SC-300 practice questions 121–130

1. Question 121 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2. The subscription contains the users shown in the following table.

   

   You create the following Conditional Access policies: • Name: Policy1 • Users: o Include: Group1 o Exclude: Group2 • Target resources: o Include: All cloud apps • Grant: o Grant access: Require multi-factor authentication • Session: o Persistent browser session: Never persistent • Name: Policy2 • Users: o Include: - Directory roles: Global Administrator - Users and groups: User3 o Exclude: Group2 • Target resources: o Include: All cloud apps • Session: o Sign-in frequency: - Periodic authentication: 2 hours For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   N,N,N When you have the 'Stay signed in' setting enabled in the company branding pane, users are typically prompted with the 'Stay signed in?' option after they sign in. However, if you also have a Conditional Access policy set to 'Persistent browser session: Never persistent', this policy will override the 'Stay signed in' setting. In this case, users will not be prompted with the 'Stay signed in?' option when they sign in to the M365 portal. The Conditional Access policy ensures that browser sessions are never persistent, meaning users will need to sign in again after closing and reopening their browser

   Source: Adapted from community discussion — perkp

   

   Next question

2. Question 122 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a user named User1. You need to ensure that User1 can create access reviews for Microsoft Entra roles. The solution must use the principle of least privilege. Which role should you assign to User1?

   • AIdentity Governance Administrator
   • BUser Access Administrator
   • CUser Administrator
   • DPrivileged Role Administrator

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

3. Question 123 · 394 in bank

   You have a Microsoft Entra tenant that contains the users shown in the following table.

   

   Admin4 creates a Conditional Access policy named Policy1 by using the Require multifactor authentication for Azure management template. Which users will be required to use multi-factor authentication (MFA) the next time they sign in?

   • AAdmin2 and Admin3 only
   • BAdmin1 and Admin4 only
   • CAdmin1, Admin2, and Admin3 only
   • DAdmin1, Admin2, Admin3, and Admin4

   Show answer

   Answer: C

   Explanation

   when you create CA policies from template the current user who is creating them is always excluded. Hopefully this is what the question is going for

   Source: Adapted from community discussion — armid

   Next question

4. Question 124 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft Teams team named Team1. The subscription contains five security groups named Group1, Group2, Group3, Group4, and Group5. You need to implement access packages for Site1 and Team1. The solution must meet the following requirements: • Members of Group3 must be able to request access to Site1 only. • Members of Group1 must be able to request access to Site1 and Team1. • Members of Group4 must be able to request access to Site1 and Team1. • Only members of Group2 must be able to approve access package requests from Group1 members. • Only members of Groups must be able to approve access package requests from Group3 and Group4 members. What h the minimum number of access packages you should create?

   • A2
   • B3
   • C4
   • D5

   Show answer

   Answer: B

   Explanation

   Here is why i go with 3: When users request access to package, they request acccess to all roles within it. So by this we automatically need 2 packages one for just Site1 and one for Site1+Team1 However we must make sure that Group1 and Group4 have different exclusive approvers ("ONLY this group can approve this package"). So we have to separate the access packages for Group1 and Group4 instead of creating just one. That leaves 3

   Source: Adapted from community discussion — armid

   Next question

5. Question 125 · 394 in bank

   You have a Microsoft Entra tenant. You open the risk detections report. Which risk detection type is classified as a user risk?

   • Aimpossible travel
   • Banonymous IP address
   • Catypical travel
   • Dleaked credentials

   Show answer

   Answer: D

   Explanation

   The correct answer is: D. Leaked credentials Explanation: User risk refers to risks associated with the identity of the user rather than just their sign-in behavior. Leaked credentials indicate that the user's credentials have been found in a data breach or leaked database, meaning their identity is at high risk. The other options (impossible travel, anonymous IP address, atypical travel) are sign-in risks, as they indicate suspicious login activity rather than a compromised identity. Thus, leaked credentials is classified as a user risk in Microsoft Entra.

   Source: Adapted from community discussion — Shingie

   Next question

6. Question 126 · 394 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps. You have multiple third-party apps that access the resources in the subscription. You need to monitor the access of the third-party apps. What should you create?

   • Aan access policy
   • Ban app permission policy
   • Can OAuth app policy
   • Dan endpoint protection policy

   Show answer

   Answer: C

   Next question

7. Question 127 · 394 in bank

   You have an Azure subscription that contains a virtual machine named VM1. VM1 has the following configurations: • Private IP address: 172.16.1.5 • Public IP address: 108.143.161.25 • System-assigned managed identity status: On You install an app named App1 on VM1. You need to configure App1 to request a managed identity app-only access token. Which IP address should App1 use for the request?

   • A108.143.161.25
   • B127.0.0.1
   • C169.254.169.254
   • D172.16.1.5

   Show answer

   Answer: C

   Explanation

   Answer is correct... 169.254.169.254 is the special IP address used for the Azure Instance Metadata Service (IMDS), which provides information about the VM and allows it to request tokens for managed identities.

   Source: Adapted from community discussion — TRN80

   Next question

8. Question 128 · 394 in bank

   Select 3

   You have a Microsoft Entra tenant. You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by using a phishing-resistant multi-factor authentication (MFA) method. Which three authentication methods should you include in the solution? Each correct answer presents a complete solution.

   • AWindows Hello for Business
   • Ban FIDO2 security key
   • Ccertificate-based authentication (multi-factor)
   • Dvoice call
   • ESMS
   • Femail OTP
   • Gcertificate-based authentication (single-factor)
   • HMicrosoft Authenticator

   Show answer

   Answer: ABC

   Explanation

   Correct Answers: A. Windows Hello for Business B. a FIDO2 security key C. certificate-based authentication (multi-factor) Explanation: To meet the requirement of phishing-resistant multi-factor authentication (MFA) for administrative access, the authentication methods must be resistant to common phishing attacks. Microsoft recognizes the following as phishing-resistant MFA methods: Windows Hello for Business (WHfB) (A) Uses biometrics or PIN tied to a device. Passwordless and resistant to phishing attacks. FIDO2 Security Keys (B) Hardware-based authentication, passwordless, and phishing-resistant. Uses cryptographic keys stored on a physical device. Certificate-Based Authentication (Multi-Factor) (C) Uses a client certificate combined with another authentication factor. More secure than single-factor certificate-based authentication.

   Source: Adapted from community discussion — Shingie

   References

   • Microsoft Learn

   Next question

9. Question 129 · 394 in bank

   You have a Microsoft Entra tenant. You configure self-service password reset (SSPR) by using the following settings: • Require users to register when signing in: Yes • Number of methods required to reset: 1 What is a valid authentication method available to users?

   • Aan email to an address outside your organization
   • Ba mobile app notification
   • Ca smartcard
   • Dan email to an address in your organization

   Show answer

   Answer: A

   Explanation

   When administrators require one method be used to reset a password, verification code is the only option available for the app option. (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks). The following authentication methods are available for SSPR: Mobile app notification Mobile app code Email Mobile phone Office phone (available only for tenants with paid subscriptions) Security questions

   Source: Adapted from community discussion — nicolaslindt

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 130 · 394 in bank

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant. All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request. You need to block the users automatically when they report an MFA request that they did not initiate. Solution: From the Azure portal, you configure the Account lockout settings for multi-factor authentication (MFA). Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Answer: B

    Explanation

    This is incorrect, should be B. Fraud alert setting literally has an option to configure it to automatically block - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#fraud-alert o enable and configure fraud alerts, complete the following steps: 1. Go to Azure Active Directory > Security > MFA > Fraud alert. 2. Set Allow users to submit fraud alerts to On. 3. Configure the Automatically block users who report fraud or Code to report fraud during initial greeting setting as needed. 4. Select Save.

    Source: Adapted from community discussion — Benkyoujin

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 121. 394 questions available.