Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 201:

  Your company has an Azure AD tenant that contains the users shown in the following table.

  

  You have the app registrations shown in the following table.

  

  A company policy prevents changes to user permissions.

  Which user can create appointments in the calendar of each user at the company?

  A. User1
  B. User2
  C. User3
  D. User4
  B. User2

• Question 202:

  HOTSPOT

  You have an Azure subscription that uses Microsoft Entra Permissions Management.

  You have an Amazon Web Services (AWS) account.

  You plan to connect Permissions Management to AWS.

  You need to create a Permissions Management app in Azure.

  How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: New-AzureADApplication

  The New-AzureADApplication cmdlet creates an application in Azure Active Directory (AD).

  Example: Create an application PS C:\>New-AzureADApplication -DisplayName "My new application" -IdentifierUris "

  http:// mynewapp.contoso.com"Box2:-IdentifierUrisIncorrect:New-AzureADApplicationKeyCredential

  The New-AzureADApplicationKeyCredential cmdlet creates a key credential for an application. -ObjectId <String> [-CustomKeyIdentifier <String>] [-StartDate <DateTime>] [-EndDate <DateTime>] [-Type <KeyType>] [-Usage <KeyUsage>] [- Value <String>] [-InformationAction <ActionPreference>] [-InformationVariable <String>] [<CommonParameters>]

  Syntax: New-AzureADApplicationKeyCredential

  New-AzureADApplicationExtensionProperty

  The New-AzureADApplicationExtensionProperty cmdlet creates an application extension property for an object in Azure Active Directory. -ObjectId <String> [-InformationAction <ActionPreference>] [-InformationVariable <String>] [-Name <String>] [-DataType <String>] [-TargetObjects <System.Collections.Generic.List`1[System.String]>] [<CommonParameters>]

  References:

  https://learn.microsoft.com/en-us/powershell/module/azuread/new-azureadapplicationkeycredentialSyntax:New-AzureADApplicationExtensionProperty

• Question 203:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.

  You deploy an Azure subscription and enable Microsoft 365 Defender.

  You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.

  Solution: From the Microsoft 365 Defender portal, you add the Google Workspace app connector.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  References:

  https://learn.microsoft.com/en-us/defender-cloud-apps/connect-aws

• Question 204:

  You have a Microsoft Entra tenant that contains the groups shown in the following table.

  

  You need to implement Privileged Identity Management (PIM) for the groups.

  Which groups can be managed by using PIM?

  A. Group1 only
  B. Group1 and Group2 only
  C. Group1 and Group3 only
  D. Group3 and Group4 only
  E. Group1, Group2, Group3, and Group4
  C. Group1 and Group3 only

• Question 205:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to enforce multi-factor authentication (MFA) for users in the Executives group when they connect to Microsoft Office 365 apps. The solution must affect only the users in the Executives group.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  You need to enforce multi-factor authentication (MFA) for users in the Executives group when they connect to Microsoft 365 apps. The solution must affect only the users in the Executives group.

  Use a Conditional Access policy to enforce MFA.

  Part 1: Create a Conditional Access policy and assign the Executives group

  Step 1: Sign in to the Microsoft Entra admin center as a Conditional Access Administrator.

  Step 2: Navigate to Protection > Conditional Access, select New policy.

  Step 3: Enter a name for the policy, for example: Require MFA for Executives.

  Step 4: Under Assignments, select Users or workload identities.

  Step 5: Under Include, select Select users and groups, then choose Users and groups.

  Step 6: Select the Executives group, and then select Select.

  Part 2: Configure the target apps and require MFA

  Step 1: Under Assignments, select Target resources.

  Step 2: Under Select what this policy applies to, choose Cloud apps.

  Step 3: Under Include, select Select apps.

  Step 4: Select Office 365.

  Step 5: Under Access controls, select Grant.

  Step 6: Select Grant access, and then select Require multi-factor authentication.

  Step 7: Select Select.

  Step 8: Set Enable policy to On, and then select Create.

  References:

  https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-azure-mfa

  https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication

• Question 206:

  You have a Microsoft 365 E5 subscription.

  You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a user named User1.

  You plan to deploy Microsoft Entra Permissions Management.

  You need to ensure that User1 can onboard the Azure subscription to Permissions Management. The solution must follow the principle of least privilege.

  Which Microsoft Entra role should you assign to User1?

  A. Permissions Management Administrator
  B. Global Administrator
  C. Security Administrator
  D. Application Administrator
  A. Permissions Management Administrator

  ---

  Explanation

  In Microsoft Entra Permissions Management, role assignments grant users permissions to monitor and take action in multicloud environments.

  Global Administrator: Manages all aspects of the Microsoft Entra admin center and Microsoft services that use Microsoft Entra ID identities.

  Permissions Management Administrator: Manages all aspects of Microsoft Entra Permissions Management.

  Billing Administrator: Performs common billing-related tasks such as updating payment information.

  Onboarding your Amazon Web Services (AWS), Microsoft Entra, or Google Cloud Platform (GCP) environments:

  To configure data collection, you must be a Permissions Management Administrator.

  A user with the Permissions Management Administrator role is required for AWS, Azure, and GCP onboarding.

  References:

  https://learn.microsoft.com/en-us/entra/permissions-management/product-roles-permissions

• Question 207:

  Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory

  (Azure AD) tenant named contoso.com by using Azure AD Connect.

  You need to prevent the synchronization of users who have the extensionAttribute15 attribute set to NoSync.

  What should you do in Azure AD Connect?

  A. Create an inbound synchronization rule for the Windows Azure Active Directory connector.
  B. Configure a Full Import run profile.
  C. Create an inbound synchronization rule for the Active Directory Domain Services connector.
  D. Configure an Export run profile.
  C. Create an inbound synchronization rule for the Active Directory Domain Services connector.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration

• Question 208:

  HOTSPOT

  You have a Microsoft Entra tenant named contoso.com that contains an administrative unit named AU1 and two users named User1 and User2. User1 is a member of AU1.

  You need to perform the following role assignments:

  1. User1: Security Administrator

  2. User2: User Administrator

  For which scopes can each user be assigned the role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 209:

  You need to meet the planned changes for the User administrator role.

  What should you do?

  A. Create an access review.
  B. Create an administrative unit.
  C. Modify Active assignments.
  D. Modify Role settings.
  D. Modify Role settings.

  ---

  Explanation

  Role Setting details is where you need to be: Role setting details - User Administrator Privileged Identity Management | Azure AD roles Default Setting State Require justification on activation Yes Require ticket information on activation No On activation, require Azure MFA Yes Require approval to activate No

  Approvers None References:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user?tabs=new

• Question 210:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a group named All Company and has the following Identity Governance settings:

  Block external users from signing in to this directory: Yes Remove external user. Yes Number of days before removing external user from this directory: 30

  On March 11, 2.022, you create an access package named Package1 that has the following settings: Resource rales

  1. Name: All Company

  2. Type: Group and Team

  3. Role: Member

  Lifecycle

  1. Access package assignment expire: On date

  2. Assignment expiration date: April 1, 2022

  On March 1, 2022, you assign Package1 to the guest users shown in the following table.

  

  On March 2, 2022, you assign the Reports reader role to Guest1.

  On April 1, 2022, you invite a guest user named Guest3 to contoso.com.

  On April 4, 2022, you add Guest3 to the All Company group.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.