Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 251:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 tenant.

  All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

  Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

  You need to block the users automatically when they report an MFA request that they did not initiate.

  Solution: From the Microsoft Entra admin center, you configure the Notifications settings for multi-factor authentication (MFA).

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  You need to configure the fraud alert settings.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings

• Question 252:

  You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.

  A contractor uses the credentials of [email protected].

  You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected].

  What should you do?

  A. Run the New-MgUser cmdlet.
  B. Run the New-MgInvitation cmdlet.
  C. Configure the External collaboration settings.
  D. Implement Microsoft Entra Connect sync.
  B. Run the New-MgInvitation cmdlet.

• Question 253:

  HOTSPOT

  You have a Microsoft Entra tenant that contains a group named Group1 and two users named User1 and User2. User1 is a member of Group1.

  You register an enterprise application named App1. You enable self-service application access for App1 and configure the following settings:

  Allow users to request access to this application: Yes

  To which group should assigned users be added: Group1

  Require approval before granting access to this application: Yes

  Who is allowed to approve access to this application: User2

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  

• Question 254:

  You need to meet the authentication requirements for leaked credentials.

  What should you do?

  A. Enable password hash synchronization in Microsoft Entra Connect sync.
  B. Configure Microsoft Entra Password Protection.
  C. Configure a Microsoft Entra authentication method policy.
  D. Enable federation with PingFederate in Microsoft Entra Connect sync.
  A. Enable password hash synchronization in Microsoft Entra Connect sync.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity

• Question 255:

  You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table.

  

  Which resources can use Managed1 as their identity?

  A. WebApp1 only
  B. storage1 and WebApp1 only
  C. VM1 and WebApp1 only
  D. VM1, storage1, and WebApp1
  C. VM1 and WebApp1 only

• Question 256:

  HOTSPOT

  You have an Azure subscription named Sub1.

  You plan to deploy Microsoft Entra Permissions Management.

  You need to ensure that Permission Management can onboard Sub1. The solution must follow the principle of least privilege.

  How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 257:

  You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.

  A contractor uses the credentials of [email protected].

  You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected].

  What should you do?

  A. Configure the External collaboration settings.
  B. Run the New-MgUser cmdlet.
  C. Create a guest user account in contoso.com
  D. Add a custom domain name to contoso.com.
  C. Create a guest user account in contoso.com

  ---

  Explanation

  Correct: * Create a guest user account in contoso.com. * Run the New-AzureADMSInvitation cmdlet. [For Microsoft Active Directory] * Run the New-MgInvitation cmdlet. [For Microsoft Entra]

  Incorrect: * Add a custom domain name to contoso.com * Add a WS-Fed identity provider. * Configure the External collaboration settings. * Implement Azure AD Connect. * Implement Microsoft Entra Application Proxy. * Implement Microsoft Entra Connect sync * Run the New-AzADUser cmdlet. * Run the New-MgUser cmdlet.

  Note: * New-AzureADMSInvitation.

  This cmdlet is used to invite a new external user to your directory.

  New-MgInvitation Microsoft.Graph.Identity.SignIns Use this API to create a new invitation or reset the redemption status for a guest user who already redeemed their invitation. Invitation adds an external user to the organization

• Question 258:

  SIMULATION

  You need to deploy multi factor authentication (MFA). The solution must meet the following requirements:

  1. Require MFA registration only for members of the Sg-Finance group.

  2. Exclude Debra Berger from having to register for MFA.

  3. Implement the solution without using a Conditional Access policy.

  A. See the Explanation Below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the Explanation Below

  ---

  Explanation

  To deploy Multi-Factor Authentication (MFA) for only the members of the Sg-Finance group, excluding Debra Berger, and without using a Conditional Access policy, you can follow these steps:

  1. Open the Microsoft Entra admin center:

  2. uk.co.certification.simulator.questionpool.PList@104a0cb8

  3. Navigate to MFA settings:

  4. Manage user settings:

  5. Exclude a user from

  MFA:

  6. Verify the configuration:

  7. Communicate the change:

  8. Monitor the setup:

• Question 259:

  You have an Azure subscription that contains a registered app named App1.

  You need to review the sign-in activity for App1. The solution must meet the following requirements:

  1. Identify the number of failed sign-ins.

  2. Identify the success rate of sign-ins.

  3. Minimize administrative effort.

  What should you use?

  A. Sign-in logs
  B. Access reviews
  C. Audit logs
  D. Usage & insights
  A. Sign-in logs

  ---

  Explanation

  You can use the sign-ins log to find answers to questions like:

  What is the sign-in pattern of a user?

  How many users have signed in over a week?

  What's the status of these sign-ins?

  Information allows you to troubleshoot each step in a user's sign-in. Use these details to track:

  The volume of sign-ins protected by MFA.

  The reason for the authentication prompt, based on the session lifetime policies.

  *-> Usage and success rates for each authentication method.

  Etc.

  Not C:

  Audit logs have a default list view that shows:

  Date and time of the occurrence Service that logged the occurrence Category and name of the activity (what) Status of the activity (success or failure) Target Initiator / actor of an activity (who)

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins

• Question 260:

  You have an Azure subscription that contains a user named User1 and two resource groups named RG1 and RG2.

  You need to ensure that User1 can perform the following tasks:

  View all resources.

  Restart virtual machines.

  Create virtual machines in RG1 only.

  Create storage accounts in RG1 only.

  What is the minimum number of role-based access control (RBAC) role assignments required?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

  ---

  Explanation

  Two different scopes needed. One for RG1 and RG2, one for RG1 only.

  So we need one role that applies to both RG1 and RG2, and one role that applies to RG1 only.