Microsoft SC-300 Online Practice Questions and Exam Preparation

Microsoft SC-300 Online Questions & Answers

• Question 71:

  You have an Azure subscription.

  You are evaluating enterprise software as a service (SaaS) apps.

  You need to ensure that the apps support automatic provisioning of Azure AD users.

  Which specification should the apps support?

  A. OAuth 2.0
  B. WS-Fed
  C. SCIM 2.0
  D. LDAP 3
  C. SCIM 2.0

  ---

  Explanation

  What applications and systems can I use with Azure AD automatic user provisioning?

  Azure AD features preintegrated support for many popular SaaS apps and human resources systems, and generic support for apps that implement specific parts of the SCIM 2.0 standard.

  Note: In Azure Active Directory (Azure AD), the term app provisioning refers to automatically creating user identities and roles for applications.

  Azure AD also supports provisioning users into applications hosted on-premises or in a virtual machine, without having to open up any firewalls. Your application must support SCIM. Or, you must build a SCIM gateway to connect to your legacy application. If so, you can use the Azure AD Provisioning agent to directly connect with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an LDAP user store or a SQL database, Azure AD can support these applications as well.

  What is SCIM?

  To help automate provisioning and deprovisioning, apps expose proprietary user and group APIs. User management in more than one app is a challenge because every app tries to perform the same actions. For example, creating or updating users, adding users to groups, or deprovisioning users. Often, developers implement these actions slightly different. For example, using different endpoint paths, different methods to specify user information, and different schema to represent each element of information.

  To address these challenges, the System for Cross-domain Identity Management (SCIM) specification provides a common user schema to help users move into, out of, and around apps. SCIM is becoming the de facto standard for provisioning and, when used with federation standards like Security Assertions Markup Language (SAML) or OpenID Connect (OIDC), provides administrators an end-to-end standards-based solution for access management.

  For detailed guidance on developing a SCIM endpoint to automate the provisioning and deprovisioning of users and groups to an application.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning

• Question 72:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  You need to configure app consent for the subscription. The solution must meet the following requirements:

  1. Disable user consent to apps.

  2. Configure admin consent workflow for apps.

  Which portal should you use for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 73:

  You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit. (Click the Exhibit tab.)

  

  You are evaluating the following passwords:

  Pr0jectlitw@re

  T@ilw1nd

  C0nt0s0

  Which passwords will be blocked?

  A. Pr0jectlitw@re and T@ilw1nd only
  B. C0nt0s0 only
  C. C0nt0s0, Pr0jectlitw@re, and T@ilw1nd
  D. C0nt0s0 and T@ilw1nd only
  E. C0nt0s0 and Pr0jectlitw@re only
  C. C0nt0s0, Pr0jectlitw@re, and T@ilw1nd

  ---

  Explanation

  References:

  https://blog.enablingtechcorp.com/azure-ad-password-protection-password-evaluation

• Question 74:

  You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity.

  You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort.

  What should you do first?

  A. Configure the Resource Access settings for Vault1.
  B. Configure the permissions model for Vault1.
  C. Add a user-assigned managed identity to VM1.
  D. Assign an Azure role to VM1.
  D. Assign an Azure role to VM1.

• Question 75:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  For which users can you configure the Job title property and the Usage location property in Azure AD? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 76:

  You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3, and a Microsoft SharePoint Online site named Site1.

  The subscription contains the devices shown in the following table.

  

  The users sign in to the devices as shown in the following table.

  

  You have a Conditional Access policy that has the following settings:

  Name: CA1

  Assignments:

  - Users and groups: User1, User2, User3

  - Cloud apps or actions: SharePoint Online (Site1)

  Access controls:

  - Session: Use app-enforced restrictions

  From the SharePoint admin center, you configure access control for unmanaged devices to allow limited, web-only access.

  Which users will have full access to Site1?

  A. User1 only
  B. User2 only
  C. User3 only
  D. User1 and User2 only
  E. User1, User2, and User3
  B. User2 only

  ---

  Explanation

  Not User1, User1 uses Device1.

  Device1 is Noncompliant.

  User2, User2 uses Device2.

  Device2 is registered and compliant

  Not User3, User3 uses Device3.

  Device3 is not registered. Unmanaged devices will only get limited, web-only access.

• Question 77:

  You need to configure the detection of multi-staged attacks to meet the monitoring requirements.

  What should you do?

  A. Customize the Microsoft Sentinel rule logic.
  B. Create a workbook.
  C. Add Microsoft Sentinel data connectors.
  D. Add a Microsoft Sentinel playbook.
  A. Customize the Microsoft Sentinel rule logic.

• Question 78:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant contains the users shown in the following table.

  

  In Azure AD Privileged Identity Management (PIM), you configure the Global administrator role as shown in the following exhibit.

  

  User1 is eligible for the Global administrator role.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 79:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to bulk invite Azure AD business-to-business (B2B) collaboration users.

  Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution

  NOTE: Each correct selection is worth one point.

  A. email address
  B. redirection URL
  C. username
  D. shared key
  E. password
  A. email address
  B. redirection URL

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/external-identities/tutorial-bulk-invite

• Question 80:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click the username below.

  To enter your password, place your cursor in the Enter password box and click the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: 1122334455667788

  If the Microsoft 365 portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 99999999

  You need to prevent all users from using legacy authentication protocols when authenticating to Microsoft Entra ID.

  To complete this task, sign in to the appropriate admin center.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  Block legacy authentication with Microsoft Entra Conditional Access

  Common Conditional Access policy: Block legacy authentication Step 1: Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.

  Step 2: Browse to Protection > Conditional Access.

  Step 3: Select Create new policy.

  Step 4: Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.

  Step 5: Under Assignments, select Users or workload identities.

  Step 5a: Under Include, select All users. Step 5b: Under Exclude, select Users and groups and choose any accounts that must maintain the ability to use legacy authentication. Microsoft recommends you exclude at least one account to prevent yourself from being locked out. [Skip]

  Step 6: Under Target resources > Cloud apps > Include, select All cloud apps.

  Step 7: Under Access controls > Grant, select Block access. Select Select.

  Step 8: Confirm your settings and set Enable policy to On.

  Step 9: Select Create to create to enable your policy.

  References:

  https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy