Free SC-300 Exam Dumps Preview

The system-assigned identity gives Automation1 a security principal, but access still must be granted at the narrowest resource scope. Configuring Access control (IAM) directly on Secret1 permits a role assignment scoped to that secret, allowing Automation1 to read it without granting access to the other secrets in Vault1.

Traffic bypass must be configured in each forwarding profile that can process the destination. The public Microsoft destination can be classified by the Microsoft traffic profile and the Internet access profile, so excluding it in only one profile would leave the other path subject to Global Secure Access. The Private access profile handles private resources and does not need this change.

Create 2 access packages because an access package can use separate request policies for different requester and approver groups while keeping one resource set. The package containing Site1 and Team1 can have one policy for Group1 requests approved by Group2 and another for Group4 requests approved by Group5. A second package containing only Site1 can serve Group3, with Group5 as approver.

User1's Application Administrator assignment is eligible, so it must be activated through Privileged Identity Management before the application proxy connector group is configured. Privileged Identity Management for Microsoft Entra roles is administered in the Microsoft Entra admin center. The Defender, Microsoft 365, and Intune portals do not activate this eligible role.

The Self-service settings for an enterprise application control whether users can request access and how that request is approved. Configuring Self-service after single sign-on establishes the required request-before-access process for MyApp1. Provisioning creates or updates accounts but does not itself provide the user access-request workflow.

Box 1: Yes - User1 can gain access to Team1 by requesting Package1.

User1 is member of Group1.

Users who can request access: For users in your directory.
Specific Users and Groups: Group1

Box 2: No - User2 can gain access to Team1 by requesting Package1. User2 is not member of Group1.
Only members of Group1 can request access.

Box 3: No - User3 can approve their own request for Package1.

User3 is member of Group1. User3 is Global Administrator. Group1 can request access. User3 is also First Approver. However, Approvers are not able to approve their own role activation requests.

References:
https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-approval-policy

A catalog is the initial Identity Governance container for the applications and other resources whose access will be managed. It establishes the scope that can be delegated to catalog owners and used for access assignments. Consent settings govern application permissions rather than delegated management and tracking of user access assignments.

Completing an access review records its decisions, but the remaining denied assignments demonstrate that the intended removals were not fully applied. The owner should verify application of the results, identify why particular changes failed, and perform the authorized follow-up needed to resolve them. Review completion alone is not proof that each target resource changed.

The account lockout threshold is configured as 3 MFA denials. Therefore, three consecutive incorrect Microsoft Authenticator verification codes can trigger the MFA account lockout. The Minutes until account lockout counter is reset value of 60 minutes controls when the failed-attempt counter resets; it isn’t the lockout duration. The Minutes until account is automatically unblocked value is 30 minutes, so after the account is locked, the user can attempt to sign in successfully again after 30 minutes.

When SSPR is configured to require one authentication method, a verification code from the Microsoft Authenticator app is a valid method for password reset. Under the legacy SSPR behavior tested by this question, when one method is required, the mobile app supports a verification code, while a mobile app notification is available when two methods are required. A smartcard is not an SSPR authentication method. Therefore, a mobile app code is the valid choice.

Litware recently added a custom user attribute named LWLicenses to the litware.com Active Directory forest. Litware wants to manage the assignment of Microsoft Entra ID service plans by modifying the value of the LWLicenses attribute. Users who have the appropriate value for LWLicenses must be added automatically to a Microsoft 365 group that has the appropriate licenses assigned.

Password hash synchronization moves the authentication dependency to the cloud instead of requiring the on-premises sign-in infrastructure for each authentication attempt. Seamless single sign-on complements it by giving eligible domain devices an intranet SSO experience. The two features therefore address the cloud-authentication and intranet-convenience requirements separately.

An authorization redirect must return the browser to a registered, exact redirect URI. Because a single-page application executes in users' browsers, it is a public client and cannot keep a client secret confidential. The registration should therefore identify the public-client redirect location without embedding a secret; API permission grants remain a separate decision.

App3 requires user assignment, so merely placing it in the HR Apps collection does not assign HRUsers to the application. Adding HRUsers under App3's Users and groups creates the required assignment. Because App3 is enabled and visible, that assignment allows the group's users to see it with App1 and App2 in the My Apps portal.

Box 1: No

Group1 is created in contoso.com (Microsoft Entra). User1 is in fabrikam.com (on-premises). From the exhibit we see that "Group writeback" is disabled. User1 cannot be added to Group1.

Note: Plan for Microsoft Entra Connect group writeback Group writeback allows you to write cloud groups back to your on-premises Active Directory instance by using Microsoft Entra Connect Sync. You can use this feature to manage groups in the cloud, while controlling access to on-premises applications and resources.

Box 2: No

User2 is in fabrikam.com (on-premises), and is enabled. User2 then disabled.

Note: Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity.
Microsoft Entra Connect synchronizes a hash of a user's password from an on-premises Active Directory instance to a cloud-based Microsoft Entra instance.

Box 3: Yes

Password writeback is enabled.

Note: Password writeback can be used to synchronize password changes in Microsoft Entra back to your on-premises AD DS environment. Microsoft Entra Connect provides a secure mechanism to send these password changes back to an existing on-premises directory from Microsoft Entra ID.

References:
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-group-writeback-v2
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-phs
https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback

A user-assigned managed identity is a separate identity that can be associated with supported Azure resources. VM1, a virtual machine, and WebApp1, an Azure App Service app, can both use Managed1. The storage account itself cannot use that identity as its own identity, so the supported resources are VM1 and WebApp1 only.

An eligible assignment gives a user the right to activate a privileged role when the role is needed, while leaving the role inactive at other times. Privileged Identity Management can apply activation requirements and a limited activation period. An active or permanent assignment would provide the privileges continuously.

An Entitlement Management custom extension uses an Azure Logic App to implement the custom workflow that runs during access package lifecycle events. Therefore, the Logic App must be created before configuring the custom extension. Resources and their roles from a catalog are made available to users through an access package, which defines the resources, request policies, approvals, and lifecycle settings used to grant access.

An anonymous IP address is a property of the current authentication attempt, so it represents sign-in risk rather than persistent evidence that the user account is compromised. A sign-in risk policy can respond to that risky attempt by requiring MFA before access to Microsoft 365 services is granted.

A remote network represents an on-premises site whose traffic is connected to Global Secure Access. Configuring it allows both Windows and Linux devices at that site to use the network-based connection without requiring a device client on every machine. A named location only classifies traffic and does not establish this connectivity.

An OAuth app policy is designed to evaluate applications that receive OAuth permissions and to monitor their behavior, permission grants, and associated risk. It directly addresses OAuth app activity rather than interactive user access. Conditional Access controls sign-ins, while access reviews periodically validate assignments or memberships.

Cross-tenant synchronization creates and maintains the partner users as B2B collaboration objects in the receiving tenant. Separately, inbound cross-tenant access trust settings determine whether that receiving tenant accepts MFA claims issued by the users' home tenant. Synchronization supplies the objects, while inbound trust supplies the requested MFA behavior, so both are required.

App1 runs as a background service with no signed-in user, so it must call Microsoft Graph as its own application identity. Application permissions authorize that app-only access after administrative consent. Delegated permissions require a user's context and therefore do not fit a service that collects sign-in audit logs without user interaction.

Azure Active Directory retains sign-in log events for 30 days in the stated tenant context. An investigation performed within that period can use the sign-in log to review previous authentication activity. The other durations do not represent the applicable built-in sign-in log retention period for this question.

References:
https://docs.microsoft.com/en-us/sharepoint/app-enforced-restrictions
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-session

Microsoft Entra applies a protected default self-service password reset policy to administrator accounts. That administrator reset policy requires two authentication methods, satisfying the stronger verification requirement without changing ordinary user registration settings. Password writeback affects where a new password is written, not how the administrator verifies identity.

Box 1: No - User1 can read the contents of blob 2.

User1 has the Reader role. Does not apply to the blob container. User1 also has the Storage Blob Data Reader with Condition1. Blob2 is in Cont2. Condition1 will be false: The action is..blob/reads Resource name is cont2 not cont1

Note: Storage Blob Data Reader Read and list Azure Storage containers and blobs.

Box 2: Yes - User1 can read the contents of blob 3.

Blob3 is in cont 1. Condition1 will be true.

Box 3: Yes - User2 can read the contents of blob 1.

User2 has the Reader role. Does not apply to the blob container. User2 also has the Storage Blob Data Owner Role with Condition2. blob1 is in cont1 Condition2 will be true, as the action is read, not a write.

Box 1: No

User1 will not be prompted for multifactor authentication (MFA) when signing in to Microsoft SharePoint Online.

User1 is a Global Administrator and a member of Group1. CA1 includes Group1 but excludes the Global Administrator directory role. In Conditional Access, an exclusion takes precedence over an inclusion. Therefore, CA1 does not apply to User1.

CA2 applies to Group2, so it does not apply to User1.

Therefore, User1 will not be prompted for MFA by either Conditional Access policy.

Box 2: Yes

User2 will be prevented from signing in to Microsoft SharePoint Online.

User2 is a member of Group2. CA1 excludes Group2, so CA1 does not apply to User2. CA2 includes Group2 and applies the Block access control to all cloud apps.

Therefore, CA2 blocks User2 from accessing Microsoft SharePoint Online.

Box 3: No

User3 will not be prevented from signing in to Microsoft SharePoint Online.

User3 is a Global Reader and a member of both Group2 and Group3. CA1 excludes Group2, so CA1 does not apply to User3.

CA2 includes Group2 but excludes Group3. Because exclusions take precedence over inclusions, CA2 does not apply to User3.

Therefore, neither CA1 nor CA2 prevents User3 from signing in to Microsoft SharePoint Online.

Purchasing the Microsoft Entra Permissions Management license is a billing operation. Billing Administrator grants the purchasing and subscription-billing capability needed for that task without providing the broad directory control of Global Administrator. Permissions Management Administrator manages the service, and User Access Administrator manages Azure access assignments rather than purchases.

A Defender for Cloud Apps access policy operates through Conditional Access App Control. The Conditional Access policy must first route App1 sessions to that control path; the access policy can then evaluate the session and allow or block access. Token configuration, API permissions, and app-enforced restrictions do not establish this session-control integration.

The failure occurs while User1 attempts to access a cloud application, so the sign-in logs provide the relevant authentication record. They expose the application, sign-in status, failure details, and policies involved in the access attempt. Reviewing that single event is the direct, low-effort way to identify why access to the Microsoft Defender for Cloud Apps portal failed.

A catalog is the entitlement management container that holds resources such as the SharePoint site and Teams team. Those resources must first be associated with a catalog before an access package can bundle their roles and policies for users. Creating the catalog is therefore the first step in building the workflow for Site1 and Team1.

App1 must first be registered in Microsoft Entra ID to establish an application identity. Because App1 is a web service that needs to access Microsoft Graph directory data independently of a signed-in user, application permissions should then be added for Microsoft Graph. Directory-reading application permissions require administrator consent, so Grant admin consent is performed last. Delegated permissions require a signed-in user and therefore are not appropriate for this service-to-service scenario.

MFA notification settings control messages associated with the service; they do not configure the response to a user reporting an unsolicited authentication request. Automatic blocking requires the fraud-reporting behavior that handles a reported suspicious MFA prompt. Therefore, changing notification settings alone does not achieve the required action.

An Autopilot rule provides an automated response to unused permissions rather than only reporting or querying them. The rule can identify managed identities whose assigned permissions meet the 90-day inactivity condition and remove those permissions through the configured remediation. This combines detection and cleanup, minimizing the recurring manual effort required by the solution.

The Microsoft Azure app connector concerns Azure activity and does not connect the listed third-party service whose OAuth grants must be monitored. Adding it therefore does not provide visibility into OAuth authentication requests for Google Workspace. A connector for the relevant application platform is required, so the proposed Microsoft Azure connector does not meet the goal.

SCIM 2.0 defines a standard protocol for exchanging identity information and automating user provisioning between an identity provider and a SaaS application. An app that supports SCIM can receive user creation, update, and removal operations from Azure AD. OAuth and WS-Fed address authentication, while LDAP is a directory access protocol.

The Client apps condition distinguishes modern clients from legacy authentication clients and protocols. A Conditional Access policy can target the legacy client categories with this condition and apply a block control. Device platform, location, and user risk describe different aspects of a sign-in and do not identify the authentication protocol.

Identity Protection evaluates the detected risk associated with a sign-in. Its sign-in risk policy can permit access only after the user completes additional verification, such as MFA. This remediates the high-risk event through verification while avoiding an unconditional block on the user's access.

The New risky app template starts an app discovery policy with criteria intended for discovered applications whose risk warrants action. The policy can be refined with the risk-score and daily-traffic thresholds and configured to apply the unsanctioned governance action automatically. This combines identification and blocking criteria without repeatedly reviewing apps by hand.

External collaboration settings govern guest invitation behavior in the Azure AD tenant, including who can invite external users and which collaboration restrictions apply. Modifying these settings therefore addresses an invitation problem at its governing control. Continuous access evaluation and Conditional Access affect session or sign-in enforcement, while access reviews evaluate existing access rather than controlling invitations.

The Application Developer role permits Admin1 to create application registrations even though ordinary users are prevented from registering applications. It grants the specific application-development capability needed for App1 without the broader administrative authority of Cloud Application Administrator, satisfying least privilege.

A mail-enabled security group can contain mail-enabled recipients, but it does not support nesting the listed group types as members. User2 has the Microsoft Office 365 Enterprise E5 license that provides the required mail-enabled user capability. User1 has no license, Group1 is only a security group, and Group2 is a Microsoft 365 group, so User2 is the only eligible object.

Box 1: Target resources
Apply Conditional Access policies to Global Secure Access traffic

1. Under Target resources > Resources (formerly cloud apps). 1a. Choose All internet resources with Global Secure Access

Box 2: Access controls: Grant

1. Under Access controls > Grant.
2a. Select Require multifactor authentication, Require device to be marked as compliant, and Require Microsoft Entra hybrid joined device 2b. For multiple controls select Require one of the selected controls.
2. Select Select.

References:
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-target-resource-microsoft-profile

Access reviews for Azure AD role assignments are part of privileged role governance. Privileged Role Administrator has the authority needed to manage those role assignments and create their access reviews. Assigning that role gives User1 the required role-specific capability without using a broader or unrelated user-management role.

Box 1: From Users and groups, add Group1. For the configuration object.

Configuration Object Assignment Users and Groups Assignment: Assign the existing group Group1 containing the 100 users directly to the synchronization configuration object.

Box 2: Add a scoping filter For the configuration object from Settings.

Configuration Object Settings Provisioning Scope: Expand Settings within the configuration provisioning blade and change the Scope option to Sync only assigned users and groups.

Scoping Filter: Under Mappings, edit the user provisioning mappings (Provision Microsoft Entra ID Users). Add a Source Object Scope filter targeting the user's department attribute (e.g., department EQUALS IT).

References:
https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure

FIDO2 tokens provide a physical authentication method that users can carry between shared desktop computers. They do not depend on a mobile phone or biometric hardware built into a particular workstation, so they satisfy the call center restrictions while providing an additional authentication factor.

Conditional Access evaluates cloud sign-ins against its configured users, applications, conditions, and controls. It does not immediately transfer an on-premises account-disable change to Azure AD. Until the disabled state reaches the tenant or authentication is validated on-premises, the policy cannot enforce that new state, so this solution does not meet the goal.

Terms of use acceptance can be imposed as a grant requirement in a Microsoft Entra ID Conditional Access policy. The policy evaluates access attempts and permits the targeted resources only after the user accepts the configured terms; users who do not accept them are denied. Intune compliance or terms settings do not enforce the tenant-wide Entra access decision described.

Box 1: User5 only User User2 can reset the password for User5 only.
A Helpdesk Administrator scoped to an administrative unit (AU) can only reset passwords for users who meet both of the following criteria: Scope Match: The target user must be a member of the Administrative Unit that the administrator has scope over (AU1 for User2).

Role Permission: A Helpdesk Administrator can only reset passwords for non-administrators and other Helpdesk Administrators. They cannot reset passwords for highly privileged roles like Global Administrator or Privileged Authentication Administrator.

User5: Can reset. User5 is located within AU1 (in scope) and holds no role (non-administrator), making them fully manageable by User2.

Incorrect:
User1: Cannot reset. User1 is located in AU2 (out of User2's AU1 scope) and holds the Global Administrator role, which is too privileged for a Helpdesk Administrator to modify.

User3: Cannot reset. Although User3 is located within AU1, they hold the Privileged Authentication Administrator role. A Helpdesk Administrator does not have the permission to reset passwords for privileged identity roles.

User4: Can reset. User4 is located within AU1 (in scope) and holds the Helpdesk Administrator role. A standard Helpdesk Administrator cannot reset the password for another Helpdesk Administrator (or any other administrative user).To reset the password for an administrative account, the acting admin requires at least the Privileged Authentication Administrator or Global Administrator role.

Box 2: User1 and User2 only User3 can reset the password for User 1 (User1) only.

Role Permissions: The Privileged Authentication Administrator role has the authority to view, set, and reset password/non-password authentication credentials for all users, including high-privilege accounts like Global Administrators.

Administrative Unit Scope: A user's physical membership placement does not restrict where they can manage users; their assigned scope determines their boundary. Since User3 is assigned this role with a scope of AU2, they can only manage users who are members of AU2.

Evaluating Target Users in AU2: User1 is in AU2 (Global Administrator). Because User3's Privileged Authentication Administrator permissions are scoped to AU2, and this specific role is highly privileged enough to reset Global Administrators, User3 can reset User1's password.

User2 is also in AU2 (Helpdesk Administrator with scope AU1). However, in standard Microsoft Entra ID scoping rules, a Helpdesk Administrator role is considered an object managed under the directory level, but the user object itself resides in AU2. Because User3 can manage any user in AU2, User3 can reset User2's password.

References:
https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles

Session control policies operate during an application's authenticated session. Configuring single sign-on for App1 integrates its authentication with Microsoft Entra, providing the sign-in path through which Defender for Cloud Apps can apply session controls. Cloud discovery inventories usage, while an OAuth policy governs OAuth app behavior rather than establishing this session path.

AKS1 must use its managed identity for data access rather than receive broad resource-management authority. The Azure Cosmos DB Data Reader Role supplies read access to Cosmos DB data, and assigning it at RG1 covers DB1. Owner is excessive, while Reader and the Account Reader role address management information rather than the required database data access.

User1 inherits the Reader role from Group1 at the subscription scope, but Reader provides management-plane read access and does not allow reading Key Vault secret contents. User2 is a member of Group2, which has the Key Vault Secrets User role scoped to RG2, so User2 can read secrets in Vault2 because Vault2 is in RG2. User3 is a member of Group3, which has the Owner role scoped to RG1, so User3 can manage resources in RG1, including updating the configuration of VM1.

The What If tool evaluates Conditional Access policy applicability for a simulated sign-in. You can supply User1 and vary sign-in attributes such as the source IP address to determine which enabled policies would apply and what controls they would impose. This performs the requested evaluation without requiring User1 to conduct repeated real sign-ins.

Microsoft Entra sign-in for these Windows Server virtual machines depends on connectivity to the enterprise registration service. Ensuring that the machines can reach the enterprise registration endpoint allows the device identity operations required by Microsoft Entra login. Deleting registrations or revoking user tokens would not repair blocked service connectivity.

PIM requires role assignments that establish who has the role actively or is eligible to activate it. Creating the assignments first associates User1 and User2 with the User Administrator role. The relevant activation and approval behavior can then distinguish immediate use from a request that must be approved by User3.

Yes, Yes, No

User1's traffic to Microsoft services is forwarded through Global Secure Access from RemoteNetwork1, so the Conditional Access policy targeting internet resources with Global Secure Access is evaluated and requires MFA.

User2's device traffic is forwarded through Global Secure Access from RemoteNetwork1 even without the client, so the policy is evaluated and requires MFA.

User3 is on RemoteNetwork2, which isn't assigned to the Microsoft traffic forwarding profile, so the sign-in to Exchange Online isn't evaluated under the Global Secure Access internet-resources policy and MFA isn't required by that policy.

The existing built-in role already contains exactly the needed actions, so creating another role does not reduce the permission set. Assigning that role at the required limited scope also restricts where those actions can be exercised. Least privilege is achieved by minimizing both the allowed actions and their reach, rather than granting broader tenant-wide authority.

An administrative unit creates a directory-management boundary containing a defined subset of users. Placing the marketing users in that unit allows a suitable Microsoft Entra role assignment for User1 to be scoped to them, leaving finance users outside the delegated scope. Resource and management groups do not create this directory-user boundary.

The admin consent workflow provides a formal request-and-review path when users cannot grant an application's requested permissions themselves. Users submit a request, designated reviewers evaluate it, and consent is granted only after approval. Conditional Access controls resource access and does not provide this application-permission approval process.

App1 accesses Microsoft Graph while a user is signed in and acts on that user's Outlook calendar. Delegated permissions represent this user-present model: the app receives permission to operate on behalf of the signed-in user within the granted scope. Application permissions are intended for app-only access without a signed-in user.

A daemon operates without a user security context, so delegated permissions cannot represent its access. Application permission gives the service its own identity, but that identity still receives only the permissions that have been consented to and authorized on the target resource. This supports unattended API access without borrowing or exceeding a user's rights.

A newly deployed Azure AD tenant has Microsoft Authenticator enabled as its default multifactor authentication method. It supports MFA through app-based approval or verification codes. SMS, voice call, and email OTP are separate authentication methods and are not the default MFA method identified for the new tenant.

The review is scoped to Guest users only, so User1 and User4, who are member users, aren’t included. User3 is the owner of Group1 and therefore acts as the reviewer. Microsoft Entra access reviews automatically flatten nested groups for review purposes, so users from Group2 can appear individually in the review of Group1. User5 is a guest user in Group2, which is nested in Group1, so User3 can review User5’s access. Microsoft notes, however, that if a nested-group user is denied, the system doesn’t automatically remove that user from the nested group itself.

A web app registration requires a redirect URI so Microsoft Entra ID knows where to return the authentication response after the user signs in. The URI binds the web authentication flow to an approved callback endpoint for App1. Executable names, bundle IDs, and package names identify other application forms rather than a .NET web callback.

The Insights Administrator role permits work with monitoring insights but does not change the recipient configured for an Azure Monitor alert. Alert delivery is determined by the alert rule's action group or notification action. Assigning that directory role to the new security administrator therefore does not redirect the existing email alerts.

User1's membership cannot be managed since he is a member of a nested group. User2's membership cannot be managed since he is a part of Group2 which is an AD group (not AAD). User3 is not the member of Group2.

Privileged Identity Management can make user accounts and guest user accounts eligible for an Azure AD role. User1 and Guest1 are identities that can receive such role assignments and activate them when required. Identity1 is a managed identity rather than a user or guest, so it cannot be added as eligible in this role scenario.