Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 431:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  You create an access review for Azure Active Directory (Azure AD) roles.

  You need to ensure that users who do not respond to review requests are removed automatically from the roles. The solution must minimize administrative effort.

  Which two settings should you modify? To answer, select the settings in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1:

  Reviewers: Members (self) Reviewers can be:

  Specified reviewers: Certain users within your organization Group owners: Microsoft 365 group owners (including Teams)

  Self-review: Users review their own access

  Box 2: If reviewers don't respond: No change

  If reviewers don't respond (within the configured review period):

  No change: Leave user's access unchanged

  Remove access: Remove user's access

  Approve access: Approve user's access

  Take recommendations: Take the system's recommendation on denying or approving the user's continued access

  References:

  https://blog.quadrotech-it.com/blog/how-to-manage-guest-access-in-azure-active-directory-pt-1/

• Question 432:

  You have a Microsoft 365 tenant.

  You have an Active Directory domain that syncs to the Microsoft Entra tenant.

  Users connect to the internet by using a hardware firewall at your company. The users authenticate to the firewall by using their Active Directory credentials.

  You plan to manage access to external applications by using Microsoft Entra ID.

  You need to use the firewall logs to create a list of unmanaged external applications and the users who access them.

  What should you use to gather the information?

  A. Application Insights in Azure Monitor
  B. access reviews in Microsoft Entra ID
  C. Cloud App Discovery in Microsoft Defender for Cloud Apps
  D. enterprise applications in Microsoft Entra ID
  C. Cloud App Discovery in Microsoft Defender for Cloud Apps

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/cloud-app-security/create-snapshot-cloud-discovery-reports#using-traffic-logs-for-cloud-discovery

• Question 433:

  You have an Azure AD tenant.

  You discover that a large number of new apps were added to the tenant.

  You need to implement an approval process for new enterprise applications.

  What should you do?

  A. From the Microsoft Defender for Cloud Apps portal, create a Cloud Discovery anomaly detection policy.
  B. From the Microsoft Entra admin center, configure the Admin consent settings.
  C. From the Microsoft Defender for Cloud Apps portal, configure an app connector.
  D. From the Microsoft Entra admin center, configure an access review.
  B. From the Microsoft Entra admin center, configure the Admin consent settings.

  ---

  Explanation

  Configure the admin consent workflow

  The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval.

  The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.

  Enable the admin consent workflow

  To enable the admin consent workflow and choose reviewers:

  Sign in to the Microsoft Entra admin center as as a Global Administrator.

  Browse to Identity > Applications > Enterprise applications > Consent and permissions > Admin consent settings.

  Under Admin consent requests, select Yes for Users can request admin consent to apps they are unable to consent to .

  Etc.

  Note: Access and consent

  You can manage user consent settings to choose whether users can allow an application or service to access user profiles and organizational data. When applications are granted access, users can sign in to applications integrated with Azure AD, and the application can access your organization's data to deliver rich data-driven experiences.

  In situations where users are unable to consent to the permissions an application is requesting, consider configuring the admin consent workflow. The workflow allows users to provide a justification and request an administrator's review and approval of an application.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow

• Question 434:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD and contains the users shown in the following table.

  

  In Azure AD Connect, Domain/OU Filtering is configured as shown in the following exhibit.

  

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 435:

  You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

  From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.

  You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

  What should you use?

  A. the Set-WindowsProductKey cmdlet
  B. the Update-MgGroup cmdlet
  C. the Set-MgUserLicense cmdlet
  D. the Update-MgUser cmdlet
  C. the Set-MgUserLicense cmdlet

• Question 436:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to ensure that users in the sg-Legal group must reauthenticate every 12 hours when they access any cloud apps managed by the tenant.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  

  Microsoft Entra ID - Conditional Access - Configure sign-in frequency (session control)

  Sign-in frequency control

  Step 1: Sign in to the Microsoft Entra admin center as a Conditional Access Administrator.

  Step 2: Navigate to Protection > Conditional Access.

  Step 3: Select New policy.

  Step 4: Enter a name for the policy.

  Step 5: Under Assignments, select Users or workload identities, and then select the sg-Legal group.

  Step 6: Under Assignments, select Target resources, choose Cloud apps, and then select All cloud apps.

  Step 7: Under Access controls, select Session.

  Step 8: Select Sign-in frequency.

  Step 9: Select Periodic reauthentication, set Value to 12, and set Unit to Hours.

  Step 10: Select Select.

  Step 11: Set Enable policy to On, and then select Create.

  References:

  https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

• Question 437:

  You have a Microsoft 365 E5 subscription.

  You need to ensure that users are prompted to accept a custom terms of use (ToU) agreement when they sign in to the subscription.

  What should you configure?

  A. an access package
  B. a Conditional Access policy
  C. a lifecycle workflow
  D. an authentication method
  B. a Conditional Access policy

• Question 438:

  You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a registered app named App1.

  You have a partner organization that has a Microsoft Entra tenant. The tenant contains a registered app named App2.

  You need to ensure that App1 can access App2.

  Which two types of credentials can App1 use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. certificate
  B. managed identity
  C. secret
  D. user account
  E. one-time password
  A. certificate
  C. secret

• Question 439:

  HOTSPOT

  You need to meet the technical requirements for license management by the helpdesk administrators.

  What should you create first, and which tool should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units

  https://docs.microsoft.com/en-us/azure/active-directory/roles/admin-units-manage

• Question 440:

  You configure a new Microsoft 365 tenant to use a default domain name of contoso.com.

  You need to ensure that you can control access to Microsoft 365 resources by using conditional access policies.

  What should you do first?

  A. Disable the User consent settings.
  B. Disable Security defaults.
  C. Configure a multi-factor authentication (MFA) registration policy.
  D. Configure password protection for Windows Server Active Directory.
  B. Disable Security defaults.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults