Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 61:

  You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.

  

  Which objects can you add as eligible in Azure Privileged identity Management (PIM) for an Azure AD role?

  A. User1 only
  B. User1 and Identity1 only
  C. User1. Guest1, and Identity
  D. User1 and Guest1 only
  D. User1 and Guest1 only

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan

• Question 62:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains three groups named Groups1, Group2, and Group3, and the users shown in the following table.

  

  You create a Conditional Access policy named CAT that has the following settings: Users Include

  Users and groups: Group1

  Exclude

  Users and groups: Group2

  Directory roles: Global Administrator Target resources Include: All cloud apps Access controls

  Grant: Require multifactor authentication

  You create a Conditional Access policy named CA2 that has the following settings:

  Users

  Include

  Users and groups: Group2

  Exclude

  Users and groups: Group3

  Target resources

  Include: All cloud apps

  Access controls

  Grant: Block access

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 63:

  You have an Azure subscription that contains two virtual machines named VM1 and VM2 and an Azure SQL managed instance named SQL1.

  You need to ensure that VM1 and VM2 can retrieve data from SQL1.

  The solution must minimize administrative effort.

  What should you create first?

  A. a certificate
  B. a shared access signature (SAS) token
  C. a managed identity
  D. a Microsoft Entra user account
  C. a managed identity

  ---

  Explanation

  Managed identities in Azure provide an automatically managed identity for applications and services to use when connecting to resources that support Microsoft Entra authentication, such as Azure SQL Managed Instance. By assigning a managed identity to your virtual machines, you can authenticate to SQL1 without the need to manage credentials manually.

  References:

  https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-user-assigned-managed-identity?view=azuresql

  https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/tutorial-windows-managed-identities-vm-access?pivots=identity-windows-mi-vm-access-data-lake

• Question 64:

  HOTSPOT

  You need to configure the assignment of Azure AD licenses to the Litware users. The solution must meet the licensing requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Litware recently added a custom user attribute named LWLicenses to the litware.com Active Directory forest. Litware wants to manage the assignment of Azure AD licenses by modifying the value of the LWLicenses attribute. Users who have the appropriate value for LWLicenses must be added automatically to a Microsoft 365 group that has the appropriate licenses assigned.

• Question 65:

  You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses.

  The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.

  You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

  What should you use?

  A. the Identity Governance blade in the Microsoft Entra admin center
  B. the Update-MgGroup cmdlet
  C. the Set-MgUserLicense cmdlet
  D. the Administrative units blade in the Microsoft Entra admin center
  C. the Set-MgUserLicense cmdlet

  ---

  Explanation

  Correct: * the Licenses blade in the Azure Active Directory admin center * the Set-MgUserLicense cmdlet

  Incorrect: * the Administrative units blade in the Azure Active Directory admin center * the Groups blade in the Azure Active Directory admin center * the Identity Governance blade in the Azure Active Directory admin center * the Set-AzureAdGroup cmdlet * the Set-AzureAdUser cmdlet * the Set-MsolUserLicense cmdlet.

  The Set-MsolUserLicense cmdlet updates the license assignment for a user. This can include adding a new license, removing a license, updating the license options, or any combination of these actions. However, the Set-MsolUserLicense cmdlet is now deprecated.

  1. the Set-WindowsProductKey cmdlet * the Update-MgGroup cmdlet * the Update-MgUser cmdlet

  Note: * the Licenses blade in the Azure Active Directory admin center You can unassign licenses from users on either the Active users page, or on the Licenses page. The method you use depends on whether you want to unassign product licenses from specific users or unassign users licenses from a specific product.

  Unassign licenses by using the Licenses page 1. In the admin center, go to the Billing > Licenses page.

  2. Select a product.

  3. Select the check boxes of the users for whom you want to unassign licenses.

  4. Select Unassign licenses.

  5. In the Unassign licenses box, select Unassign. the group that should no longer have the license.

  2. Select Remove license. To remove a license from a group 1. On the Licensed groups page for the license plan, select

  1. the Set-MgUserLicense cmdlet Removing licenses from user accounts To remove licenses from an existing user account, use the following syntax:

  Set-MgUserLicense -UserId "<Account>" -RemoveLicenses @("<AccountSkuId1>") -AddLicenses @{} This example removes the SPE_E5 (Microsoft 365 E5) licensing plan from the user [email protected]:

  $e5Sku = Get-MgSubscribedSku -All | Where SkuPartNumber -eq 'SPE_E5' Set-MgUserLicense -UserId "[email protected]" -RemoveLicenses @($e5Sku.SkuId) - AddLicenses @{}

  To remove all licenses from a group of existing licensed users, use the following syntax:

  $licensedUsers = Get-MgUser -Filter 'assignedLicenses/$count ne 0' ` -ConsistencyLevel eventual -CountVariable licensedUserCount -All ` -Select UserPrincipalName,DisplayName,AssignedLicenses foreach($user in $licensedUsers) {$licensesToRemove = $user.AssignedLicenses | Select -ExpandProperty SkuId $user = Set-MgUserLicense -UserId $user.UserPrincipalName -RemoveLicenses $licensesToRemove - AddLicenses @{} }

  References:

  https://docs.microsoft.com/en-us/microsoft-365/admin/manage/remove-licenses-from-users

  https://learn.microsoft.com/en-us/microsoft-365/admin/manage/assign-licenses-to-users

  https://learn.microsoft.com/en-us/microsoft-365/enterprise/remove-licenses-from-user-accounts-with-

• Question 66:

  You have a Microsoft 365 tenant.

  You currently allow email clients that use Basic authentication to connect to Microsoft Exchange Online.

  You need to ensure that users can connect to Exchange Online only from email clients that use Modern authentication protocols.

  What should you implement?

  A. a Microsoft Entra conditional access policy
  B. a Microsoft Intune compliance policy
  C. a Microsoft Defender for Cloud Apps Oauth policy
  D. a Microsoft Intune app protection policy
  D. a Microsoft Intune app protection policy

  ---

  Explanation

  Account setup configuration via enterprise mobility management Outlook for iOS and Android offers IT administrators the ability to "push" account configurations to Microsoft 365 or Office 365 accounts or on-premises accounts using hybrid modern authentication. This capability works with any Unified Endpoint Management (UEM) provider who uses the Managed App Configuration channel for iOS or the Android in the Enterprise channel for Android.

  For users enrolled in Microsoft Intune, you can deploy the account configuration settings using Intune in the Azure portal.

  References:

  https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/setup-with-modern-authentication

• Question 67:

  DRAG DROP

  Your network contains an on-premises Active Directory domain named contoso.com that syncs with a Microsoft Entra tenant by using Microsoft Entra Connect. The domain contains the users shown in the following table.

  

  From Active Directory Users and Computers, you add the following user

  1. Name: User3

  2. UPN: [email protected]

  3. Proxy addresses: smtp: [email protected], smtp: [email protected]

  From Active Directory Users and Computers, you update the proxyAddresses attribute for each user as shown in the following table.

  

  You trigger a manual synchronization.

  Which sync status will Microsoft Entra Connect sync return for each user? To answer, drag the appropriate status to the correct users. Each status may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 68:

  You have a Microsoft 365 tenant.

  The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain.

  Users connect to the internet by using a hardware firewall at your company. The users authenticate to the firewall by using their Active Directory credentials.

  You plan to manage access to external applications by using Azure AD.

  You need to use the firewall logs to create a list of unmanaged external applications and the users who access them.

  What should you use to gather the information?

  A. Application Insights in Azure Monitor
  B. access reviews in Azure AD
  C. Cloud App Discovery in Microsoft Cloud App Security
  D. enterprise applications in Azure AD
  C. Cloud App Discovery in Microsoft Cloud App Security

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/cloud-app-security/create-snapshot-cloud-discovery-reports#using-traffic-logs-for-cloud-discovery

• Question 69:

  You have a Microsoft 365 tenant.

  All users have mobile phones and Windows 11 laptops.

  The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.

  You plan to implement multi-factor authentication (MFA).

  Which MFA authentication method can the users use from the remote location?

  A. email
  B. Windows Hello for Business
  C. voice
  D. an app password
  B. Windows Hello for Business

  ---

  Explanation

  Correct: * a verification code from the Microsoft Authenticator app * Windows Hello for Business

  Incorrect: * a notification through the Microsoft Authenticator app * an app password * email * security questions * SMS * voice

  Note:

  Correct: * Windows Hello for Business In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN. After an initial two-step verification of the user during enrollment, Windows Hello is set up on the user'' device and Windows asks the user to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Windows Hello to authenticate users.

  a verification code from the Microsoft Authenticator app The Authenticator app can be used as a software token to generate an OATH verification code. After entering your username and password, you enter the code provided by the Authenticator app into the sign-in interface.

  Incorrect: * a notification through the Microsoft Authenticator app A notification through the Microsoft Authenticator app requires connectivity to send the verification code to the device requesting the logon 1. an app password An app password can be used to open an application but it cannot be used to sign in to a computer.

  2. email An email requires network connectivity. Password reset authentication only. You'll need to choose a different method for two-'actor verification.

  3. security questions Security questions are not used as an authentication method but can be used during the self-service password reset (SSPR) process.

  4. SMS SMS requires a mobile phone 5. voice A voice call requires mobile connectivity.

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods

  https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-overview

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-authenticator-app#verification-code-from-mobile-app

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods

• Question 70:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3.

  You have two Azure AD roles that have the Activation settings shown in the following table.

  

  The Azure AD roles have the Assignment settings shown in the following table.

  

  The Azure AD roles have the eligible users shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.