SC-300 practice questions 181–190

1. Question 181 · 394 in bank

   HOTSPOT - You have an Azure subscription that contains the key vaults shown in the following table.

   

   The subscription contains the users shown in the following table.

   

   On June 1, Admin4 performs the following actions: • Deletes a certificate named Certificate1 from KeyVault1 • Deletes a secret named Secret1 from KeyVault2 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Yes - Key Vault Administrator can perform all data plane operations on a key vault. and purge protection is disabled for KeyVault2. NB: Purge protection is an optional Key Vault behavior and is not enabled by default. Do not mismatch with soft-delete No - We are still in the Purge protection remaining period. NB: Also the Key Vault contributor role doesn't allow to get access to certificate No - We are still in the Purge protection remaining period. Even if the Certificate Officer role allow to get access to certificate

   Source: Adapted from community discussion — wsrudmen

   References

   • Microsoft Learn

   

   Next question

2. Question 182 · 394 in bank

   You have a management group named Group1 that contains two Azure subscriptions named Sub1 and Sub2. The subscriptions are linked to a Microsoft Entra tenant that contains a user named User1. You need to ensure that User1 can onboard Sub1 to Permissions Management. The solution must follow the principle of least privilege. Which permission should you grant to User1?

   • AMicrosoft.Authorization/roleAssignments/read for Sub1
   • BMicrosoft.Authorization/roleAssignments/write for Group1
   • CMicrosoftAuthorization/roleAssignments/write for Sub1
   • DMicrosoft.Authorization/roleAssignments/read for Group1

   Show answer

   Answer: C

   Explanation

   You are wrong. If you read the source you provide carefully you understand that when your tenant is onboarded an App is created and this App requires the reading permissions. In the Prerequisites its clearly stated what permission is required to do the task and logically its a write permission "You must have Microsoft.Authorization/roleAssignments/write permission at the subscription or management group scope to perform these tasks." The correct answer is C and most likely a typo by the creator of the question.

   Source: Adapted from community discussion — csi_2025

   Next question

3. Question 183 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant. You configure self-service password reset (SSPR) by using the following settings: • Require users to register when signing in: Yes • Number of methods required to reset: 1 What is a valid authentication method available to users?

   • Aa smartcard
   • Ba mobile app code
   • Ca mobile app notification
   • Dan email to an address outside your organization

   Show answer

   Answer: B

   Explanation

   There should be an option for multiple answers. When configuring SSPR for a single method to reset there are two options - Mobile app code AND Email

   Source: Adapted from community discussion — Guestie

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 184 · 394 in bank

   You create a new Microsoft 365 E5 tenant. You need to ensure that when users connect to the Microsoft 365 portal from an anonymous IP address, they are prompted to use multi-factor authentication (MFA). What should you configure?

   • Aa sign-in risk policy
   • Ba user risk policy
   • Can MFA registration policy

   Show answer

   Answer: A

   Explanation

   Sign-in risk is correct. Examples for Sign-In Risk: Anonymous IP address Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray

   Source: Adapted from community discussion — BRoald

   Next question

5. Question 185 · 394 in bank

   HOTSPOT - You have a Microsoft 365 tenant. You configure a conditional access policy as shown in the Conditional Access policy exhibit. (Click the Conditional Access policy tab.)

   

   You view the User administrator role settings as shown in the Role setting details exhibit. (Click the Role setting details tab.)

   

   You view the User administrator role assignments as shown in the Role assignments exhibit. (Click the Role assignments tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct Answer is: Yes/Yes/No On activation, require multifactor authentication: You can require users who are eligible for a role to prove who they are by using the multifactor authentication feature in Microsoft Entra ID before they can activate. Multifactor authentication helps safeguard access to data and applications. It provides another layer of security by using a second form of authentication. Users might not be prompted for multifactor authentication if they authenticated with strong credentials or provided multifactor authentication earlier in the session. The word "might" implies that Yes/Yes/Yes can also be accepted as answer. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings#on-activation-require-multi-factor-authentication

   Source: Adapted from community discussion — Siraf

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 186 · 394 in bank

   HOTSPOT - You have an Azure AD tenant that contains the users shown in the following table.

   

   You have the Azure AD Identity Protection policies shown in the following table.

   

   You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   N N N User 1 No The User Risk = Low. Then User risk policy blocked access. User 2 No The Sign-in Risk = Unknown. But it is Confirm Safe so we can ignore this. The User risk = Medium. The user risk policy block access. User 3 No User 3 User Risk is dismissed, but anonymous IP address risk (this is Sign-in Risk) is still at High level. Hence the sign-in risk policy blocked the access. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#nonpremium-sign-in-risk-detections

   Source: Adapted from community discussion — doch

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 187 · 394 in bank

   You have an Azure subscription that contains a user named User1. You need to meet the following requirements: • Prevent User1 from being added as an owner of newly registered apps. • Ensure that User1 can manage the application proxy settings. • Ensure that User1 can register apps. • Use the principle of least privilege. Which role should you assign to User1?

   • AApplication developer
   • BCloud application administrator
   • CService support administrator
   • DApplication administrator

   Show answer

   Answer: D

   Explanation

   Application Administrator is correct. Application Administrator = Can create and manage all aspects of app registrations and enterprise apps. Cloud Application Administrator = Can create and manage all aspects of app registrations and enterprise apps ***except App Proxy***. Service Support Administrator = Can read service health information and manage support tickets. Application Developer = Can create application registrations independent of the 'Users can register applications' setting. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

   Source: Adapted from community discussion — doch

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 188 · 394 in bank

   DRAG DROP - You have a Microsoft 365 E5 subscription and an Azure subscription. You need to meet the following requirements: • Ensure that users can sign in to Azure virtual machines by using their Microsoft 365 credentials. • Delegate the ability to create new virtual machines. What should you use for each requirement? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   There is no Azure AD built in role, which can create virtual machine. Only some Azure built in roles can do it. So I vote for both Azure RBAC.

   Source: Adapted from community discussion — dobriv

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 189 · 394 in bank

   You have a Microsoft 365 tenant. All users have computers that run Windows 10. Most computers are company-owned and joined to Azure Active Directory (Azure AD). Some computers are user- owned and are only registered in Azure AD. You need to prevent users who connect to Microsoft SharePoint Online on their user-owned computer from downloading or syncing files. Other users must NOT be restricted. Which policy type should you create?

   • Aa Microsoft Cloud App Security activity policy that has Microsoft Office 365 governance actions configured
   • Ban Azure AD conditional access policy that has session controls configured
   • Can Azure AD conditional access policy that has client apps conditions configured
   • Da Microsoft Cloud App Security app discovery policy that has governance actions configured

   Show answer

   Answer: B

   Explanation

   B is the correct answer imo - https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices - You need to use "Use app enforced restrictions" from the "Session" control of the CA

   Source: Adapted from community discussion — Val_0

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 190 · 394 in bank

    HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant. The AD DS domain contains the organizational units (OUs) shown in the following table.

    

    You need to create a break-glass account named BreakGlass. Where should you create BreakGlass, and which role should you assign to BreakGlass? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access Create emergency access accounts Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment.

    Source: Adapted from community discussion — kmk_01

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 181. 394 questions available.