Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 91:

  DRAG DROP

  You have a Microsoft 365 E5 subscription. The subscription contains 500 devices that run Windows.

  You have deployed the Global Secure Access client to the devices.

  You need to prevent users from accessing https://contoso.com from the devices.

  Which three actions should you perform in sequence?

  To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 92:

  You have a Microsoft Entra tenant that contains the devices shown in the following table.

  

  You plan to configure Microsoft Entra Private Access.

  You deploy the Global Secure Access client to compatible devices.

  From which devices can you use Private Access?

  A. Device1 only
  B. Device2 only
  C. Device2 and Device4 only
  D. Device1, Device2, and Device3 only
  E. Device1, Device2, Device3, and Device4
  C. Device2 and Device4 only

  ---

  Explanation

  The Global Secure Access client, an essential component of Global Secure Access, helps organizations manage and secure network traffic on end-user devices. The client's main role is to route traffic that needs to be secured by Global Secure Access to the cloud service.

  Prerequisites:

  A Microsoft Entra tenant onboarded to Global Secure Access.

  A managed device joined to the onboarded tenant. The device must be either Microsoft Entra joined or Microsoft Entra hybrid joined. [Device2] Microsoft Entra registered devices aren't supported. [Not Device1, not Device3] The Global Secure Access client requires a 64-bit version of Windows 10 or Windows 11.

  Global Secure Access client for Android

  The Global Secure Access client can be deployed to compliant Android devices using Microsoft Intune and Microsoft Defender for Endpoint on Android.

  Prerequisites:

  Android devices must be Microsoft Entra registered or Microsoft Entra joined devices. [Device4]

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-android-client

• Question 93:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest.

  You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

  You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

  Solution: You configure conditional access policies.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn

• Question 94:

  HOTSPOT

  You have two Microsoft Entra tenants named contoso.com and fabrikam.com. Contoso.com contains the users shown in the following table.

  

  You configure cross-tenant synchronization from contoso.com to fabrikam.com by using the following settings:

  Users and groups: Group1

  Provisioning Mode: Automatic

  Attribute mappings: Default

  Source Object Scope: Filter1 and Filter2

  Filter1 is configured as shown in the following table.

  

  Filter2 is configured as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No - User1 syncs to fabrikam.com.

  User1 is in IT department and has the job title support. Filter1 matches. User1 is in city Vancouner, which does not have a letter M. Filter2 does not match. User1 is not synced.

  Note:

  Both filter must match. Filter1 matches if department is IT, and there is jobTitle value. Filter2 matches any city that has the letter M in it.

  In Microsoft Entra Connect Sync, the "PRESENT" operator in scoping filters specifies that the attribute must exist with any value, even if it's empty or null. This is different from EQUALS, which requires a specific value, or NOT EQUALS, which excludes a specific value. The PRESENT operator is used to ensure that an attribute exists in the object being synchronized, regardless of its actual value.

  Box 2: Yes - User2 syncs to fabrikam.com.

  User2 is in IT department and has the job title technician. Filter1 matches. User2 is in city Madrid, which does not have a letter M. Filter2 matches. User2 syncs.

  Box 3: No - User3 syncs to fabrikam.com.

  User3 is in HR department, so Filter1 will not match. User3 will not sync.

  References:

  https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering

• Question 95:

  You have a Microsoft Entra tenant.

  For the tenant, Users can register applications is set to No.

  A user named Admin1 must deploy a new cloud app named App1.

  You need to ensure that Admin1 can register App1 in Microsoft Entra ID. The solution must use the principle of least privilege.

  Which role should you assign to Admin1?

  A. Managed Application Contributor for subscription1
  B. Application developer in Microsoft Entra ID
  C. Cloud application administrator in Microsoft Entra ID
  D. App Configuration Data Owner for Subscription1
  B. Application developer in Microsoft Entra ID

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles

• Question 96:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to ensure that the owner of each Microsoft 365 group is notified to renew their group every 180 days. Groups that are not renewed must be deleted. For groups without an owner, notifications must be sent to Allan Deyoung.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  

  Microsoft 365 group expiration policy With the increase in usage of Microsoft 365 groups and Microsoft Teams, administrators and users need a way to clean up unused groups and teams. A Microsoft 365 groups expiration policy can help remove inactive groups from the system and make things cleaner.

  How to set the expiration policy As noted above, expiry is turned off by default. An administrator will have to enable the expiration policy and set the properties for it to take effect.

  Use the Microsoft 365 group expiration policy in Microsoft Entra ID.

  Step 1: Sign in to the Microsoft Entra admin center as a Global Administrator.

  Step 2: Navigate to Identity > Groups > Expiration.

  Step 3: Set Group lifetime (in days) to 180.

  Step 4: In Email contact for groups with no owners, specify Allan Deyoung.

  Step 5: Set Enable expiration for these Microsoft 365 groups to All.

  Step 6: Select Save.

  Note:

  Group owners receive renewal notifications 30 days, 15 days, and 1 day before expiration. If a group is not renewed, it is automatically deleted along with its associated resources.

  References:

  https://learn.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-groups-expiration-policy

  

• Question 97:

  You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses. You are deploying Global Secure Access.

  You need to ensure that connections to www.microsoft.com are bypassed by Global Secure Access.

  Which profiles should you update?

  A. Internet access profile only
  B. Microsoft traffic profile only
  C. Microsoft traffic profile and Internet access profile only
  D. Microsoft traffic profile, Private access profile, and Internet access profile
  A. Internet access profile only

  ---

  Explanation

  Global Secure Access, How to manage the Internet Access traffic forwarding profile

  The Internet Access traffic forwarding profile routes internet traffic through the Global Secure Access client. Enabling this traffic forwarding profile allows remote workers to connect to the internet in a controlled and secure way. With the features of Microsoft Entra Internet Access, you can control which internet sites can be accessed. You can also configure which traffic to exclude from Global Secure Access based on IP addresses, IP address ranges, IP subnets, and fully qualified domain names (FQDNs).

  Internet Access traffic forwarding profile policies

  View the policies that relate to the Internet Access traffic forwarding profile. There are three policies by default. To view them:

  Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.

  Browse to Global Secure Access > Connect > Traffic forwarding.

  Select the View link in the Internet Access policies section.

  The Custom Bypass policy contains user-defined traffic/endpoints that are excluded from the Internet Access traffic forwarding profile. In other words, you define the traffic that the profile shouldn't acquire. You might typically exclude traffic such as your VPN endpoints, private IP ranges, squat IP ranges, and endpoints that leverage a network Access Control List (ACL).

  The default Internet Access policies include:

  Default Bypass

  Default Acquire

  Custom Bypass

  Example of adding a custom bypass policy:

  Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.

  Browse to Global Secure Access > Connect > Traffic forwarding.

  In the Internet Access traffic forwarding profile area, in the Internet Access policies section, select the View link.

  Expand the Custom Bypass policy.

  Select Add rule.

  Choose a destination type, such as Fully Qualified Domain Name (FQDN). You can add multiple comma-separated destination values. Don't add whitespace. For example, contoso.com,fabrikam.com or 10.0.0.1/32,10.0.0.2/32. Ports, protocol, and action are always fixed and can't be changed.

  Enter a valid destination.

  Select Save.

  Incorrect:

  Microsoft traffic profile

  The Microsoft traffic forwarding profile includes Microsoft Entra ID/Microsoft Graph, SharePoint Online, Exchange Online, and other Microsoft apps.

  Private access profile

  With the Private Access profile, you can route traffic to your private resources. This traffic forwarding profile requires configuring Quick Access, which includes the fully qualified domain names (FQDNs) and IP addresses of the private apps and resources you want to forward to the service.

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-internet-access-profile

• Question 98:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Monitor to analyze Microsoft Entra ID activity logs.

  You receive more than 100 email alerts each day for failed Microsoft Entra ID user sign-in attempts.

  You need to ensure that a new security administrator receives the alerts instead of you.

  Solution: From Azure Monitor, you modify the action group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 99:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  User2 reports that he can only configure multi-factor authentication (MFA) to use the Microsoft Authenticator app.

  You need to ensure that User2 can configure alternate MFA methods.

  Which configuration is required, and which user should perform the configuration? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Modify security defaults.

  Privileged Authentication Administrator

  Users with this role can set or reset any authentication method (including passwords) for any user, including Global Administrators. Privileged Authentication Administrators can force users to re-register against existing non-password credential (such as MFA or FIDO) and revoke 'remember MFA on the device', prompting for MFA on the next sign-in of all users.

  The Authentication Administrator role has permission to force re-registration and multifactor authentication for standard users and users with some admin roles.

  

  Box 2: User1 only.

  Security Administrator.

  Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Azure Active Directory Identity Protection, Azure Active Directory Authentication, Azure Information Protection, and Office 365 Security & Compliance Center.

  Incorrect:

  Not User3. Service Support Administrator.

  Users with this role can create and manage support requests with Microsoft for Azure and Microsoft 365 services, and view the service dashboard and message center in the Azure portal and Microsoft 365 admin center.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 100:

  You have a Microsoft 365 E5 subscription.

  You purchase the app governance add-on license.

  You need to enable app governance integration.

  Which portal should you use?

  A. the Microsoft Defender for Cloud Apps portal
  B. the Microsoft 365 admin center
  C. Microsoft 365 Defender
  D. the Azure Active Directory admin center
  E. the Microsoft Purview compliance portal
  A. the Microsoft Defender for Cloud Apps portal