SC-300 Certification Practice Question #235

Question

You have an Azure AD tenant that contains the groups shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Accepted Answer

A managed identity is a service principal. Per the MS Learn membership matrix, service principals can be members of a security group but not a Microsoft 365 group, and only users/devices can populate a dynamic group, while on-prem-synced groups are managed on-premises. Of the five groups, only Group2 is an in-cloud, assigned security group, so "Group2 only" is correct. For an Azure AD cloud user, direct (manual) assignment works for the three Cloud + Assigned groups (All Company, Group1, Group2); Group3 is Dynamic (members are computed by rule, not added manually) and Group4 is synced from Windows Server AD (managed on-premises), so the answer is "All Company, Group1, and Group2 only." Confidence is held at 84 rather than higher because a minority of commenters note a cloud user could technically be made a member of the dynamic Group3 by editing its rule; however the question's intent (and the highest-voted, tested answers) treats the standard direct-assignment behavior, which excludes the dynamic and on-prem groups.

More SC-300 practice questions