Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 421:

  You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs.

  Yon receive more than 100 email alerts each day for tailed Azure Al) user sign-in attempts.

  You need to ensure that a new security administrator receives the alerts instead of you.

  Solution: From Azure monitor, you create a data collection rule.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 422:

  You have a Microsoft Entra tenant.

  You need to allow users to request access to enterprise applications.

  What should you configure?

  A. Application proxy
  B. Self-service access
  C. Conditional Access
  D. Admin consent workflow
  B. Self-service access

  ---

  Explanation

  Self-service access allows users to request access to applications. Administrators can approve or deny these requests.

• Question 423:

  HOTSPOT

  You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains the identities shown in the following table.

  

  The tenant is onboarded to Permissions Management.

  You create the Azure resources shown in the following table.

  

  From Microsoft Entra Insights, which identity will be included in Accounts assigned to highly privileged roles, and which identity will be included in Service principals with privileged role assignments?

  

  

  ---

  Box 1: Accounts assigned to highly privileged roles: Group1

  The most critical built-in roles in Azure AD are Global Administrator and Privileged Role Administrator, because users assigned to these two roles can delegate administrator roles.

  Box 2: Service principals with privileged role assignments: SPrincipal1 SPrincipal1 is a service principal.

  Security Operator This is a privileged role. Users with this role can manage alerts and have global read-only access on security-related features, including all information in Microsoft 365 Defender portal, Microsoft Entra ID Protection, Privileged Identity Management and Microsoft Purview compliance portal.

  References:

  https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access

  https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#security-operator

• Question 424:

  You have an on-premises app named App1 and a Microsoft Entra tenant.

  You plan to publish App1 using Microsoft Entra Private Access.

  You need to enable the Private Access profile.

  Which blade should you use in the Microsoft Entra admin center?

  A. Remote networks
  B. Traffic forwarding
  C. Security profiles
  D. Connectors
  B. Traffic forwarding

• Question 425:

  You have a Microsoft Entra tenant.

  You need to ensure that sign-in logs are available in Azure Monitor.

  What should you configure first?

  A. Log Analytics workspace
  B. Diagnostic settings
  C. Conditional Access
  D. Access reviews
  B. Diagnostic settings

  ---

  Explanation

  Diagnostic settings must be configured to send Azure AD logs to Azure Monitor.

• Question 426:

  HOTSPOT

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company has a business partner named Fabrikam, Inc.

  Fabrikam uses Azure AD and has two verified domain names of fabrikam.com and litwareinc.com. Both domain names are used for Fabrikam email addresses.

  You plan to create an access package named package1 that will be accessible only to the users at Fabrikam.

  You create a connected organization for Fabrikam.

  You need to ensure that the package1 will be accessible only to users who have fabrikam.com email addresses.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 427:

  You configure a new Microsoft 36S tenant to use a default domain name of contosso.com.

  You need to ensure that you can control access to Microsoft 365 resource-, by using conditional access policy.

  What should you do first?

  A. Disable the User consent settings.
  B. Disable Security defaults.
  C. Configure a multi-factor authentication (Ml A) registration policy1.
  D. Configure password protection for Windows Server Active Directory.
  B. Disable Security defaults.

• Question 428:

  DRAG DROP

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server and hosts a shared folder named Share1. The domain contains 500 devices that run Windows 11.

  You have a Microsoft 365 E5 subscription that syncs with the domain.

  From Global Secure Access, you enable the Private access profile and deploy the Global Secure Access client to all the devices.

  You need to ensure that the devices can connect to Share1 remotely by using Global Secure Access.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  How to configure per-app access using Global Secure Access applications

  Microsoft Entra Private Access provides secure access to your organization's internal resources. You create a Global Secure Access application and specify the internal private resources that you want to secure. By configuring a Global Secure Access application, you're creating per-app access to your internal resources. A Global Secure Access application provides a more detailed ability to manage how the resources are accessed on a per-app basis.

  High-level steps

  Per-app access is configured by creating a new Global Secure Access app. You create the app [Step 2], select a connector group [created in Step 1], and add application segments [Step 3]. These settings make up the individual app that you can assign users and groups to.

  Step 1: Install a connector on Server1. The overall process is as follows:

  Create a connector group with at least one active private network connector. If you already have a connector group, make sure you're using the latest version.

  To configure a Global Secure Access app, you must have a connector group with at least one active private network connector.

  Step 2: Create an enterprise application.

  Create a Global Secure Access app through the service. You can complete all three steps at the same time, or you can add them after the initial setup is complete.

  Create a Global Secure Access application

  To create a new app, you provide a name, select a connector group, and then add application segments. App segments include the fully qualified domain names (FQDNs) and IP addresses that you want to tunnel.

  Step 3: Create an application segment.

  Add an application segment

  The Add application segment process is where you define the FQDNs and IP addresses that you want to include in the traffic for the Global Secure Access app. You can add sites when you create the app and return later to add more or edit them.

  Assign users and groups to the app.

  Configure Conditional Access policies.

  Enable Microsoft Entra Private Access.

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-per-app-access

• Question 429:

  You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.

  You need to ensure that users can request access to Site1. The solution must meet the following requirements:

  1. Automatically approve requests from users based on their group membership.

  2. Automatically remove the access after 30 days

  What should you do?

  A. Create a Conditional Access policy.
  B. Create an access package.
  C. Configure Role settings in Microsoft Entra Privileged Identity Management.
  D. Create a Microsoft Defender for Cloud Apps access policy.
  B. Create an access package.

  ---

  Explanation

  An access package enables you to do a one-time setup of resources and policies that automatically administers access for the life of the access package.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-create

• Question 430:

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.

  You plan to increase app security for the subscription.

  You need to identify which apps do NOT require user authentication.

  What should you do in the Microsoft 365 Defender portal?

  A. Review the cloud app catalog.
  B. Create an OAuth policy and review alerts.
  C. Create a snapshot Cloud Discovery report.
  D. Create a discovered app query.
  A. Review the cloud app catalog.