SC-300 practice questions 131–140

1. Question 131 · 394 in bank

   You have a Microsoft 365 E5 subscription. You need to be able to create a Microsoft Defender for Cloud Apps session policy. What should you do first?

   • AFrom the Microsoft 365 Defender portal, select User monitoring.
   • BFrom the Microsoft 365 Defender portal, select App onboarding/maintenance.
   • CFrom the Microsoft Entra admin center, create a Conditional Access policy.
   • DFrom the Microsoft 365 Defender portal, create a continuous report.

   Show answer

   Answer: C

   Explanation

   In order for your session policy to work, you must also have a Microsoft Entra ID Conditional Access policy, which creates the permissions to control traffic. https://learn.microsoft.com/en-us/defender-cloud-apps/session-policy-aad

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn

   Next question

2. Question 132 · 394 in bank

   Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs user accounts with a Microsoft 365 E5 subscription. You need to ensure that on-premises account lockout policies are applied to Microsoft Entra sign-ins. What should you configure?

   • AAzure Active Directory Seamless Single Sign-on (Azure AD Seamless SSO)
   • BMicrosoft Entra Cloud Sync
   • Cpassword hash synchronization
   • Dpass-through authentication

   Show answer

   Answer: D

   Next question

3. Question 133 · 394 in bank

   You have a Microsoft 365 tenant. All users have mobile phones and Windows 10 laptops. The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access. You plan to implement multi-factor authentication (MFA). Which MFA authentication method can the users use from the remote location?

   • AWindows Hello for Business
   • Ban app password
   • Ca notification through the Microsoft Authenticator app
   • Dsecurity questions

   Show answer

   Answer: A

   Explanation

   Correct Answer: ✅ A. Windows Hello for Business Explanation: Since users do not have Wi-Fi access or mobile phone connectivity, we need an MFA method that works without requiring mobile authentication or real-time internet-based verification. Windows Hello for Business (WHfB) is a strong, phishing-resistant authentication method that: Uses biometric authentication (face, fingerprint) or PIN tied to the device. Does not require a mobile network or Wi-Fi to work. Provides multi-factor authentication (MFA) because it binds the identity to the enrolled device. Why Not the Other Options? App Password (B) → ❌ Not considered MFA and is only used for legacy apps. Authenticator Notification (C) → ❌ Requires internet on a mobile device, which is unavailable. Security Questions (D) → ❌ Not an MFA method in Microsoft 365.

   Source: Adapted from community discussion — Shingie

   Next question

4. Question 134 · 394 in bank

   You have multiple on-premises devices that run either Windows or Linux. You have a Microsoft 365 E5 subscription. You configure Microsoft Entra Internet Access. You need to ensure that all the on-premises devices access the internet by using Global Secure Access. What should you do in the Microsoft Entra admin center?

   • ACreate a remote network.
   • BCreate a named location.
   • CCreate an access package.
   • DDeploy the Global Secure Access client.

   Show answer

   Answer: A

   Next question

5. Question 135 · 394 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains two resource groups named RG1 and RG2. Sub1 contains the users shown in the following table.

   

   Sub1 contains the resources shown in the following table.

   

   You create the role-based access control (RBAQ role assignments shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. No. Must be Key Vault Secrets User. User1 is only a Reader. 2. Yes. User2 is a Key Vault Secrets User! :D 3. Yes. User3 is the Owner of RG1 and has god-like powers. >:-) https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn

   

   Next question

6. Question 136 · 394 in bank

   HOTSPOT - You have an Azure subscription that contains a resource group named RG1. RG1 contains two virtual machines named VM1 and VM2 that have Microsoft Entra ID login enabled. The subscription contains the users shown in the following table.

   

   Which users can sign in to VM1, and which users can sign in to VM2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

7. Question 137 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table.

   

   The subscription contains a Conditional Access policy that has the following settings: • Name: Policy1 • Assignments o Include - Users and Groups: Group1 - Directory roles: Global Administrator o Exclude - Users and Groups: Group2 o Target resources - Include - All cloud apps - Access controls - Grant - Require multifactor authentication For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

8. Question 138 · 394 in bank

   DRAG DROP - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server and hosts a shared folder named Share1. The domain contains 500 devices that run Windows 11. You have a Microsoft 365 E5 subscription that syncs with the domain. From Global Secure Access, you enable the Private access profile and deploy the Global Secure Access client to all the devices. You need to ensure that the devices can connect to Share1 remotely by using Global Secure Access. Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

9. Question 139 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant. All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request. You need to block the users automatically when they report an MFA request that they did not initiate. Solution: From the Azure portal, you configure the Block/unblock users settings for multi-factor authentication (MFA). Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   B - No It should be Azure Active Directory > Security > Multifactor authentication > Fraud alert -> Allow users to submit fraud alerts to On Pay attention to the words - you need to block the users AUTOMATICALLY Explanation from MS docs: FRAUD ALERT The fraud alert feature lets users report fraudulent attempts to access their resources. When an unknown and suspicious MFA prompt is received, users can report the fraud attempt by using the Microsoft Authenticator app or through their phone. The following fraud alert configuration options are available: - Automatically block users who report fraud. - Code to report fraud during initial greeting. BLOCK AND UNBLOCK USERS If a user's device is lost or stolen, you can block Azure AD Multi-Factor Authentication attempts for the associated account. Any Azure AD Multi-Factor Authentication attempts for blocked users are automatically denied. Users remain blocked for 90 days from the time that they're blocked.

   Source: Adapted from community discussion — shoutiv

   References

   • Microsoft Learn

   Next question

10. Question 140 · 394 in bank

    You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses. You are deploying Global Secure Access. You need to ensure that connections to www.microsoft.com are bypassed by Global Secure Access. Which profiles should you update?

    • AIntemet access profile only
    • BMicrosoft traffic profile only
    • CMicrosoft traffic profile and Internet access profile only
    • DMicrosoft traffic profile, Private access profile, and Internet access profile

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 131. 394 questions available.