SC-300 Certification Practice Question #113

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant. The AD DS domain contains the organizational units (OUs) shown in the following table.

You need to create a break-glass account named BreakGlass.

Where should you create BreakGlass, and which role should you assign to BreakGlass? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

A break-glass (emergency access) account exists to guarantee tenant administration when normal sign-in fails — including federation or on-prem outages. MS Learn is explicit that these accounts must be cloud-only, created directly in Microsoft Entra ID (Azure AD), not synchronized from on-premises, so neither OU1 (which syncs) nor OU2 (which doesn't sync, but is still an on-prem AD DS container) is valid. The account must hold the Global Administrator role to provide the broadest emergency control; Billing Administrator, Owner, and Privileged Role Administrator are all narrower. The overwhelming community signal (41-vote and 7-vote Highly Voted comments) aligns exactly with the MS Learn guidance, so confidence is high despite no published Suggested Answer letter.

More SC-300 practice questions