Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 441:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 tenant.

  You have 100 IT administrators who are organized into 10 departments.

  You create the access review shown in the exhibit. (Click the Exhibit tab.)

  

  You discover that all access review requests are received by Megan Bowen.

  You need to ensure that the manager of each department receives the access reviews of their respective department.

  Solution: You add each manager as a fallback reviewer.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 442:

  HOTSPOT

  You need to create the LWGroup1 group to meet the management requirements.

  How should you complete the dynamic membership rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 443:

  Your company recently implemented Azure Active Directory (Azure AD) Privileged Identity Management (PIM).

  While you review the roles in PIM, you discover that all 15 users in the IT department at the company have permanent security administrator rights.

  You need to ensure that the IT department users only have access to the Security administrator role when required.

  What should you configure for the Security administrator role assignment?

  A. Expire eligible assignments after from the Role settings details
  B. Expire active assignments after from the Role settings details
  C. Assignment type to Active
  D. Assignment type to Eligible
  D. Assignment type to Eligible

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

• Question 444:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to prevent all users from using passwords that are variations of the word Falcon.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  

  Eliminate bad passwords using Microsoft Entra Password Protection

  Step 1: Select Authentication methods

  Step 2: Select Password Protection

  Step 3: In Custom banned passwords, Set Enforce Custom list: Yes

  Step 4: In Custom banned password list, add the word Falcon

  References:

  https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad

• Question 445:

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps and Conditional Access policies.

  You need to block access to cloud apps when a user is assessed as high risk.

  Which type of policy should you create in the Microsoft Defender for Cloud Apps portal?

  A. access policy
  B. OAuth app policy
  C. anomaly detection policy
  D. activity policy
  A. access policy

• Question 446:

  You have a Microsoft Entra tenant.

  You need to assign a role that allows a user to reset passwords for non-administrative users only.

  Which role should you assign?

  A. Security administrator
  B. Helpdesk administrator
  C. Global administrator
  D. Authentication administrator
  B. Helpdesk administrator

  ---

  Explanation

  Helpdesk administrators can reset passwords for non-admin users while following least privilege principles.

• Question 447:

  HOTSPOT

  You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains three users named User1, User2 and User3.

  You have the devices shown in the following table.

  

  You deploy a virtual machine that has the following configurations:

  Name: VM1 Resource group: RG1 Operating system: Windows Server Login with Microsoft Entra ID: Enabled

  You have the Azure role assignments shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No - User1 can sign in to VM1 from Device1 by using their Microsoft Entra credentials.

  User1 has the Virtual Machine Local User Login role with scope RG1. The role is not correct. The Virtual Machine User Login role would be correct.

  Box 2: Yes - User2 can sign in to VM1 from Device2 by using their Microsoft Entra credentials.

  User2 has the correct role: the Virtual Machine User Login role. The device is Windows 11, which is supported. The device does not have to be Microsoft Entra joined or Microsoft Entra registered.

  Box 3: No - User3 can sign in to VM1 from Device3 by using their Microsoft Entra credentials.

  Not possible from an Android device.

  Note:

  Enable Microsoft Entra login for a Windows VM in Azure. To use Microsoft Entra login for a Windows VM in Azure, you must: Enable the Microsoft Entra login option for the VM. [Assume this has been configured]

  Configure Azure role assignments for users who are authorized to sign in to the VM.

  Virtual Machine Administrator Login: Users with administrator privileges who have this role assigned can sign in to an Azure virtual machine.

  Virtual Machine User Login: Users with regular user privileges who have this role assigned can sign in to an Azure virtual machine.

  Log in by using Microsoft Entra credentials to a Windows VM. You can sign in over RDP using one of two methods: Passwordless using supported Microsoft Entra credentials (recommended)

  Password or limited passwordless using Windows Hello for Business deployed using the certificate trust model

  To use passwordless authentication for your Windows VMs in Azure, the Windows client machine and the session host (VM) must run supported operating systems: Windows 10

  Windows 11

  Windows Server 2022 References:

  https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-ad-joined-session-hosts

• Question 448:

  You create a conditional access policy that blocks access when a user triggers a high-severity sign-in alert.

  You need to test the policy under the following conditions:

  1. A user signs in from another country.

  2. A user triggers a sign-in risk.

  What should you use to complete the test?

  A. the Conditional Access What If tool
  B. Microsoft Entra sign-ins logs
  C. Microsoft Defender for Cloud Apps activity logs
  D. Microsoft Entra Access Reviews
  A. the Conditional Access What If tool

  ---

  Explanation

  The Azure AD conditional access.

  What if tool allows you to understand the impact of your conditional access policies on your environment. Instead of test driving your policies by performing multiple sign-ins manually, this tool enables you to evaluate a simulated sign-in of a user. The simulation estimates the impact this sign-in has on your policies and generates a simulation report. The report does not only list the applied conditional access policies but also classic policies if they exist.

  References:

  https://azure.microsoft.com/en-us/updates/azure-ad-conditional-access-what-if-tool-is-now-available

• Question 449:

  Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

  

  All the users work remotely.

  Azure AD Connect is configured in Azure AD as shown in the following exhibit.

  

  Connectivity from the on-premises domain to the internet is lost.

  Which users can sign in to Azure AD?

  A. User1 and User3 only
  B. User1 only
  C. User1, User2, and User3
  D. User1 and User2 only
  A. User1 and User3 only

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations

• Question 450:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.

  User1 has the devices shown in the following table.

  

  On November 5, 2020, you create and enforce terms of use in contoso.com that has the following settings:

  Name: Terms1

  Display name: Contoso terms of use Require users to expand the terms of use: On Require users to consent on every device: On Expire consents: On Expire starting on: December 10, 2020 Frequency: Monthly

  On November 15, 2020, User1 accepts Terms1 on Device3.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.