Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 351:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that has multi-factor authentication (MFA) enabled.

  The account lockout settings are configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

• Question 352:

  You have a Microsoft Entra tenant with Microsoft Defender for Cloud Apps.

  You need to detect when a user downloads an unusually large number of files.

  Which policy type should you create?

  A. Access policy
  B. Activity policy
  C. File policy
  D. Session policy
  B. Activity policy

  ---

  Explanation

  Activity policies monitor user activities such as downloads and uploads. They are used to detect abnormal behaviors like excessive file downloads.

• Question 353:

  Your company purchases a Microsoft 365 E5 subscription.

  A user named User1 is assigned the Security Administrator role.

  You need to ensure that User1 can create Microsoft Defender for Cloud Apps session policies.

  What should you do first?

  A. Create a Conditional Access policy and select Require app protection policy.
  B. Create a Conditional Access policy and select Use Conditional Access App Control.
  C. Assign the Cloud Application Administrator role to User1.
  D. Assign the Cloud App Security Administrator role to User1.
  D. Assign the Cloud App Security Administrator role to User1.

  ---

  Explanation

  To create Microsoft Defender for Cloud Apps session policies, the user must have the appropriate permissions within Defender for Cloud Apps. The Security Administrator role does not provide sufficient permissions to create session policies.

  The Cloud App Security Administrator role grants full permissions in Microsoft Defender for Cloud Apps, including the ability to create and manage session policies.

  Prerequisites to using session policies:

  Before you start, make sure that you have the following prerequisites: A Defender for Cloud Apps license (stand-alone or part of another license)

  A license for Microsoft Entra ID Premium P1 (as a stand-alone license or included in an E5 license), or the license required by your identity provider (IdP) solution.

  The relevant apps should be deployed with Conditional Access App Control Make sure you've configured your IdP solution to work with Defender for Cloud Apps

  Incorrect:

  Option A: Require app protection policy is used for Microsoft Intune app protection, not Defender for Cloud Apps session policies.

  Option B: Use Conditional Access App Control is required to route sessions to Defender for Cloud Apps, but it does not grant the permissions needed to create session policies.

  Option C: Cloud Application Administrator can manage enterprise applications and app registrations, but does not have permissions in Defender for Cloud Apps.

  Note:

  Security Administrator

  Can read security information and reports, and manage configuration in Microsoft Entra ID and Microsoft 365, but does not have full permissions in Defender for Cloud Apps.

  Cloud App Security Administrator

  Users with this role have full permissions in Microsoft Defender for Cloud Apps. They can add administrators, create and manage policies (including session policies), upload logs, and perform governance actions.

• Question 354:

  SIMULATION

  You need to create a group named Audit. The solution must ensure that the members of Audit can activate the Security Reader role.

  A. See the Explanation Below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the Explanation Below

  ---

  Explanation

  To create a group named "Audit" and ensure that its members can activate the Security Reader role, follow these steps:

  1. Open the Microsoft Entra admin center:

  2. uk.co.certification.simulator.questionpool.PList@4c9ee6f3

  3. Navigate to Groups:

  4. Create the security group:

  5. Edit settings:

  6. Assign roles:

  7. Review and finish:

  By following these steps, you will have created the "Audit" group and enabled its members to activate the Security Reader role, which allows them to view security-related information without having permissions to change it. Remember to communicate the new group and role assignment to the relevant stakeholders in your organization.

• Question 355:

  You have a Microsoft Entra tenant.

  You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by using a phishing-resistant multi-factor authentication (MFA) method.

  Which three authentication methods should you include in the solution?

  Each correct answer presents a complete solution.

  A. Windows Hello for Business
  B. an FID02 security key
  C. certificate-based authentication (multi-factor)
  D. voice call
  E. SMS
  F. email OTP
  G. certificate-based authentication (single-factor)
  H. Microsoft Authenticator
  A. Windows Hello for Business
  B. an FID02 security key
  C. certificate-based authentication (multi-factor)

• Question 356:

  You have a Microsoft Entra tenant that contains three users named User1, User2, and User3.

  You need to configure just-in-time (JIT) access to admin roles by using Privileged Identity Management (PIM). The solution must meet the following requirements:

  1. Ensure that User1 can use the User Administrator role without approval.

  2. Ensure that User2 can use the User Administrator role once User3 has approved the role request of User2.

  What should you create first?

  A. role assignments
  B. administrative units
  C. security groups
  D. Conditional Access policies
  A. role assignments

  ---

  Explanation

  To configure just-in-time (JIT) access by using PIM, you must first create role assignments for the User Administrator role.

  Assign User1 and User2 as eligible members of the role. Then configure role settings:

  For User1: configure activation without requiring approval.

  For User2: configure activation to require approval and specify User3 as the approver.

  PIM role assignments are required before configuring activation settings such as approval requirements.

  Incorrect:

  Option B: Administrative units

  Used to scope administrative permissions, not to configure JIT access.

  Option C: Security groups

  Optional when using Privileged Access Groups, but not required to configure JIT role activation.

  Option D: Conditional Access policies

  Used for sign-in conditions, not for PIM role activation workflows.

  References:

  https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

• Question 357:

  HOTSPOT

  You have an Azure AD tenant.

  You need to configure the following External Identities features:

  1. B2B collaboration

  2. Monthly active users (MAU)-based pricing

  Which two settings should you configure? To answer, select the settings in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: External collaboration settings

  B2B collaboration

  Configure external collaboration settings Configure settings in the portal 1. Sign in to the Microsoft Entra admin center as at least a External Identity Provider administrator.

  2. Browse to Identity > External Identities > External collaboration settings.

  3. Under Guest user access, choose the level of access you want guest users to have 4. Under Guest invite settings, choose the appropriate settings

  5. Etc.

  Box 2: Linked Subscriptions

  Monthly active users (MAU)-based pricing

  Link your Microsoft Entra tenant to a subscription (see step 4 below)

  A Microsoft Entra tenant must be linked to a resource group within an Azure subscription for proper billing and access to features.

  1. Sign in to the Microsoft Entra admin center with an account that's been assigned at least the Contributor role within the subscription or a resource group within the subscription.

  2. Select the directory you want to link: In the Microsoft Entra admin center toolbar, select the Directories + subscriptions icon in the portal toolbar. Then on the Portal settings | Directories + subscriptions page, find your directory in the Directory name list, and then select Switch.

  3. Browse to Identity > External identities > Overview.

  4. Under Subscriptions, select Linked subscriptions.

  In the tenant list, select the checkbox next to the tenant, and then select Link subscription.

  Note: About monthly active users (MAU) billing

  In your Microsoft Entra tenant, guest user collaboration usage is billed based on the count of unique guest users with authentication activity within a calendar month. This model replaces the 1:5 ratio billing model, which allowed up to five guest users for each Microsoft Entra ID P1 or P2 license in your tenant. When your tenant is linked to a subscription and you use External Identities features to collaborate with guest users, you'll be automatically billed using the MAU-based billing model.

  Your first 50,000 MAUs per month are free for both Premium P1 and Premium P2 features. To determine the total number of MAUs, we combine MAUs from all your tenants (both External ID and Azure AD B2C) that are linked to the same

  *subscription*.

  References:

  https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

• Question 358:

  You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest. The tenant-uses through authentication.

  A corporate security policy states the following:

  Domain controllers must never communicate directly to the internet. Only required software must be-installed on servers. The Active Directory domain contains the on-premises servers shown in the following table.

  

  You need to ensure that users can authenticate to Azure AD if a server fails.

  On which server should you install an additional pass-through authentication agent?

  A. Server2
  B. Server4
  C. Server1
  D. Server3
  B. Server4

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start

• Question 359:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant: that contains the users shown in the following table.

  

  In Azure. AD Identity Protection, you configure a user risk policy that has the following settings: Assignments:

  - Users: Group1

  - User risk: Low and above

  Controls:

  - Access: Block access

  Enforce policy: On

  In Azure AD Identify Protection, you configure a sign-in risk policy that has the following settings: Assignments:

  - Users: Group2

  - Sign-in risk: Low and above

  Controls:

  - Access: Require multi-factor authentication

  Enforce policy: On

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 360:

  You have an Azure Active Directory (Azure AD) tenant.

  You need to review the Azure AD sign-ins log to investigate sign ins that occurred in the past.

  For how long does Azure AD store events in the sign-in log?

  A. 14 days
  B. 30 days
  C. 90 days
  D. 365 days
  B. 30 days