Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 41:

  You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

  From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.

  You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

  What should you use?

  A. the Identity Governance blade in the Azure Active Directory admin center
  B. the Set-AzureAdUser cmdlet
  C. the Licenses blade in the Azure Active Directory admin center
  D. the Set-WindowsProductKey cmdlet
  C. the Licenses blade in the Azure Active Directory admin center

  ---

  Explanation

  You can unassign licenses from users on either the Active users page, or on the Licenses page. The method you use depends on whether you want to unassign product licenses from specific users or unassign users licenses from a specific product.

  Note:

  There are several versions of this question in the exam. The question has two possible correct answers:

  1. the Licenses blade in the Azure Active Directory admin center

  2. the Set-MsolUserLicense cmdlet

  Other incorrect answer options you may see on the exam include the following:

  1. the Administrative units blade in the Azure Active Directory admin center 2. the Groups blade in the Azure Active Directory admin center

  3. the Set-AzureAdGroup cmdlet

  References:

  https://docs.microsoft.com/en-us/microsoft-365/admin/manage/remove-licenses-from-users?view=o365-worldwide

• Question 42:

  You need to implement the planned changes for Package!.

  Which users can create and manage the access review?

  A. User3 only
  B. User4 only
  C. User5 only
  D. User3 and User4
  E. User3 and User5
  F. User4and User5
  C. User5 only

• Question 43:

  HOTSPOT

  You need to meet the technical requirements for the probability that user identities were compromised.

  What should the users do first, and what should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

• Question 44:

  You need to meet the planned changes and technical requirements for App1.

  What should you implement?

  A. a policy set in Microsoft Intune
  B. Microsoft Entra Application Proxy
  C. an app configuration policy in Microsoft Intune
  D. an app registration in Microsoft Entra ID
  D. an app registration in Microsoft Entra ID

  ---

  Explanation

  Planned Changes:

  Implement a custom line-of-business Azure web app named App1. App1 will be accessible from the internet and authenticated by using Microsoft Entra ID accounts. Contoso identifies the following technical requirements: App1 must have a redirect URI set to

  https://contoso.com/auth-response.ToenableauthenticationusingMicrosoftEntraIDandtoconfigurearedirectURI,youmustcreateanappregistrationinMicrosoftEntraID.TheredirectURIisarequiredsettingintheappregistrationandisusedduringtheOAuth2.0/OpenIDConnectauthenticationflow.Theprovidedreferencesectionaboutconfiguringnativeclientapplicationsisnotdirectlyrelevanttothisrequirement.ItdescribeshowtoallowclientapplicationstoaccessAPIs,whichisunnecessarywhentherequirementisonlytoauthenticateuserstoawebapplication.Correctimplementationsteps:

  1. Go to Microsoft Entra ID.

  2. Select App registrations > New registration.

  3. Enter a name for App1.

  4. Under Redirect URI, select Web and enter

  https://contoso.com/auth-response.

  5. Complete the registration.

  Answer: D. an app registration in Microsoft Entra ID

• Question 45:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named User1 and the conditional access policies shown in the following table.

  

  You need to evaluate which policies will be applied to User1 when User1 attempts to sign-in from various IP addresses.

  Which feature should you use?

  A. Access reviews
  B. Identity Secure Score
  C. The What If tool
  D. the Microsoft 365 network connectivity test tool
  C. The What If tool

• Question 46:

  HOTSPOT

  You have a Microsoft 365 tenant that contains a group named Group1 as shown in the Group1 exhibit. (Click the Group1 tab.)

  

  You create an enterprise application named App1 as shown in the App1 Properties exhibit. (Click the App1 Properties tab.)

  

  You configure self-service for App1 as shown in the App1 Self-service exhibit. (Click the App1 Self-service tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  No

  No

  No a) When you assign a group to an application, only users in the group will have access. The assignment does not cascade to nested groups. b) Tested in lab, existing owners will be replaced. Also direct assignment (resource owner) is path of least privilege. (replicated in test) c) Application setting 'visible to users' is set to No, then no users see this application on their My Apps portal and O365 launcher.

  Reference a)

  https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal

  b) maybe

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-manage-groups

  c)

  https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-properties#visible-to-users

• Question 47:

  You have three Azure subscriptions that are linked to a single Microsoft Entra tenant.

  You need to evaluate and remediate the risks associated with highly privileged accounts. The solution must minimize administrative effort.

  What should you use?

  A. Global Secure Access
  B. Privileged Identity Management (PIM)
  C. Microsoft Entra Permissions Management
  D. Microsoft Entra Verified ID
  B. Privileged Identity Management (PIM)

  ---

  Explanation

  Privileged Identity Management (PIM) is a service in Microsoft Entra ID that enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

  Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of

  Privileged Identity Management:

  Provide just-in-time privileged access to Microsoft Entra ID and Azure resources Assign time-bound access to resources using start and end dates

  *-> Require approval to activate privileged roles

  Enforce multi-factor authentication to activate any role

  Use justification to understand why users activate

  *-> Get notifications when privileged roles are activated

  Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator and Privileged Role Administrator role assignments

  Incorrect:

  * Global Secure Access

  Global Secure Access (preview) is the area in the Microsoft Entra admin center where you configure and manage Microsoft Entra Internet Access and Microsoft Entra Private Access.

  Microsoft Entra Internet Access

  Microsoft Entra Internet Access isolates the traffic for Microsoft 365 applications and resources, such as Exchange Online and SharePoint Online. Users can access these resources by connecting to the Global Secure Access Client or through a remote network, such as in a branch office location.

  Microsoft Entra Private Access

  Microsoft Entra Private Access provides a secure, zero-trust access solution for accessing internal resources without requiring a VPN. Configure Quick Access and enable the Private access traffic forwarding profile to specify the sites and apps you want routed through Microsoft Entra Private Access.

  * Microsoft Entra Permissions Management

  Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) product that provides comprehensive visibility and control over permissions for any identity and any resource in Microsoft Azure, Amazon Web Services (AWS) and Google Cloud Platform (GCP).

  * Microsoft Entra Verified ID

  Microsoft Entra Verified ID Service.

  An issuance and verification service in Azure and a REST API for W3C Verifiable Credentials that are signed with the did:web method. They enable identity owners to generate, present, and verify claims. This forms the basis of trust between users of the systems.

  References:

  https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

• Question 48:

  SIMULATION

  You need to implement additional security checks before the members of the Sg-Executive can access any company apps. The members must meet one of the following conditions:

  1. Connect by using a device that is marked as compliant by Microsoft Intune.

  2. Connect by using client apps that are protected by app protection policies.

  A. See the Explanation Below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the Explanation Below

  ---

  Explanation

  To implement additional security checks for the Sg-Executive group members before they can access any company apps, you can use Conditional Access policies in Microsoft Entra. Here's a step-by-step guide:

  1. Sign in to the Microsoft Entra admin center:

  2. uk.co.certification.simulator.questionpool.PList@164c53bc

  3. Navigate to Conditional Access:

  4. Create a new policy:

  5. Assign the policy to the Sg-Executive group:

  6. Define the application control conditions:

  7. Set the device compliance requirement:

  8. Set the app protection policy requirement:

  9. Configure the access controls:

  10. Enable the policy:

  11. Review and save the policy:

  By following these steps, you will ensure that the Sg-Executive group members can only access company apps if they meet one of the specified conditions, either by using a compliant device or a protected client app. This enhances the security posture of your organization by enforcing stricter access controls for executive-level users.

• Question 49:

  You have a Microsoft 365 E5 subscription.

  You need to ensure that users can only access resources in the subscription from a device that has the Global Secure Access client connected.

  What should you do first?

  A. Enable Global Secure Access signaling.
  B. Enable tagging to enforce tenant restrictions.
  C. Create a named location.
  D. Create a remote network.
  D. Create a remote network.

  ---

  Explanation

  How to create a remote network with Global Secure Access Remote networks are remote locations, such as a branch office, or networks that require internet connectivity. Setting up remote networks connects your users in remote locations to Global Secure Access. Once a remote network is configured, you can assign a traffic forwarding profile to manage your corporate network traffic. Global Secure Access provides remote network connectivity so you can apply network security policies to your outbound traffic.

  You can create a remote network in the Microsoft Entra admin center or through the Microsoft Graph API.

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-create-remote-networks

• Question 50:

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  The tenant has the authentication methods shown in the following table.

  

  Which users will sign in to cloud apps by matching a number shown in the app with a number shown on their phone?

  A. User1 only
  B. User2 only
  C. User3 only
  D. User1 and User2 only
  E. User2 and User3 only
  A. User1 only