Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 31:

  You have an Azure subscription that contains an Azure Automation account named Automation1 and an Azure key vault named Vault1. Vault1 contains a secret named Secret1.

  You enable a system-assigned managed identity for Automation1.

  You need to ensure that Automation1 can read the contents of Secret1. The solution must meet the following requirements:

  1. Prevent Automation1 from accessing other secrets stored in Vault1.

  2. Follow the principle of least privilege.

  What should you do?

  A. From Vault1, configure the Access control (IAM) settings.
  B. From Automation1, configure the Identity settings.
  C. From Automation1, configure the Run as accounts settings.
  D. From Secret1, configure the Access control (IAM) settings.
  D. From Secret1, configure the Access control (IAM) settings.

  ---

  Explanation

  References:

  https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide

• Question 32:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2. The subscription contains the users shown in the following table.

  

  You create the following Conditional Access policies:

  - Name: Policy1

  - Users:

  o Include: Group1

  o Exclude: Group2

  - Target resources:

  o Include: All cloud apps

  - Grant:

  o Grant access: Require multi-factor authentication

  - Session:

  o Persistent browser session: Never persistent

  - Name: Policy2

  - Users:

  o Include:

  - Directory roles: Global Administrator

  - Users and groups: User3

  o Exclude: Group2

  - Target resources:

  o Include: All cloud apps

  - Session:

  o Sign-in frequency:

  - Periodic authentication: 2 hours

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes - User1 will be prompted for the Stay signed in option when they sign in to the Microsoft 365 portal.

  User1 is member of Group1. Policy1 includes Group1. Poliyc1 has Persistent browser session: Never persistent.

  Note: Think of the sign-in frequency as controlling the lifetime of the refresh token. Persistent session allows the browser to store the refresh token (which is usually kept in memory only), so it can be reused after you close/reopen all browser windows.

  Persistent Browser Session configuration in Microsoft Entra Conditional Access overrides the "Stay signed in?" setting in the company branding pane for the same user if you have configured both policies.

  Box 2: No - User2 must reauthenticate to Microsoft 365 Apps every two hours.

  Policy2 has Session Sign-in frequency: Periodic authentication: 2 hours User2 is Global administrator. Policy2 includes Global administrator. User2 is member of Group2. Policy2 excludes Group2. The exclusion overrides inclusion.

  Note: Exclude users.

  When organizations both include and exclude a user or group, the user or group is excluded from the policy. The exclude action overrides the include action in policy.

  Box 3: No - User3 must reauthenticate to Microsoft 365 Apps every two hours.

  User3 is includes in Policy2. User3 is member of Group2 (and Group1). Group2 is excluded from Policy2.

  The exclusion overrides inclusion.

  References:

  https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

  https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups

  https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion

• Question 33:

  You have a management group named Group1 that contains two Azure subscriptions named Sub1 and Sub2. The subscriptions are linked to a Microsoft Entra tenant that contains a user named User1.

  You need to ensure that User1 can onboard Sub1 to Permissions Management. The solution must follow the principle of least privilege.

  Which permission should you grant to User1?

  A. Microsoft.Authorization/roleAssignments/read for Sub1
  B. Microsoft.Authorization/roleAssignments/write for Group1
  C. MicrosoftAuthorization/roleAssignments/write for Sub1
  D. Microsoft.Authorization/roleAssignments/read for Group1
  C. MicrosoftAuthorization/roleAssignments/write for Sub1

  ---

  Explanation

  Granting User1 the Microsoft.Authorization/roleAssignments/write permission at the Sub1 subscription level enables them to assign roles and permissions required during the onboarding process. This approach adheres to the principle of least privilege by providing the minimum necessary permissions at the specific scope needed.

  References:

  https://learn.microsoft.com/en-us/entra/permissions-management/onboard-azure

• Question 34:

  You have a Microsoft Entra tenant.

  You need to configure continuous access evaluation for app sign-ins and assign the configuration to users that are assigned the Application Administrator role.

  What should you configure?

  A. a sign-in risk policy
  B. an access review
  C. a Conditional Access policy
  D. the Admin consent settings
  C. a Conditional Access policy

• Question 35:

  HOTSPOT

  You have a Microsoft 365 tenant and an Active Directory domain named adatum.com.

  You deploy Azure AD Connect by using the Express Settings.

  You need to configure self-service password reset (SSPR) to meet the following requirements:

  1. When users reset their password, they must be prompted to respond to a mobile app notification or answer three predefined security questions.

  2. Passwords must be synced between the tenant and the domain regardless of where the password was reset.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions

• Question 36:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You need to ensure that Azure AD External Identities pricing is based on monthly active users (MAU).

  What should you configure?

  A. an access review
  B. the terms or use
  C. a linked subscription
  D. a user flow
  C. a linked subscription

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/external-identities/external-identities-pricing

• Question 37:

  You have an Azure Active Directory (Azure AD) tenant that contains the groups shown in the following table.

  

  For which groups can you create an access review?

  A. Group1 only
  B. Group1 and Group4 only
  C. Group1 and Group2 only
  D. Group1, Group2, Group4, and Group5 only
  E. Group1, Group2, Group3, Group4 and Group5
  D. Group1, Group2, Group4, and Group5 only

  ---

  Explanation

  You cannot create access reviews for device groups.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 38:

  HOTSPOT

  You have a Microsoft 36S tenant.

  You create a named location named HighRiskCountries that contains a list of high-risk countries.

  You need to limit the amount of time a user can stay authenticated when connecting from a high-risk country.

  What should you configure in a conditional access policy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 39:

  You have a Microsoft Exchange organization that uses an SMTP' address space of contoso.com.

  Several users use their contoso.com email address for self-service sign up to Azure Active Directory (Azure AD).

  You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.

  You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.

  Which PowerShell cmdlet should you run?

  A. Set-MsolCompanySettings
  B. Set-MsolDomainFederationSettings
  C. Update-MsolfederatedDomain
  D. Set-MsolDomain
  A. Set-MsolCompanySettings

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-self-service-signup

• Question 40:

  DRAG DROP

  Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect.

  Attire AD Connect is installed on a server named Server 1.

  You deploy a new server named Server? that runs Windows Server 2019.

  You need to implement a failover server for Azure AD Connect. The solution must minimize how long it takes to fail over if Server1 fails.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place: