Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 21:

  You have a Microsoft Entra tenant named contoso.com that has Microsoft Entra ID Protection enabled.

  You need to implement a sign-in risk remediation policy without blocking user access.

  What should you do first?

  A. Configure Microsoft Entra Access Reviews.
  B. Enforce Microsoft Entra Password Protection.
  C. Implement multi-factor authentication (MFA) for all users.
  D. Configure self-service password reset (SSPR) for all users.
  C. Implement multi-factor authentication (MFA) for all users.

  ---

  Explanation

  MFA and SSPR are both required. However, MFA is required first.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-remediate-unblock

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

• Question 22:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains Azure AD Privileged Identity Management (PIM) role settings for the User administrator role as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

• Question 23:

  You have a Microsoft 365 E5 subscription.

  Users authorize third-party cloud apps to access their data.

  You need to configure an alert that will be triggered when an app requires high permissions and is authorized by more than 20 users.

  Which type of policy should you create in the Microsoft Defender for Cloud Apps portal?

  A. anomaly detection policy
  B. OAuth app policy
  C. access policy
  D. activity policy
  B. OAuth app policy

  ---

  Explanation

  https://learn.microsoft.com/en-us/defender-cloud-apps/app-permission-policyReason:InadditiontotheexistinginvestigationofOAuthappsconnectedtoyourenvironment,youcansetpermissionpoliciessothatyougetautomatednotificationswhenanOAuthappmeetscertaincriteria.Forexample,youcanautomaticallybealertedwhenthereareappsthatrequireahighpermissionlevelandwereauthorizedbymorethan50users.

• Question 24:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the following group:

  1. Name: Group1

  2. Members: User1, User2

  3. Owner: User3

  On January 15, 2021, you create an access review as shown in the exhibit. (Click the Exhibit tab.)

  

  Users answer the Review1 question as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 25:

  You have an Azure AD tenant that contains the users shown in The following table.

  

  You enable self-service password reset (SSPR) for all the users and configure SSPR to require security questions as the only authentication method.

  Which users must use security questions when resetting their password?

  A. User4 only
  B. User3and User4only
  C. User1 and User4only
  D. User1, User3, and User4 only
  E. User1, User2, User3. and User4
  B. User3and User4only

  ---

  Explanation

  User1 and User2 are administrators, so the security question does not apply to them.

  Note: When you test self-service password reset, use a non-administrator account. By default, Azure AD enables self-service password reset for admins. They're required to use two authentication methods to reset their password.

  Administrator reset policy differences By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned.

  A two-gate policy applies in the following circumstances:

  All the following Azure administrator roles are affected: Application administrator Application proxy service administrator Authentication administrator Azure AD Joined Device Local Administrator Billing administrator Compliance administrator Device administrators Directory synchronization accounts Directory writers Dynamics 365 administrator Exchange administrator Global administrator or company administrator Helpdesk administrator Intune administrator Mailbox Administrator Partner Tier1 Support Partner Tier2 Support *-> Password administrator Power BI service administrator Privileged Authentication administrator Privileged role administrator Security administrator Service support administrator SharePoint administrator Skype for Business administrator *-> User administrator

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences

• Question 26:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Active Directory forest that syncs to a Microsoft Entra tenant.

  You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Microsoft Entra for up to 30 minutes.

  You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Microsoft Entra.

  Solution: You configure Microsoft Entra Password Protection.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 27:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to add the LinkedIn application as a resource to the Sales and Marketing access package. The solution must NOT remove any other resources from the access package.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  

  Change resource roles for an access package in entitlement management As an access package manager, you can change the resources in an access package at any time without worrying about provisioning the user's access to the new resources, or removing their access from the previous resources.

  Step 1: Sign in to the Microsoft Entra admin center as at least an Identity Governance Administrator.

  Step 2: Browse to Identity governance > Entitlement management > Access package.

  Step 3: On the Access packages page, open the access package you want to check to ensure that its catalog has the necessary resources. [Open the Sales and Marketing access package]

  Step 4: In the left menu, select Catalog and then open the catalog.

  

  Step 5: In the left menu, select Resources to see the list of resources in this catalog.

  If the resources aren't already in the catalog, and you're an administrator or a catalog owner, you can add resources to a catalog. The types of resources you can add are groups, applications you've integrated with your directory, and SharePoint Online sites.

  Step 6: Click Add resources [or if Linked is visible, just select LinkedIn on the screen directly]

  Step 7: Select the LinkedIn application

  References:

  https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-resources

• Question 28:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 E5 subscription.

  You create a user named User1.

  You need to ensure that User1 can update the status of Identity Secure Score improvement actions.

  Solution: You assign the Exchange Administrator role to User1.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 29:

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  You have an administrative unit named Au1. Group1, User2, and User3 are members of Au1.

  User5 is assigned the User administrator role for Au1.

  For which users can User5 reset passwords?

  A. User1, User2, and User3
  B. User1 and User2 only
  C. User3 and User4 only
  D. User2 and User3 only
  D. User2 and User3 only

• Question 30:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains two attribute sets named Set1 and Set2. The subscription contains the users shown in the following table.

  

  You have the custom security attributes shown in the following table.

  

  You assign User2 the Attribute Definition Administrator role for Set1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No - User1 can modify the configuration of Secure1.

  User1 is Global Administrator. By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.

  Note: The roles that apply to configuration sets are: Attribute Definition Administrator Attribute Assignment Administrator Attribute Definition Reader Attribute Assignment Reader

  Box 2: No - User2 can view the value of Secure2 for all users.

  User2 is Attribute Definition Administrator. Attribute Definition Administrator Users with this role can define a valid set of custom security attributes that can be assigned to supported Microsoft Entra objects. This role can also activate and deactivate custom security attributes.

  Box 3: Yes - User3 can view the value of Secure3 for all users.

  User3 is Attribute assignment Administrator. Attribute Assignment Administrator Users with this role can assign and remove custom security attribute keys and values for supported Microsoft Entra objects such as users, service principals, and devices.

  References:

  https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference