Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 321:

  You have a Microsoft 365 E5 subscription and an Azure subscription.

  You plan to analyze Microsoft Entra sign-in logs by using Azure Monitor. You need to configure diagnostic settings for Microsoft Entra.

  Which destination should you configure for the sign-in logs?

  A. an Azure event hub
  B. an Azure SQL database
  C. a Log Analytics workspace
  D. an Azure Storage account
  C. a Log Analytics workspace

  ---

  Explanation

  Integrate Microsoft Entra logs with Azure Monitor logs

  A Log Analytics workspace allows you to collect data based on a variety of requirements, such as geographic location of the data, subscription boundaries, or access to resources.

  Note: Use the integration of Microsoft Entra activity logs and Azure Monitor to perform the following tasks:

  Compare your Microsoft Entra sign-in logs against security logs published by Microsoft Defender for Cloud.

  Troubleshoot performance bottlenecks on your application's sign-in page by correlating application performance data from Azure Application Insights.

  Analyze the Identity Protection risky users and risk detections logs to detect threats in your environment.

  Identify sign-ins from applications still using the Active Directory Authentication Library (ADAL) for authentication.

  Prerequisites To use this feature, you need:

  An Azure subscription.

  A Microsoft Entra ID P1 or P2 tenant.

  At least the Security Administrator role in the Microsoft Entra tenant.

  A Log Analytics workspace in your Azure subscription.

  Permission to access data in a Log Analytics workspace.

  References:

  https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs

• Question 322:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains a user named User1 and the groups shown in the following table.

  

  In the tenant, you create the groups shown in the following table.

  

  Which members can you add to GroupA and GroupB? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://bitsizedbytes.wordpress.com/2018/12/10/distribution-security-and-office-365-groups-nesting/

• Question 323:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named SecAdmin1. SecAdmin1 is

  assigned the Security administrator role.

  SecAdmin1 reports that she cannot reset passwords from the Azure AD Identity Protection portal.

  You need to ensure that SecAdmin1 can manage passwords and invalidate sessions on behalf of non-administrative users. The solution must use the principle of least privilege.

  Which role should you assign to SecAdmin1?

  A. Authentication administrator
  B. Helpdesk administrator
  C. Privileged authentication administrator
  D. Security operator
  B. Helpdesk administrator

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 324:

  You have an Azure subscription that contains the resources shown in the following table.

  

  For which resources can you create an access review?

  A. Group1, App1, Contributor, and Role1
  B. Hotel and Contributor only
  C. Group1, Role1, and Contributor only
  D. Group1 only
  A. Group1, App1, Contributor, and Role1

  ---

  Explanation

  Access reviews require an Azure AD Premium P2 license.

  Access reviews for Group1 and App1 can be configured in Azure AD Access Reviews.

  Access reviews for the Contributor role and Role1 would need to be configured in Privileged Identity Management (PIM). PIM is included in Azure AD Premium P2.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review?toc=/azure/active-directory/governance/toc.json

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 325:

  DRAG DROP

  You have a new Microsoft 365 tenant that uses a domain name of contoso.onmicrosoft.com.

  You register the name contoso.com with a domain registrar.

  You need to use contoso.com as the default domain name for new Microsoft 365 users.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  References:

  https://practical365.com/configure-a-custom-domain-in-office-365/

• Question 326:

  You have a Microsoft 365 subscription.

  You plan to deploy an app named App1 that will have the following configurations:

  1. Will be registered in Microsoft Entra

  2. Will run as a service without user interaction

  3. Will collect audit logs associated with user sign-ins

  4. Will access resources by using the Microsoft Graph API

  You need to ensure that App1 can access Microsoft Graph.

  What should you use?

  A. application permissions
  B. delegated permissions
  C. a custom role-based access control (RBAC) role
  D. a built-in role-based access control (RBAC) role
  B. delegated permissions

• Question 327:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium Plan 2 license. The tenant contains the users shown in the following table.

  

  You have the Device Settings shown in the following exhibit.

  

  User1 has the devices shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Users may join 5 devices to Azure AD.

  Box 2: Yes

  Box 3: No

  An additional local device administrator has not been applied

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

• Question 328:

  You have an Azure AD tenant that contains a user named User1.

  User1 needs to manage license assignments and reset user passwords.

  Which role should you assign to User1?

  A. Helpdesk administrator
  B. Billing administrator
  C. License administrator
  D. User administrator
  D. User administrator

• Question 329:

  You have a Microsoft 365 tenant.

  In Microsoft Entra ID, you configure the terms of use.

  You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access.

  What should you configure?

  A. an access policy in Microsoft Defender for Cloud Apps
  B. Terms and conditions in Microsoft Intune
  C. a conditional access policy in Microsoft Entra ID
  D. a compliance policy in Microsoft Intune
  C. a conditional access policy in Microsoft Entra ID

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/terms-of-use

• Question 330:

  HOTSPOT

  You have an Azure subscription named Sub1.

  You plan to onboard Microsoft Entra Permissions Management.

  You need to ensure that Permissions Management users can manage role assignments for Sub1. The solution must follow the principle of least privilege.

  Which role should you assign and to which identity should you assign the role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: User Access Administrator

  Onboard a Microsoft Azure subscription Onboarding a subscription creates a new authorization system to represent the Azure subscription in Permissions Management.

  The Permissions Management service is built on Azure, and given you're onboarding your Azure subscriptions to be monitored and managed, setup is simple with few moving parts to configure.

  When your tenant is onboarded, an application is created in the tenant. This app requires 'reader' permissions on the subscriptions For controller functionality, the app requires 'User Access Administrator' to create and implement right-size roles

  Note: User Access Administrator Manage user access to Azure resources Assign roles in Azure RBAC Assign themselves or others the Owner role

  Incorrect:

  1. Contributor Grants full access to manage all resources > Can't assign roles in Azure RBAC Can't manage assignments in Azure Blueprints or share image galleries 2. Reader Only view Azure resources

  3. Security admin (too much)

  Box 2: Cloud Infrastructure Entitlements Management

  Note: Permissions Management allows multicloud discovery, remediation, and monitoring of privileged access across Azure, AWS, and GCP.

  Microsoft Entra Permissions Management A Cloud Infrastructure Entitlements Management (CIEM) tool (formerly CloudKnox Permissions Management) that provides visibility into all permission assigned to identities, actions, and resources

  Incorrect:

  1. Azure Credential Configuration Endpoint Service

  2. Microsoft Azure Management References:

  https://learn.microsoft.com/en-us/entra/permissions-management/onboard-azure https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

  https://learn.microsoft.com/en-us/entra/permissions-management/ https://blog.matrixpost.net/what-is-microsoft-entra-permissions-management/