SC-300 practice questions 221–230

1. Question 221 · 394 in bank

   DRAG DROP - You have a Microsoft 365 E5 tenant. You purchase a cloud app named App1. You need to enable real-time session-level monitoring of App1 by using Microsoft Cloud App Security. In which order should you perform the actions? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Publish App1. 2. Create a conditional access policy that has session controls configured. 3. From MCAS modify the Connected apps settings 4. From MCAS create a session policy Reference - https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-blocking-data-downloads-via-microsoft-cloud-app/ba-p/326357

   Source: Adapted from community discussion — JasonYin

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 222 · 394 in bank

   You have an Azure AD tenant. You deploy a new enterprise application named App1. When users attempt to provide App1 with access to the tenant, the attempt fails. You need to ensure that the users can request admin consent for App1. The solution must follow the principle of least privilege. What should you do first?

   • AEnable admin consent requests for the tenant.
   • BDesignate a reviewer of admin consent requests for the tenant.
   • CFrom the Permissions settings of App1, grant App1 admin consent for the tenant.
   • DCreate a Conditional Access policy for App1.

   Show answer

   Answer: A

   Explanation

   To ensure that users can request admin consent for App1 in your Azure AD tenant, you should first enable admin consent requests for the tenant. Enabling admin consent requests allows users to initiate the process of requesting admin consent for applications that require it. By default, users do not have the ability to grant admin consent for applications. Enabling this feature ensures that users can request admin consent for App1 without having to rely on an administrator to initiate the process.

   Source: Adapted from community discussion — haazybanj

   Next question

3. Question 223 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant. All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request. You need to block the users automatically when they report an MFA request that they did not initiate. Solution: From the Azure Active Directory admin center, you configure the Block/unblock users settings for multi-factor authentication (MFA). Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   To meet the goal of automatically blocking users when they report an unauthorized MFA request, you would need to implement additional measures such as monitoring and alerting, conditional access policies, or security policies to detect and respond to suspicious MFA activity. Therefore, the correct answer is B. No.

   Source: Adapted from community discussion — haazybanj

   References

   • Microsoft Learn

   Next question

4. Question 224 · 394 in bank

   You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft 365 group named Group1. You need to ensure that the members of Group1 can access Site1 for 90 days. The solution must minimize administrative effort. What should you use?

   • Aan access package
   • Ban access review
   • Ca lifecycle workflow
   • Da Conditional Access policy

   Show answer

   Answer: A

   Explanation

   A. an access package For this scenario, an access package would be the most suitable. An access package in Azure Active Directory (Azure AD) entitlement management is a bundle of resources that you can give to users so they can access a set of related resources. They can be configured to expire after a certain amount of days (in this case 90 days), after which access to the resources is automatically revoked, saving administrative effort.

   Source: Adapted from community discussion — ANiMOSiTYOP

   Next question

5. Question 225 · 394 in bank

   You have a Microsoft Entra tenant that contains the groups shown in the following table.

   

   You need to implement Privileged Identity Management (PIM) for the groups. Which groups can be managed by using PIM?

   • AGroup1 only
   • BGroup1 and Group2 only
   • CGroup1 and Group3 only
   • DGroup3 and Group4 only
   • EGroup1, Group2, Group3, and Group4

   Show answer

   Answer: C

   Explanation

   source https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/concept-pim-for-groups Groups in Microsoft Entra ID can be classified as either role-assignable or non-role-assignable. Additionally, any group can be enabled or not enabled for use with Microsoft Entra Privileged Identity Management (PIM) for Groups. These are independent properties of the group. Any Microsoft Entra security group and any Microsoft 365 group (except dynamic groups and groups synchronized from on-premises environment) can be enabled in PIM for Groups. The group doesn't have to be role-assignable group to be enabled in PIM for Groups.

   Source: Adapted from community discussion — Blakkaboy69

   References

   • Microsoft Learn

   Next question

6. Question 226 · 394 in bank

   You have a Microsoft Entra tenant. You need to query risky user activity for the tenant. How long will the logs of risky user activity be retained?

   • A30 days
   • B60 days
   • C90 days
   • D180 days

   Show answer

   Answer: C

   Explanation

   https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention Risky users No limit No limit No limit Risky sign-ins 7 days 30 days 90 days Note Risky users and workload identities are not deleted until the risk has been remediated.

   Source: Adapted from community discussion — throwaway10188

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 227 · 394 in bank

   HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table.

   

   You have a user risk policy that has the following settings: • Assignments: o Include: Group1 o Exclude: Group2 • Sign-in risk: Medium and above • Access controls: o Grant access: Require password change When the users attempt to sign in, user risk levels are detected as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For a CA they say: Remember, the exclusion will take precedence. So if you select to include a user then exclude the user, the user will be excluded from the policy.

   Source: Adapted from community discussion — spatrick

   References

   • Microsoft Learn

   

   Next question

8. Question 228 · 394 in bank

   You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4. You plan to assign the users the following roles for RG1: • User1: Reader • User2: Contributor • User3: Storage Blob Data Reader • User4: Virtual Machine Contributor You are evaluating the use of attribute-based access control (ABAC). Which user's role will support the use of ABAC?

   • AUser1
   • BUser2
   • CUser3
   • DUser4

   Show answer

   Answer: C

   Explanation

   Attribute-based access control (ABAC) grants access based on attributes of users, resources, and the environment. - User roles (User1, User2, User3, User4) are a simpler form of access control. Out of the options, only Storage Blob Data Reader and Virtual Machine Contributor roles are specific to resource types (Storage Blob and Virtual Machine). These roles suggest ABAC might be used for finer-grained control. So, the answer is either C or D. While both Storage Blob Data Reader and Virtual Machine Contributor roles might be used with ABAC, it's more likely for data access. Therefore, the most likely user to benefit from ABAC is User3: Storage Blob Data Reader. So the answer is: C. User3

   Source: Adapted from community discussion — klayytech

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 229 · 394 in bank

   Select 2

   You have an Azure subscription. The subscription contains a virtual machine named VM1 that runs Linux. You need to configure enhanced security for VM1. The solution must meet the following requirements: • Ensure that users can sign in to VM1 by using their Microsoft Entra credentials. • Ensure that users authenticate by using multi-factor out-of-band. • Prevent users from signing in to VM1 by using passwords. Which two authentication methods can you include in the solution? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Athe Microsoft Authenticator app
   • BFIDO2 security keys
   • CTemporary Access Pass
   • DSMS
   • EWindows Hello for Business

   Show answer

   Answer: AB

   Next question

10. Question 230 · 394 in bank

    SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to configure Microsoft Entra Identity Protection to meet the following requirements: • Require multi-factor authentication (MFA) for any sign-ins at the high risk level. • Apply the configuration to all users except for Mod Administrator. To complete this task, sign in to the appropriate admin center.

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 221. 394 questions available.