SC-300 practice questions 171–180

1. Question 171 · 394 in bank

   You create a conditional access policy that blocks access when a user triggers a high-severity sign-in alert. You need to test the policy under the following conditions: ✑ A user signs in from another country. ✑ A user triggers a sign-in risk. What should you use to complete the test?

   • Athe Conditional Access What If tool
   • Bsign-ins logs in Azure Active Directory (Azure AD)
   • Cthe activity logs in Microsoft Defender for Cloud Apps
   • Daccess reviews in Azure Active Directory (Azure AD)

   Show answer

   Answer: A

   Explanation

   A. the Conditional Access What If tool The Conditional Access What If tool allows you to simulate the effects of conditional access policies on users and identify the potential impact of policy changes without affecting real user sessions. This tool will help you test the policy for the given scenarios. Option B (sign-ins logs in Azure Active Directory) is used to view historical sign-in logs but doesn't allow you to simulate policy changes. Option C (the activity logs in Microsoft Defender for Cloud Apps) is not directly related to conditional access policy testing. Option D (access reviews in Azure Active Directory) is used for managing and reviewing access to resources and is not suitable for testing conditional access policies.

   Source: Adapted from community discussion — sherifhamed

   References

   • Microsoft Learn

   Next question

2. Question 172 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   You have the locations shown in the following table.

   

   The tenant contains a named location that has the following configurations: ✑ Name: Location1 ✑ Mark as trusted location: Enabled IPv4 range: 10.10.0.0/16 -

   

   MFA has a trusted IP address range of 193.17.17.0/24. ✑ Name: CAPolicy1 ✑ Assignments - Users or workload identities: Group1 - Cloud apps or actions: All cloud apps ✑ Conditions - Locations: All trusted locations ✑ Access controls - Grant - Grant access: Require multi-factor authentication - Session: 0 controls selected ✑ Enable policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think (feel free to discuss): 1) No 2) Yes (although the request is from a trusted location, that doesn't mean the MFA prompt will be bypassed! If there was CA policy configured to require MFA with the trusted locations EXCLUDED, then the user would not get the MFA prompt) 3) No (request is coming from the IP that is added to the MFA trusted IPs list in the legacy MFA portal https://account.activedirectory.windowsazure.com/UserManagement/MfaSettings.aspx)

   Source: Adapted from community discussion — dejo

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 173 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Email one-time passcode for guests set to Yes. You invite the guest users shown in the following table.

   

   Which users will receive a one-time passcode, and how long will the passcode be valid? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Guest3 only - When does a guest user get a one-time passcode? When a guest user redeems an invitation or uses a link to a resource that has been shared with them, they'll receive a one-time passcode if: They don't have an Azure AD account They don't have a Microsoft account The inviting tenant didn't set up federation with social (like Google) or other identity providers. Box 2: 30 minutes - One-time passcodes are valid for 30 minutes. After 30 minutes, that specific one-time passcode is no longer valid, and the user must request a new one. User sessions expire after 24 hours. After that time, the guest user receives a new passcode when they access the resource. Session expiration provides added security, especially when a guest user leaves their company or no longer needs access. Reference: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/one-time-passcode

   Source: Adapted from community discussion — EmnCours

   References

   • Microsoft Learn

   

   Next question

4. Question 174 · 394 in bank

   You have a Microsoft Entra tenant that contains the devices shown in the following table.

   

   You plan to configure Microsoft Entra Private Access. You deploy the Global Secure Access client to compatible devices. From which devices can you use Private Access?

   • ADevice1 only
   • BDevice2 only
   • CDevice2 and Device4 only
   • DDevice1, Device2, and Device3 only
   • EDevice1, Device2, Device3, and Device4

   Show answer

   Answer: B

   Explanation

   Isn't B a better option? for Android though it seems just registered is enough but there is more to it, the question doesn't say anything about how its managed or if the authenticator app is intalled. *Android devices must be Microsoft Entra registered devices. -->Devices not managed by your organization must have the Microsoft Authenticator app must be installed. -->Devices not managed through Intune must have the Company Portal app installed. -->Device enrollment is required for Intune device compliance policies to be enforced.

   Source: Adapted from community discussion — barlar

   References

   • Microsoft Learn

   Next question

5. Question 175 · 394 in bank

   You have an Azure subscription that contains an Azure SQL database named db1. You deploy an Azure App Service web app named App1 that provides product information to users that connect to App1 anonymously. You need to provide App1 with access to db1. The solution must meet the following requirements: • Credentials must only be available to App1. • Administrative effort must be minimized. Which type of credentials should you use?

   • Aa system-assigned managed identity
   • Ban Azure Active Directory (Azure AD) user account
   • Ca SQL Server account
   • Da user-assigned managed identity

   Show answer

   Answer: A

   Explanation

   To provide App1 with access to db1 while minimizing administrative effort and ensuring that credentials are only available to App1, you should use a system-assigned managed identity. A system-assigned managed identity is enabled directly on an Azure service instance. When the identity is enabled, Azure creates an identity for the instance in the Azure AD tenant that’s trusted by the subscription of the instance This way, you don’t need to create or manage any secrets or credentials for your application. The identity is automatically managed by Azure and enables you to authenticate to any service that supports Azure AD authentication without having any credentials in your code

   Source: Adapted from community discussion — mali1969

   Next question

6. Question 176 · 394 in bank

   You have an Azure subscription that contains the custom roles shown in the following table.

   

   You need to create a custom Azure subscription role named Role3 by using the Azure portal. Role3 will use the baseline permissions of an existing role. Which roles can you clone to create Role3?

   • ARole2 only
   • Bbuilt-in Azure subscription roles only
   • Cbuilt-in Azure subscription roles and Role2 only
   • Dbuilt-in Azure subscription roles and built-in Azure AD roles only
   • ERole1, Role2, built-in Azure subscription roles, and built-in Azure AD roles

   Show answer

   Answer: C

   Explanation

   It's unclear if the question asks which roles can be cloned from a single action or in general, but I'd say the latter. So, both custom and Azure built-in roles can be cloned - https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal#clone-a-role

   Source: Adapted from community discussion — dejo

   References

   • Microsoft Learn

   Next question

7. Question 177 · 394 in bank

   HOTSPOT - Your on-premises network contains an Active Directory domain that uses Microsoft Entra Connect sync to sync with a Microsoft Entra tenant. You need to configure Microsoft Entra Connect sync to meet the following requirements: • Microsoft Entra sign-ins must be authenticated by an Active Directory domain controller. • Active Directory domain users must be able to use Microsoft Entra self-service password reset (SSPR). • Minimize administrative effort. What should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 178 · 394 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant. The tenant contains the users shown in the following table.

   

   Sub1 contains a resource group named RG1. The tenant contains the groups shown in the following table.

   

   You deploy a virtual machine named VM1 to RG1. VM1 runs Windows Server and has Microsoft Entra login enabled. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

9. Question 179 · 394 in bank

   You have a Microsoft Entra tenant that contains the users shown in the following table.

   

   The tenant has the authentication methods shown in the following table.

   

   Which users will sign in to cloud apps by using number matching?

   • AUser1 only
   • BUser2 only
   • CUser3 only
   • DUser1 and User2 only
   • EUser2 and User3 only

   Show answer

   Answer: A

   Next question

10. Question 180 · 394 in bank

    HOTSPOT - You have an Azure subscription that contains the following virtual machine: • Name: V1 • Azure region: East US • System-assigned managed identity: Disabled You create the managed identities shown in the following table.

    

    You perform the following actions: • Assign Managed1 to V1. • Create a resource group named RG1 in the West US region. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    please dont just say it should be this and that. u need to justify why it should be YNN so that other users see if u are right or not. u end up confusing people by just saying what u think without stating why!

    Source: Adapted from community discussion — kevin_office

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 171. 394 questions available.