Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 401:

  You have a Microsoft Entra tenant.

  You need to ensure that users can group applications in the My Apps portal.

  What should you create?

  A. Tags
  B. Collections
  C. Dynamic groups
  D. Administrative units
  B. Collections

  ---

  Explanation

  Collections are used in the My Apps portal to group related applications for better organization.

• Question 402:

  DRAG DROP

  You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3.

  You need to configure the users as shown in the following table.

  

  Which portal should you use to configure each user? To answer, drag the appropriate portals to the correct users. Each portal may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 403:

  You have a Microsoft Entra tenant.

  You configure self-service password reset (SSPR) by using the following settings:

  1. Require users to register when signing in: Yes

  2. Number of methods required to reset: 1

  What is a valid authentication method available to users?

  A. a Microsoft Teams chat
  B. a mobile app notification
  C. a mobile app code
  D. an FIDO2 security token
  C. a mobile app code

  ---

  Explanation

  Why Option C is correct:

  1. a mobile app code

  When administrators require only one method to reset a password, a verification code (such as a mobile app code) is a valid authentication method.

  2. an email to an address outside your organization

  A one-gate policy requires only one piece of authentication data, such as an email address or phone number.

  A one-gate policy applies in the following circumstances:

  - It is within the first 30 days of a trial subscription; or - A custom domain has not been configured for the Microsoft Entra tenant, and the default *.onmicrosoft.com domain is in use; and

  - Microsoft Entra Connect is not synchronizing identities.

  Why others are incorrect:

  1. a Microsoft Teams chat

  2. a mobile app notification

  3. a smart card 4. Windows Hello for Business PIN

  5. an FIDO2 security key

  Note: When administrators require two methods to reset a password, users can use either a notification or a verification code in addition to any other enabled methods.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#

• Question 404:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains the resources shown in the following table.

  

  Sub1 contains the managed identities shown in the following table.

  

  Sub1 has the role-based access control (RBAC) role assignments shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No - Automation1 can access the contents of the secrets stored in Vault1.

  Automation1 is in RG1. Vault1 is in RG1. Identity1 is assigned to Automation1. Scope of Identity1 is RG2, however.

  Box 2: Yes - Identity2 can be assigned Automation2 to gain access to the contents of the secrets stored in Vault1.

  Identity2 is assigned to Automation2. Scope of Identity2 is Sub1. Vault1 is in Sub1.

  Box 3: Yes - VM1 can access to the contents of the secrets stored in Vault1.

  VM1 is assigned Identity3.

  Scope of Identity3 is RG1. Vault1 is in RG1.

• Question 405:

  You have an on-premises app named App1.

  You have a Microsoft Entra tenant.

  You plan to publish App1 by using Microsoft Entra Private Access.

  You need to enable the Private access profile.

  Which blade should you use in the Microsoft Entra admin center?

  A. Remote networks
  B. Traffic forwarding
  C. Security profiles
  D. Connectors
  B. Traffic forwarding

  ---

  Explanation

  Enabling the Private Access profile is a crucial step in configuring Microsoft Entra Private Access, which allows secure access to on-premises applications like App1. This configuration is managed within the Traffic forwarding section of the Microsoft Entra admin center.

  1. Sign in to the Microsoft Entra admin center.

  2. Navigate to Global Secure Access.

  3. Select Connect.

  4. Click on Traffic forwarding.

  5. Enable the Private Access profile by selecting the appropriate checkbox.

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-private-access-profile

• Question 406:

  You have a Microsoft 365 ES subscription that user Microsoft Defender for Cloud Apps and Yammer.

  You need prevent users from signing in to Yammer from high-risk locations.

  What should you do in the Microsoft Defender for Cloud Apps portal?

  A. Create an access Policy.
  B. Create an activity policy.
  C. Unsanction Yammer.
  D. Create an anomaly detection policy.
  A. Create an access Policy.

• Question 407:

  HOTSPOT

  You have an Azure subscription that contains the key vaults shown in the following table.

  

  The subscription contains the users shown in the following table.

  

  On June 1, Admin4 performs the following actions:

  - Deletes a certificate named Certificate1 from KeyVault1

  - Deletes a secret named Secret1 from KeyVault2

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Yes - Key Vault Administrator can perform all data plane operations on a key vault. and purge protection is disabled for KeyVault2.

  NB: Purge protection is an optional Key Vault behavior and is not enabled by default.

  Do not mismatch with soft-delete

  No - We are still in the Purge protection remaining period.

  NB: Also the Key Vault contributor role doesn't allow to get access to certificate

  No - We are still in the Purge protection remaining period.

  Even if the Certificate Officer role allow to get access to certificate

• Question 408:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.

  You need to ensure that User1 can create new catalogs and add resources to the catalogs they own.

  What should you do?

  A. From the Roles and administrators blade, modify the Service support administrator role.
  B. From the identity Governance blade, modify the Entitlement management settings.
  C. From the Identity Governance blade, modify the roles and administrators for the General catalog
  D. From the Roles and administrators blade, modify the Groups administrator role.
  B. From the identity Governance blade, modify the Entitlement management settings.

• Question 409:

  You have a Microsoft 365 E5 subscription.

  You need to create a Microsoft Defender for Cloud Apps session policy.

  What should you do first?

  A. From the Microsoft Defender for Cloud Apps portal, select User monitoring.
  B. From the Microsoft Defender for Cloud Apps portal, select App onboarding/maintenance.
  C. From the Azure Active Directory admin center, create a Conditional Access policy.
  D. From the Microsoft Defender for Cloud Apps portal, create a continuous report.
  C. From the Azure Active Directory admin center, create a Conditional Access policy.

• Question 410:

  HOTSPOT

  You have an Azure AD tenant that contains the users shown in the following table.

  

  You have the Azure AD Identity Protection policies shown in the following table.

  

  You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.