SC-300 practice questions 231–240

1. Question 231 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to implement a process to review guest users who have access to the Salesforce app. The review must meet the following requirements: • The reviews must occur monthly. • The manager of each guest user must review the access. • If the reviews are NOT completed within five days, access must be removed. • If the guest user does not have a manager, Megan Bowen must review the access. To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

2. Question 232 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to prevent all users from using legacy authentication protocols when authenticating to Microsoft Entra ID. To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

3. Question 233 · 394 in bank

   You have a Microsoft Entra tenant that contains a terms of use (ToU) named Terms1. You create a Conditional Access policy named Policy1 to deploy Terms1. You need to configure Policy1 to require users to accept Terms1. Which settings should you configure for Policy1?

   • AConditions
   • BSession
   • CGrant
   • DTarget resources

   Show answer

   Answer: C

   Explanation

   o enforce Terms of Use (ToU) acceptance in a Conditional Access policy, you must configure it under the Grant section : https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-require-terms-of-use

   Source: Adapted from community discussion — nicolaslindt

   References

   • Microsoft Learn

   Next question

4. Question 234 · 394 in bank

   You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity. You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort. What should you do first?

   • AConfigure the Resource access settings for Vault1.
   • BConfigure the permissions model for Vault1.
   • CAdd a user-assigned managed identity to VM1.
   • DAssign an Azure role to VM1.

   Show answer

   Answer: D

   Explanation

   stupid question, we can use RBAC or access policy, but to do that we also have to configure the resource (key vault) access settings. so it is either A or D https://learn.microsoft.com/en-us/azure/frontdoor/managed-identity "Configure Key Vault access You can configure Azure Key Vault access using either of the following methods: Role-based access control (RBAC) - Provides fine-grained access control using Azure Resource Manager. Access policy - Uses native Azure Key Vault access control. For more information, see Azure role-based access control (Azure RBAC) vs. access policy."

   Source: Adapted from community discussion — rvln7

   References

   • Microsoft Learn

   Next question

5. Question 235 · 394 in bank

   HOTSPOT - You have an Azure subscription named Sub1. You plan to use Microsoft Entra Permissions Management to manage Sub1. You need to ensure that Permissions Management can perform the following tasks: • Identify unused permissions assigned to applications and managed identities. • Provide users with recommendations about which permissions to remove. • Remove unused permissions. The solution must follow the principle of least privilege. Which role should you assign to the service principal of Permissions Management, and what should you use to provide recommendations and remove unused permissions? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

6. Question 236 · 394 in bank

   HOTSPOT - You have a Microsoft 365 tenant and an Active Directory domain named adatum.com. You deploy Azure AD Connect by using the Express Settings. You need to configure self-service password reset (SSPR) to meet the following requirements: ✑ When users reset their password, they must be prompted to respond to a mobile app notification or answer three predefined security questions. ✑ Passwords must be synced between the tenant and the domain regardless of where the password was reset. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions

   Source: Adapted from community discussion — girikedar

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 237 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure AD Identity Protection enabled. You need to implement a sign-in risk remediation policy without blocking user access. What should you do first?

   • AConfigure access reviews in Azure AD.
   • BEnforce Azure AD Password Protection.
   • CConfigure self-service password reset (SSPR) for all users.
   • DImplement multi-factor authentication (MFA) for all users.

   Show answer

   Answer: D

   Explanation

   to implement a sign-in risk remediation policy When a sign in risk policy triggers: Azure AD MFA can be triggered, allowing to user to prove it's them by using one of their registered authentication methods, resetting the sign in risk. https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

   Source: Adapted from community discussion — melatocaroca

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 238 · 394 in bank

   HOTSPOT - Your company has a Microsoft 365 tenant. All users have computers that run Windows 10 and are joined to the Azure Active Directory (Azure AD) tenant. The company subscribes to a third-party cloud service named Service1. Service1 supports Azure AD authentication and authorization based on OAuth. Service1 is published to the Azure AD gallery. You need to recommend a solution to ensure that the users can connect to Service1 without being prompted for authentication. The solution must ensure that the users can access Service1 only from Azure AD-joined computers. The solution must minimize administrative effort. What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-managed-devices

   Source: Adapted from community discussion — NawafAli

   References

   • Microsoft Learn

   

   Next question

9. Question 239 · 394 in bank

   Your company requires that users request access before they can access corporate applications. You register a new enterprise application named MyApp1 in Azure Active Directory (Azure AD) and configure single sign-on (SSO) for MyApp1. Which settings should you configure next for MyApp1?

   • ASelf-service
   • BProvisioning
   • CApplication proxy
   • DRoles and administrators

   Show answer

   Answer: A

   Explanation

   Después de configurar el inicio de sesión único (SSO) para MyApp1, debe configurar la opción A, Autoservicio, para permitir que los usuarios soliciten acceso a la aplicación. La opción Autoservicio permite que los usuarios soliciten acceso a la aplicación desde el portal de Azure AD, y los administradores pueden revisar y aprobar las solicitudes de acceso. La opción B, Aprovisionamiento, se refiere a la sincronización de usuarios y grupos desde el directorio local o desde otros proveedores de identidad a Azure AD. No está relacionado con la configuración de acceso a la aplicación. La opción C, Proxy de aplicación, se refiere a la publicación de aplicaciones detrás de una puerta de enlace de aplicaciones. No está relacionado con la configuración de acceso a la aplicación. La opción D, Funciones y administradores, se refiere a la asignación de roles y permisos a los administradores y usuarios. No está relacionado con la configuración de acceso a la aplicación.

   Source: Adapted from community discussion — eleazarrd

   References

   • Microsoft Learn

   Next question

10. Question 240 · 394 in bank

    DRAG DROP - Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company is developing a web service named App1. You need to ensure that App1 can use Microsoft Graph to read directory data in contoso.com. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    100% First, we need to register a new application Then we need to add application permissions And then we need to grant admin consent

    Source: Adapted from community discussion — Jacquesvz

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 231. 394 questions available.