Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 411:

  You have a Microsoft Entra tenant.

  You configure self-service password reset (SSPR) by using the following settings:

  Require users to register when signing in: Yes Number of methods required to reset: 1

  What is a valid authentication method available to users?

  A. a Windows Hello PIN
  B. a smartcard
  C. a mobile app notification
  D. an email to an address outside your organization
  C. a mobile app notification

  ---

  Explanation

  Azure AD SSPR lets users verify their identity using the Microsoft Authenticator app's push notification. Users simply approve a notification on their registered device to prove ownership and reset their password.

• Question 412:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to ensure that all users can consent to apps that require permission to read their user profile. Users must be prevented from consenting to apps that require any other permissions.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  

  Plan:

  Part 1: Configure permission classifications Part 2: Configure user consent settings

  Part 1: Configure permission classifications

  Follow these steps to classify permissions by using the Microsoft Entra admin center:

  Step 1: Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  Step 2: Navigate to Identity > Applications > Enterprise applications > Consent and permissions > Permission classifications.

  Step 3: Select Add permissions to classify another permission.

  Step 4: Select Microsoft Graph as the API, and then select the delegated permission.

  Step 5: Select User.Read (Sign in and read user profile).

  Step 6: Assign the classification Low.

  Step 7: Select Add permissions to save.

  Part 2: Configure user consent settings

  To configure user consent settings by using the Microsoft Entra admin center:

  Step 1: Sign in to the Microsoft Entra admin center as a Global Administrator.

  Step 2: Navigate to Identity > Applications > Enterprise applications > Consent and permissions > User consent settings.

  Step 3: Under User consent for applications, select Allow user consent for apps from verified publishers, for selected permissions (Recommended).

  Step 4: Select Save.

  Note:

  Permission classifications enable you to categorize delegated permissions based on risk levels defined by your organization. These classifications can be used in consent policies to control which permissions users are allowed to grant.

  Supported permission classifications are Low, Medium (preview), and High (preview). Only delegated permissions that do not require admin consent can be classified.

  The minimum permissions required for basic sign-in are openid, profile, email, offline_access, and User.Read. These are Microsoft Graph delegated permissions that allow an application to sign in users and read basic profile information, and optionally maintain access when the user is offline.

  References:

  https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent

  https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-permission-classifications

• Question 413:

  You have an Azure Active Directory (Azure AD) tenant.

  You need to review the Azure AD sign-in logs to investigate sign-ins that occurred in the past.

  For how long does Azure AD store events in the sign-in logs?

  A. 14 days
  B. 30 days
  C. 90 days
  D. 365 days
  B. 30 days

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-reports-dataretention#how-long-does-azure-ad-store-the-data

• Question 414:

  You have a Microsoft 365 subscription that is onboarded to Microsoft Entra Permissions Management.

  You need to identify managed identities that are assigned permissions and remove any permissions that have been unused for 90 days. The solution must minimize administrative effort.

  What should you do in the Entra Permissions Management portal?

  A. Configure an Autopilot rule.
  B. Schedule a Permissions analytics report.
  C. From Microsoft Entra Insights, review Service principals with privileged role assignments.
  D. Run an audit query.
  B. Schedule a Permissions analytics report.

  ---

  Explanation

  Autopilot rules in Microsoft Entra Permissions Management allow you to automatically right-size permissions by identifying unused permissions and removing them based on defined conditions, such as inactivity over a specified period (for example, 90 days). This minimizes administrative effort by automating remediation.

  Incorrect:

  Option B: Schedule a Permissions analytics report Permissions analytics reports help identify inactive identities and unused permissions, but they only provide insights and do not automatically remove permissions.

  Option C: From Microsoft Entra Insights, review service principals with privileged role assignments.

  This provides visibility into privileged assignments but does not automate identification and removal of unused permissions.

  Option D: Run an audit query Audit queries provide analysis and visibility but require manual action to remove permissions.

  References:

  https://learn.microsoft.com/en-us/entra/permissions-management/product-permissions-analytics-reports

• Question 415:

  HOTSPOT

  You need to implement password restrictions to meet the authentication requirements.

  You install the Azure AD password Protection DC agent on DC1.

  What should you do next? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 416:

  You have a Microsoft Entra tenant.

  You plan to enforce a custom terms of use (ToU) for all users accessing cloud applications.

  You need to ensure that users must accept the ToU before gaining access.

  Which component should you configure?

  A. Authentication methods policy
  B. Conditional Access policy
  C. Identity Protection policy
  D. Access review
  B. Conditional Access policy

  ---

  Explanation

  Conditional Access policies can enforce Terms of Use. By configuring a Conditional Access policy with a grant control that requires acceptance of ToU, users must accept the terms before accessing resources.

• Question 417:

  You have an Azure Active Directory (Azure AD) tenant that uses conditional access policies.

  You plan to use third-party security information and event management (SIEM) to analyze conditional access usage.

  You need to download the Azure AD log that contains conditional access policy data.

  What should you export from Azure AD?

  A. sign-ins in JSON format
  B. sign-ins in CSV format
  C. audit logs in JSON format
  D. audit logs in CSV format
  C. audit logs in JSON format

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs

• Question 418:

  HOTSPOT

  You have a Microsoft 365 tenant.

  You need to identify users who have leaked credentials. The solution must meet the following requirements.

  1. Identity sign-Ins by users who ate suspected of having leaked credentials.

  2. Rag the sign-ins as a high risk event.

  3. Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.

  What should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 419:

  You have a Microsoft Entra tenant that contains the users shown in the following table.

  

  You add an enterprise application named App1 to Microsoft Entra ID and set User1 as the owner of App1. App1 requires admin consent to access Microsoft Entra ID before the app can be used.

  You configure the Admin consent requests settings as shown in the following exhibit.

  

  Admin1, Admin2, Admin3, and User' are added as reviewers.

  Which users can review and approve the admin consent requests?

  A. Admin1 only
  B. Admin1, Admin2 and Admin3 only
  C. Admin1, Admin2, and User1 only
  D. Admin1 and Admin2 only
  E. Admin1, Admin2, Admin3, and User1
  D. Admin1 and Admin2 only

• Question 420:

  HOTSPOT

  You have an Azure subscription.

  You need to create two custom roles named Role1 and Role2. The solution must meet the following requirements:

  1. Users that are assigned Role1 can create or delete instances of Azure Container Apps.

  2. Users that are assigned Role2 can enforce adaptive network hardening rules.

  Which resource provider permissions are required for each role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Role1: Microsoft.App

  https://learn.microsoft.com/en-us/azure/container-apps/quickstart-portal#prerequisitesRole2:Microsoft.Security

  https://learn.microsoft.com/en-ie/rest/api/defenderforcloud/adaptive-network-hardenings/enforce?tabs=HTTP