SC-300 practice questions 211–220

1. Question 211 · 394 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You need to configure access to Vault1. The solution must meet the following requirements: • Ensure that User1 can manage and create keys in Vault1. • Ensure that User2 can access a certificate stored in Vault1. • Use the principle of least privilege. Which role should you assign to each user? To answer select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct. Key Vault Certificates Officer DataActions: - Microsoft.KeyVault/vaults/certificates/* - Microsoft.KeyVault/vaults/certificates/* - Microsoft.KeyVault/vaults/certificatecontacts/write Key Vault Crypto Officer DataActions: - Microsoft.KeyVault/vaults/keys/* - Microsoft.KeyVault/vaults/keyrotationpolicies/* Key Vault Secrets Officer DataActions: - Microsoft.KeyVault/vaults/secrets/* https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-certificates-officer https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-crypto-officer https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-secrets-officer

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 212 · 394 in bank

   Select 2

   You have an Azure AD tenant that has multi-factor authentication (MFA) enforced and self-service password reset (SSPR) enabled. You enable combined registration in interrupt mode. You create a new user named User1. Which two authentication methods can User1 use to complete the combined registration process? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Aa FIDO2 security key
   • Ba hardware token
   • Ca one-time passcode email
   • DWindows Hello for Business
   • Ethe Microsoft Authenticator app

   Show answer

   Answer: CE

   Explanation

   A. FIDO2 security keys, can only be added in Manage mode. Question says "You enable combined registration in interrupt mode." B. Hardware token – You cannot register with hardware token. C. Email is supported. D. Windows Hello for Business is not supported. E. Microsoft Authenticator app is supported.

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 213 · 394 in bank

   DRAG DROP - You have an Azure AD tenant that contains a user named Admin1. Admin1 uses the Require password change for high-risk users policy template to create a new Conditional Access policy. Who is included and excluded by default in the policy assignment? To answer, drag the appropriate options to the correct target. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Include: All users Exclude: Admin1 These are the settings for the Require Password Change for High-Risk Users template: Users: All Users are Included – The current user creating the policy will be excluded Apps:All apps User Risk: Risk levels: High Access Control: Grant access – Require multifactor authentication AND Require password change Conditional Access template policies will exclude only the user creating the policy from the template. If your organization needs to exclude other accounts, you will be able to modify the policy once they are created. You can find these policies in the Microsoft Entra admin center > Protection > Conditional Access > Policies. Select a policy to open the editor and modify the excluded users and groups to select accounts you want to exclude. https://sccmentor.com/2023/03/26/just-dropped-in-to-see-what-condition-my-conditional-access-rule-was-in-part-6-require-password-change-for-high-risk-users/ https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-common?tabs=zero-trust#template-categories

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 214 · 394 in bank

   DRAG DROP - You have a Microsoft 365 E5 subscription. The subscription contains 500 devices that run Windows. You deploy the Global Secure Access client to the devices. You need to prevent users from accessing https://contoso.com from the devices. Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

5. Question 215 · 394 in bank

   You have a Microsoft 365 tenant. You currently allow email clients that use Basic authentication to connect to Microsoft Exchange Online. You need to ensure that users can connect to Exchange Online only from email clients that use Modern authentication protocols. What should you implement?

   • Aa conditional access policy in Azure AD
   • Ba compliance policy in Microsoft Intune
   • Can OAuth policy in Microsoft Defender for Cloud Apps
   • Dan application control profile in Microsoft Intune

   Show answer

   Answer: A

   Explanation

   Exactly. A. And in the previous occurrence, we clarified that "app control" is for approved apps. This will not block basic auth from, e.g. personal computers ;)

   Source: Adapted from community discussion — Nyamnyam

   References

   • Microsoft Learn

   Next question

6. Question 216 · 394 in bank

   You plan to deploy a new Azure AD tenant. Which multifactor authentication (MFA) method will be enabled by default for the tenant?

   • AMicrosoft Authenticator
   • BSMS
   • Cvoice call
   • Demail OTP

   Show answer

   Answer: A

   Explanation

   It’s a new Azure tenant, so security defaults are enabled. With security defaults, Microsoft Authenticator is the default authentication method. “Security defaults users are required to register for and use multifactor authentication using the Microsoft Authenticator app using notifications. Users might use verification codes from the Microsoft Authenticator app but can only register using the notification option. Users can also use any third party application using OATH TOTP to generate codes.” https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults#authentication-methods

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 217 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table.

   

   The users have the devices shown in the following table.

   

   You create the following two Conditional Access policies: • Name: CAPolicy1 • Assignments o Users or workload identities: Group1 o Cloud apps or actions: Office 365 SharePoint Online o Conditions Filter for devices: Exclude filtered devices from the policy Rule syntax: device.displayName -startsWith “Device” o Access controls Grant: Block access Session: 0 controls selected o Enable policy: On • Name: CAPolicy2 • Assignments o Users or workload identities: Group2 o Cloud apps or actions: Office 365 SharePoint Online o Conditions: 0 conditions selected • Access controls o Grant: Grant access Require multifactor authentication o Session: 0 controls selected • Enable policy: On All users confirm that they can successfully authenticate using MFA. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Azure Conditional Access policies can only apply to devices that are registered or joined in Azure Active Directory. If a device is not registered or joined, the policy will not be able to read the device name. N Y Y

   Source: Adapted from community discussion — vaaws

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 218 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3 and a Microsoft SharePoint Online site named Site1. The subscription contains the devices shown in the following table.

   

   The users sign in to the devices as shown in the following table.

   

   You have a Conditional Access policy that has the following settings: • Name: CA1 • Assignments o Users and groups: User1, User2, User3 o Cloud apps or actions: SharePoint - Site1 • Access controls o Session: Use app enforced restrictions From the SharePoint admin center, you configure Access control for unmanaged devices to allow limited, web-only access. Which users will have full access to Site1?

   • AUser1 only
   • BUser2 only
   • CUser3only
   • DUser1 and User2 only
   • EUser1, User2, and User3

   Show answer

   Answer: B

   Explanation

   The users who will have full access to Site1 are User1 and User2 only. The Conditional Access policy is configured to include User1, User2, and User3, but the Access control for unmanaged devices in the SharePoint admin center allows only limited, web-only access. Therefore, only User1 and User2, who sign in from managed devices, will have full access to Site1. The correct answer is D. User1 and User2 only.

   Source: Adapted from community discussion — vaaws

   References

   • Microsoft Learn

   Next question

9. Question 219 · 394 in bank

   You have an Azure AD tenant named contoso.com that contains the resources shown in the following table.

   

   You create a user named Admin1. You need to ensure that Admin1 can enable Security defaults for contoso.com. What should you do first?

   • ADelete Package1.
   • BDelete CAPolicy1.
   • CAssign Admin1 the Authentication Administrator role for Au1.
   • DConfigure Identity Governance.

   Show answer

   Answer: B

   Explanation

   To enable capolicies you need to disable Security defaults therefore you need to do it viceversa If you want to Go back to Security defaults

   Source: Adapted from community discussion — DasChi_cken

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 220 · 394 in bank

    DRAG DROP - You have an Azure subscription that is linked to an Azure AD tenant named contoso.com. The subscription contains a group named Group1 and a virtual machine named VM1. You need to meet the following requirements: • Enable a system-assigned managed identity for VM1. • Add VM1 to Group1. How should you complete the PowerShell script? To answer, drag the appropriate cmdlets to the correct targets. Each cmdlet may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Add VM system assigned identity to a group: After you have enabled system assigned identity on a VM, you can add it to a group. The following procedure adds a VM's system assigned identity to a group. 1. Retrieve and note the ObjectID (as specified in the Id field of the returned values) of the VM's service principal: $displayname = Get-AzADServicePrincipal -displayname "vm1" 2. Retrieve and note the ObjectID (as specified in the Id field of the returned values) of the group: $group Get-AzADGroup -searchstring "group1" 3. Add the VM's service principal to the group: Add-AzureADGroupMember -ObjectId $group.id -RefObjectId $displayname.id https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/qs-configure-powershell-windows-vm#system-assigned-managed-identity

    Source: Adapted from community discussion — penatuna

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 211. 394 questions available.