SC-300 practice questions 161–170

1. Question 161 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that has Security defaults disabled. You are creating a conditional access policy as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

   Source: Adapted from community discussion — melatocaroca

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 162 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains a user named SecAdmin1. SecAdmin1 is assigned the Security administrator role. SecAdmin1 reports that she cannot reset passwords from the Azure AD Identity Protection portal. You need to ensure that SecAdmin1 can manage passwords and invalidate sessions on behalf of non-administrative users. The solution must use the principle of least privilege. Which role should you assign to SecAdmin1?

   • AAuthentication administrator
   • BHelpdesk administrator
   • CPrivileged authentication administrator
   • DSecurity operator

   Show answer

   Answer: B

   Explanation

   Answer must be B - Helpdesk Administrators. From the docs: Authentication administrator: can reset passwords for non-admins but can't invalidate sessions. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#authentication-administrator Helpdesk administrator: Users with this role can change passwords, invalidate refresh tokens, manage service requests, and monitor service health. Invalidating a refresh token forces the user to sign in again. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#helpdesk-administrator Privileged Authentication Administrator: can reset all passwords (admins & non-admins) but can't invalidate any sessions. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator Security Operator: can't reset any passwords. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-operator

   Source: Adapted from community discussion — sezza_blunt

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 163 · 394 in bank

   You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit. (Click the Exhibit tab.)

   

   You are evaluating the following passwords: ✑ Pr0jectlitw@re ✑ T@ilw1nd ✑ C0nt0s0 Which passwords will be blocked?

   • APr0jectlitw@re and T@ilw1nd only
   • BC0nt0s0 only
   • CC0nt0s0, Pr0jectlitw@re, and T@ilw1nd
   • DC0nt0s0 and T@ilw1nd only
   • EC0nt0s0 and Pr0jectlitw@re only

   Show answer

   Answer: C

   Explanation

   After normalization we have : ✑ Pr0jectlitw@re - > projectlitware = 2 points ✑ T@ilw1nd -> tailwind =1 point ✑ C0nt0s0 -> contoso = 1 point You need 5 points therefore everything is blocked.

   Source: Adapted from community discussion — Goseu

   References

   • Microsoft Learn

   Next question

4. Question 164 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   User2 reports that he can only configure multi-factor authentication (MFA) to use the Microsoft Authenticator app. You need to ensure that User2 can configure alternate MFA methods. Which configuration is required, and which user should perform the configuration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Modify security defaults. Privileged Authentication Administrator Users with this role can set or reset any authentication method (including passwords) for any user, including Global Administrators. Privileged Authentication Administrators can force users to re-register against existing non-password credential (such as MFA or FIDO) and revoke 'remember MFA on the device', prompting for MFA on the next sign-in of all users. The Authentication Administrator role has permission to force re-registration and multifactor authentication for standard users and users with some admin roles. Box 2: User1 only. Security Administrator. Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Azure Active Directory Identity Protection, Azure Active Directory Authentication, Azure Information Protection, and Office 365 Security & Compliance Center. Incorrect: Not User3. Service Support Administrator. Users with this role can create and manage support requests with Microsoft for Azure and Microsoft 365 services, and view the service dashboard and message center in the Azure portal and Microsoft 365 admin center. Reference: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

   Source: Adapted from community discussion — Cepheid

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 165 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant. You configure self-service password reset (SSPR) by using the following settings: ✑ Require users to register when signing in: Yes ✑ Number of methods required to reset: 1 What is a valid authentication method available to users?

   • Aa Microsoft Teams chat
   • Ba mobile app notification
   • Ca mobile app code
   • Dan FIDO2 security token

   Show answer

   Answer: C

   Explanation

   C. a mobile app code In this configuration, users are required to register for SSPR and have at least one authentication method. A mobile app code is one of the available methods, which typically involves receiving a code on a mobile app that the user must enter to reset their password. Options A and B (Microsoft Teams chat and mobile app notification) might be used for multi-factor authentication, but they are not typically used as standalone methods for password reset. Option D (FIDO2 security token) is a strong authentication method but is not typically used for password reset; it's more commonly used for sign-in or multi-factor authentication.

   Source: Adapted from community discussion — sherifhamed

   References

   • Microsoft Learn

   Next question

6. Question 166 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that uses Azure AD Identity Protection and contains the resources shown in the following table.

   

   Azure Multi-factor Authentication (MFA) is enabled for all users. User1 triggers a medium severity alert that requires additional investigation. You need to force User1 to reset his password the next time he signs in. The solution must minimize administrative effort. What should you do?

   • AReconfigure the user risk, policy to trigger on medium or low severity.
   • BMark User1 as compromised.
   • CReset the Azure MIFA registration for User1.
   • DConfigure a sign-in risk policy.

   Show answer

   Answer: B

   Explanation

   The questions assists with the answer: "The solution must minimize administrative effort." So by selecting "user is compromised" in the alert will automatically prompt the user for a password reset on next logon. Less effort than reconfiguring a user risk policy.

   Source: Adapted from community discussion — Buzz8

   References

   • Microsoft Learn

   Next question

7. Question 167 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant: that contains the users shown in the following table.

   

   In Azure. AD Identity Protection, you configure a user risk policy that has the following settings: ✑ Assignments: - Users: Group1 - User risk: Low and above ✑ Controls: - Access: Block access ✑ Enforce policy: On In Azure AD Identify Protection, you configure a sign-in risk policy that has the following settings: ✑ Assignments: - Users: Group2 - Sign-in risk: Low and above ✑ Controls: - Access: Require multi-factor authentication ✑ Enforce policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Anonymous IP triggers sign-in risk policy (not user risk policy) So user1 gets only user risk policy —> not affected, can login YES User2 affected by the sign-in risk policy, and has no MFA so cannot login NO User 3 gets both policies, but only policy 2 is used for the anonymous IP, and he has MFA, so can login YES Ref: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

   Source: Adapted from community discussion — existingname

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 168 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   The tenant has the authentication methods shown in the following table.

   

   Which users will sign in to cloud apps by matching a number shown in the app with a number shown on their phone?

   • AUser1 only
   • BUser2 only
   • CUser3 only
   • DUser1 and User2 only
   • EUser2 and User3 only

   Show answer

   Answer: A

   Explanation

   Number matching will be enabled by default in february 2023! How to use number matching in multifactor authentication (MFA) notifications - Authentication methods policy - https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match

   Source: Adapted from community discussion — LHADUK

   References

   • Microsoft Learn

   Next question

9. Question 169 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.com. All users who run applications registered in Azure AD are subject to conditional access policies. You need to prevent the users from using legacy authentication. What should you include in the conditional access policies to filter out legacy authentication attempts?

   • Aa cloud apps or actions condition
   • Ba user risk condition
   • Ca client apps condition
   • Da sign-in risk condition

   Show answer

   Answer: C

   Explanation

   Directly blocking legacy authentication The easiest way to block legacy authentication across your entire organization is by configuring a Conditional Access policy that applies specifically to legacy authentication clients and blocks access. Conditional Access policies apply to all client apps by default Client apps By default, all newly created Conditional Access policies will apply to all client app types even if the client apps condition is not configured. Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication

   Source: Adapted from community discussion — melatocaroca

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 170 · 394 in bank

    You have an Azure Active Directory (Azure AD) tenant that contains a user named User1 and the conditional access policies shown in the following table.

    

    You need to evaluate which policies will be applied to User1 when User1 attempts to sign-in from various IP addresses. Which feature should you use?

    • AAccess reviews
    • BIdentity Secure Score
    • CThe What If tool
    • Dthe Microsoft 365 network connectivity test tool

    Show answer

    Answer: C

    Explanation

    C - The what if tool "The What If tool provides a way to quickly determine the policies that apply to a specific user" Source: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/what-if-tool

    Source: Adapted from community discussion — shoutiv

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 161. 394 questions available.