Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 51:

  HOTSPOT

  You have an Azure subscription.

  Azure AD logs are sent to a Log Analytics workspace.

  You need to query the logs and graphically display the number of sign-ins per user.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  

  

  ---

  Box 1 = SigninLogs

  | where ResultType == 0

  | summarize login_count = count() by identity

  | render piechart

  This query retrieves the sign-in logs, filters the successful sign-ins, summarizes the count of sign-ins per user, and renders the result as a pie chart.

  Box 2 = Render

• Question 52:

  Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant-Users sign in to computers that run Windows 10 and are joined to the domain.

  You plan to implement Azure AD Seamless Single Sign-On (Azure AD Seamless SSO).

  You need to configure the computers for Azure AD Seamless SSO.

  What should you do?

  A. Enable Enterprise State Roaming.
  B. Configure Sign-in options.
  C. Install the Azure AD Connect Authentication Agent.
  D. Modify the Intranet Zone settings.
  D. Modify the Intranet Zone settings.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start

• Question 53:

  You have a Microsoft 365 E5 subscription that contains a web app named App1.

  Guest users are regularly granted access to App1.

  You need to ensure that the guest users that have NOT accessed App1 during the past 30 days have their access removed. The solution must minimize administrative effort.

  What should you configure?

  A. a Conditional Access policy
  B. a compliance policy
  C. a guest access review
  D. an access review for application access
  D. an access review for application access

• Question 54:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices.

  You have a Microsoft 365 subscription that syncs with the domain.

  You create a Conditional Access policy named Policy1.

  You need to meet the following requirements:

  1. Apply Policy1 to all the Windows devices.

  2. Assess the compliance of the Windows devices with Policy1.

  What should you do for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Apply Policy1 to all the Windows devices by Microsoft Entra hybrid joining the domain-joined Windows 11 devices so they exist as device objects in Microsoft Entra ID and can be targeted by Conditional Access.

  Assess compliance by enrolling the devices in Microsoft Intune, because Conditional Access evaluates "device marked as compliant" using Intune compliance status.

• Question 55:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 E5 subscription.

  You create a user named User1.

  You need to ensure that User1 can update the status of Identity Secure Score improvement actions.

  Solution: You assign the User Administrator role to User1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 56:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to implement a process to review guest users who have access to the Salesforce app. The review must meet the following requirements:

  1. The reviews must occur monthly.

  2. The manager of each guest user must review the access.

  3. If the reviews are NOT completed within five days, access must be removed.

  4. If the guest user does not have a manager, Megan Bowen must review the access.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  

  Microsoft Entra, Microsoft Entra ID Governance, Manage guest access with access reviews

  Create an access review of groups and applications in Microsoft Entra ID. Access to groups and applications for employees and guests changes over time. To reduce the risk associated with stale access assignments, administrators can use Microsoft Entra ID to create access reviews for group members or application access.

  Create a single-stage access review

  Step 1: Sign in to the Microsoft Entra admin center as at least an Identity Governance Administrator.

  Step 2: Browse to Identity governance > Access reviews.

  Step 3: Select New access review to create a new access review.

  Step 4: In the Select what to review box, select which resource you want to review. [Select Teams + Groups]

  Step 5: If you selected Teams + Groups, you have two options: All Microsoft 365 groups with guest users: Select this option if you want to create recurring reviews on all your guest users across all your Microsoft Teams and Microsoft 365 groups in your organization. Dynamic groups and role-assignable groups aren't included. You can also choose to exclude individual groups by selecting Select group(s) to exclude.

  Select Teams + groups: Select this option if you want to specify a finite set of teams or groups to review.

  Step 6: [Select All Microsoft 365 groups with guest users]

  Step 7: Now you can select a scope for the review. [Select Guest users only]: This option limits the access review to only the Microsoft Entra B2B guest users in your directory.

  Step 8:

  Select Next: Reviews.

  Next: Reviews. Single stage review

  Step 9: In the Specify reviewers section, in the Select reviewers box, select either one or more people to make decisions in the access reviews. You can choose from:

  Group owner(s): This option is only available when you do a review on a team or group.

  Selected user(s) or group(s)

  Users review their own access

  Managers of users Step 10: [Select Managers of users]

  Step 11: In the Specify recurrence of review section, specify the following selections:

  Duration (in days): How long a review is open for input from reviewers.

  Start date: When the series of reviews begins.

  End date: When the series of reviews ends. You can specify that it Never ends, or you can select End on a specific date or End after number of occurrences.

  Step 12:

  Enter Duration (in days): 5

  Step 12a: Click Select fallback reviewers, and specify

  Megan Bowen. Question: If the guest user does not have a manager, Megan Bowen must review the access.

  Step 13:

  Select Next: Settings.

  Step 14: In the Upon completion settings section, you can specify what happens after the review finishes.

  Step 14a: Select Auto apply results to resource. Select this checkbox if you want access of denied users to be removed automatically after the review duration ends. If the option is disabled, you have to manually apply the results when the review finishes.

  Step 14b: For If reviewers don't respond, select Remove access. [Maybe not available, and only need to do step 14c]

  Question: If the reviews are not completed within five days, access must be removed.

  If reviewers don't respond: Use this option to specify what happens for users not reviewed by any reviewer within the review period. This setting doesn't affect users who were reviewed by a reviewer. The dropdown list shows the following options:

  No change: Leaves a user's access unchanged.

  Remove access: Removes a user's access.

  Approve access: Approves a user's access.

  Take recommendations: Takes the system's recommendation to deny or approve the user's continued access.

  Step 14c: For Action to apply on denied guest users, select Remove user's membership from the resource.

  Action to apply on denied guest users: This option is only available if the access review is scoped to include only guest users to specify what happens to guest users if they're denied either by a reviewer or by the If reviewers don't respond setting.

  Remove user's membership from the resource: This option removes a denied guest user's access to the group or application being reviewed. They can still sign in to the tenant and won't lose any other access.

  Block user from signing in for 30 days, then remove user from the tenant

  Step 15:

  Select Next: Review + Create.

  Step 16: Review the information and select Create.

  References:

  https://learn.microsoft.com/en-us/entra/id-governance/create-access-review

• Question 57:

  You have an Azure subscription that contains a user named User1 and an Azure Key Vault named Vault1.

  You need to ensure that User1 can read the metadata of certificates, keys, and secrets stored in Vault1.

  The solution must follow the principle of least privilege.

  Which role should you assign to User1?

  A. Key Vault Crypto User
  B. Key Vault Crypto Officer
  C. Key Vault Reader
  D. Key Vault Secrets User
  C. Key Vault Reader

• Question 58:

  You have an Azure AD tenant

  You configure User consent settings to allow users to provide consent to apps from verified publishers.

  You need to ensure that the users can only provide consent to apps that require low impact permissions.

  What should you do?

  A. Create an access package.
  B. Configure permission classifications.
  C. Create an enterprise application collection.
  D. Create an access review.
  B. Configure permission classifications.

• Question 59:

  HOTSPOT

  You have an Azure subscription that contains a user named User1.

  You onboard Microsoft Entra Permissions Management.

  You need to perform the following tasks:

  1. Identify all the accounts that are assigned the Global Administrator role permanently.

  2. Review the Permission Creep Index (PCI) of User1.

  Which tab in Permissions Management should you use for each task? To answer, select the appropriate options in the answer area.

  

  

  ---

  Box 1: Azure AD Insights

  View privileged role assignments in your organization.

  The Microsoft Entra (older: Azure AD) Insights tab shows you who is assigned to privileged roles in your organization. You can review a list of identities assigned to a privileged role and learn more about each identity.

  View information in the Microsoft Entra Insights tab 1. From the Permissions Management home page, select the Microsoft Entra Insights tab.

  2. Select Review global administrators to review the list of Global administrator role assignments.

  3. Select Review highly privileged roles or Review service principals to review information on principal role assignments for the following roles: Application administrator, Cloud Application administrator, Exchange administrator, Intune administrator, Privileged role administrator, SharePoint administrator, Security administrator, User administrator.

  Box 2: Dashboard

  Review the Permission Creep Index (PCI) of User1.

  View metrics related to avoidable risk.

  The data provided by Permissions Management includes metrics related to avoidable risk. These metrics allow the Permissions Management administrator to identify areas where they can reduce risks related to the principle of least permissions.

  You can view the following information in Microsoft Entra:

  1. The Permission Creep Index (PCI) heat map on the Permissions Management *Dashboard* identifies:

  2. The number of users who have been granted high-risk permissions but aren't using them.

  3. The number of users scale.

  who contribute to the permission creep index (PCI) and where they are on the 4. The Analytics dashboard provides a snapshot of permission metrics within the last 90 days.

  https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights

  https://learn.microsoft.com/en-us/entra/permissions-management/ui-dashboardReference:

• Question 60:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 tenant.

  All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

  You need to block the users automatically when they report an MFA request that they did not initiate.

  Solution: From the Azure portal, you configure the Notifications settings for multi-factor authentication (MFA).

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  You need to configure the fraud alert settings.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings