SC-300 practice questions 281–290

1. Question 281 · 394 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You create a Microsoft Entra user named User1. Which identities can you add to VM1 and App1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   these questions confuse the bajesus out of me; are they talking about SAMI or UAMI when they only say "managed identity"

   Source: Adapted from community discussion — armid

   

   Next question

2. Question 282 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to ensure that when users in the sg-Operations group go to the My Apps portal, a tab named Operations appears that contains only the following applications: • LinkedIn • Box To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Incorrect. You created a Collection. Labbed it... 1. Sign in the Microsoft Entra admin center 2. Browse to Identity -> Enterprise applications -> App launchers -> Collections 3. Add a New Collection 4. On the Basics tab set Name = Operations 5. On the Applications tab add LinkedIn and Box 6. On the Users and groups tab add the sg-Operations group 7. Click Review + create

   Source: Adapted from community discussion — northgaterebel

   

   Next question

3. Question 283 · 394 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You create a Microsoft Entra user named User1. Which identities can you add to VM1 and App1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Here we go again. Are Managed1 and Managed2 system-assigned or user-assigned managed identities? Without that key information we are guessing blindly at the answer.

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 284 · 394 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to grant permissions to the resources by using attribute-based access control (ABAC). To which resource can you grant permissions?

   • AVault1
   • BVM1
   • CApp1
   • DStorage1

   Show answer

   Answer: D

   Explanation

   Correct. Currently, conditions (ABAC) can be added to built-in or custom role assignments that have blob storage or queue storage data actions. https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn

   Next question

5. Question 285 · 394 in bank

   Select 2

   You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a registered app named App1. You have a partner organization that has a Microsoft Entra tenant. The tenant contains a registered app named App2. You need to ensure that App1 can access App2. Which two types of credentials can App1 use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Acertificate
   • Bmanaged identity
   • Csecret
   • Duser account
   • Eone-time password

   Show answer

   Answer: AC

   Explanation

   Answer: A. Certificate & C. Secret Explanation: To allow App1 in your Azure tenant to authenticate and access App2 in the partner organization's Azure tenant, you typically use app-to-app authentication with OAuth 2.0 client credentials flow. The two valid credential types for this authentication are: ✅ A. Certificate – Apps can use a public-private key pair (certificate) for authentication, which is considered more secure than secrets. ✅ C. Secret – Apps can use a client secret (a password-like string) to authenticate, though it's less secure than certificates. Why not the others? ❌ B. Managed Identity – Managed identities are used only within a single tenant and cannot be used across different Microsoft Entra tenants. ❌ D. User Account – The client credentials flow does not involve interactive user authentication. Instead, App1 authenticates as itself. ❌ E. One-time password – OTPs are for human users, not for app-to-app authentication.

   Source: Adapted from community discussion — Shingie

   Next question

6. Question 286 · 394 in bank

   You have an Azure subscription that contains two virtual machines named VM1 and VM2 and an Azure SQL managed instance named SQL1. You need to ensure that VM1 and VM2 can retrieve data from SQL1. The solution must minimize administrative effort. What should you create first?

   • Aa certificate
   • Ba shared access signature (SAS) token
   • Ca managed identity
   • Da Microsoft Entra user account

   Show answer

   Answer: C

   Explanation

   Answer: C. A managed identity Explanation: To ensure that VM1 and VM2 can retrieve data from SQL1 (Azure SQL Managed Instance) with minimal administrative effort, you should use Azure Managed Identity. ✅ Managed identities allow Azure resources (like VMs) to authenticate and access other Azure services (like SQL Managed Instance) securely without storing credentials. Why not the others? ❌ A. A certificate – While certificates can be used for authentication, managing them requires more administrative overhead than a managed identity. ❌ B. A shared access signature (SAS) token – SAS tokens are mainly used for Azure Storage access, not for authenticating to SQL Managed Instances. ❌ D. A Microsoft Entra user account – Entra ID users are meant for human authentication, while VM-to-SQL authentication should use workload identity solutions like managed identities.

   Source: Adapted from community discussion — Shingie

   References

   • Microsoft Learn

   Next question

7. Question 287 · 394 in bank

   You have a Microsoft 365 E5 subscription. You plan to deploy a third-party software as a service (SaaS) app named App1. You need to onboard App1 to Microsoft Defender for Cloud Apps. The solution must ensure that you can implement session control policies. What should you do first?

   • AFrom the Microsoft Defender portal, configure Cloud discovery.
   • BFrom the Microsoft Entra admin center, configure single sign-on (SSO) for App1.
   • CFrom the Microsoft Defender portal, create an OAuth app policy.
   • DFrom the Microsoft Entra admin center, configure a traffic forwarding profile.

   Show answer

   Answer: B

   Explanation

   A. No. Cloud discovery analyzes your traffic logs against the Microsoft Defender for Cloud Apps catalog of over 31,000 cloud apps. B. Yes. When you use Single Sign-On (SSO) for a third-party SaaS application, you can implement session control policies through your identity provider (IdP), C. No. An OAuth app policy is primarily used to manage application permissions and access levels, not session management. D. No. A traffic forwarding profile determines which traffic to route through Global Secure Access.

   Source: Adapted from community discussion — northgaterebel

   Next question

8. Question 288 · 394 in bank

   HOTSPOT - You have a custom cloud app named App1 that is registered in Azure Active Directory (Azure AD). App1 is configured as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   From the Portal if you hover on the information next to the user assignment required it says: " If this option is set to yes, then users must first be assigned to this application before being able to access it. If this option is set to no, then any users who navigate to the application deep-link URL or application URL directly will be granted access. This option does not affect whether or not an application appears on My Apps. To show the application there, assign an appropriate user or group to the application. This option only functions with the following application types: applications configured for Federated Single Sign-on with SAML-based Authentication, Application Proxy applications that use Azure Active Directory Pre-Authentication or applications built directly on the Azure AD application platform that use OAuth 2.0 / OpenID Connect Authentication after a user or admin has consented to that application. This option has no effect when an application is configured for any of the other Single Sign-on modes." Therefore correct answer is: All users Assigned user in users and groups blade

   Source: Adapted from community discussion — Saz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 289 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to enable Microsoft Defender for Cloud Apps session control for Site1. Which type of policy should you create first?

   • Aaccess
   • Bapp governance
   • Csession
   • DConditional Access

   Show answer

   Answer: D

   Next question

10. Question 290 · 394 in bank

    You have an Azure Active Directory (Azure AD) tenant. You create an enterprise application collection named HR Apps that has the following settings: ✑ Applications: App1, App2, App3 ✑ Owners: Admin1 ✑ Users and groups: HRUsers All three apps have the following Properties settings: ✑ Enabled for users to sign in: Yes ✑ User assignment required: Yes Visible to users: Yes -

    

    Users report that when they go to the My Apps portal, they only see App1 and App2. You need to ensure that the users can also see App3. What should you do from App3?

    • AFrom Users and groups, add HRUsers.
    • BFrom Single sign-on, configure a sign-on method.
    • CFrom Properties, change User assignment required to No.
    • DFrom Permissions, review the User consent permissions.

    Show answer

    Answer: A

    Explanation

    This question has no sense for me... It sais that HRUsers are already in "users and groups" and the users have access to App1 and App2, so they should have access to App3 too. Someone can explain me?

    Source: Adapted from community discussion — JLInF

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 281. 394 questions available.