access-package assignment to expire at the end of the approved project duration.
3. Configure the access-package request policy with the intended requestor population and approval stages.
4. Use entitlement-management request and assignment history to trace a denied or expired request.
5. Use catalog, access-package, request, assignment, and expiration history to diagnose partner requester eligibility under package policy.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides diagnosis of partner requester eligibility under package policy. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is creation of catalog with correct resource ownership. The scenario instead requires diagnosis of partner requester eligibility under package policy, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the required setting for assignment expiration for project duration. The scenario instead requires diagnosis of partner requester eligibility under package policy, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between accepted terms and entitlement approval. The scenario instead requires diagnosis of partner requester eligibility under package policy, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is tracking of denied or expired request through evidence. The scenario instead requires diagnosis of partner requester eligibility under package policy, so this option would solve an adjacent identity problem rather than the documented gap.