SC-300 practice questions 291–300

1. Question 291 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant. For the tenant, Users can register applications is set to No. A user named Admin1 must deploy a new cloud app named App1. You need to ensure that Admin1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which role should you assign to Admin1?

   • AManaged Application Contributor for Subscription1.
   • BApplication developer in Azure AD.
   • CCloud application administrator in Azure AD.
   • DApp Configuration Data Owner for Subscription1.

   Show answer

   Answer: B

   Explanation

   Name: Application developer Description: Users in this role will continue to be able to register app registrations even if the Global Admin has turned off the tenant level switch for "Users can register apps".

   Source: Adapted from community discussion — tatendazw

   References

   • Microsoft Learn

   Next question

2. Question 292 · 394 in bank

   HOTSPOT - You have a Microsoft 365 tenant that contains a group named Group1 as shown in the Group1 exhibit. (Click the Group1 tab.)

   

   You create an enterprise application named App1 as shown in the App1 Properties exhibit. (Click the App1 Properties tab.)

   

   You configure self-service for App1 as shown in the App1 Self-service exhibit. (Click the App1 Self-service tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Just sharing my thoughts. 1. NO - Only direct members will have access. Approved users will be added to Group 1. 2. Yes - The approver will automatically become owner of the Group 1 after self service is configured. 3. NO - Visible to users is NO. So no one will be able to see the app.

   Source: Adapted from community discussion — J4U

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 293 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two attribute sets named Set1 and Set2. The subscription contains the users shown in the following table.

   

   You have the custom security attributes shown in the following table.

   

   You assign User2 the Attribute Definition Administrator role for Set1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   correct. User 1 cannot as Global Admin are not allowed any access on custom attributes. Only Attribute Definition Administrator has. https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-add?tabs=ms-powershell Secondly for user 2, it has received the role of Attribute Definition Administrator which does not have the permission to see values for any USERS. https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-manage?tabs=admin-center if you see the comparision table, you will notice it there.

   Source: Adapted from community discussion — anonymousarpanch

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 294 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant. You have 100 IT administrators who are organized into 10 departments. You create the access review shown in the exhibit. (Click the Exhibit tab.)

   

   You discover that all access review requests are received by Megan Bowen. You need to ensure that the manager of each department receives the access reviews of their respective department. Solution: You set Reviewers to Member (self). Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Correct: "Fallback reviewers are asked to do a review when the user has no manager specified in the directory or the group does not have an owner."

   Source: Adapted from community discussion — Beitran

   Next question

5. Question 295 · 394 in bank

   You have a Microsoft 365 tenant. The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain. You plan to create an emergency-access administrative account named Emergency1. Emergency1 will be assigned the Global administrator role in Azure AD. Emergency1 will be used in the event of Azure AD functionality failures and on-premises infrastructure failures. You need to reduce the likelihood that Emergency1 will be prevented from signing in during an emergency. What should you do?

   • AConfigure Azure Monitor to generate an alert if Emergency1 is modified or signs in.
   • BRequire Azure AD Privileged Identity Management (PIM) activation of the Global administrator role for Emergency1.
   • CConfigure a conditional access policy to restrict sign-in locations for Emergency1 to only the corporate network.
   • DConfigure a conditional access policy to require multi-factor authentication (MFA) for Emergency1.

   Show answer

   Answer: A

   Explanation

   The answer is stupid, because creating alert does not help with reducing the likelihood. But it is correct, because all other answers will create additional blockers to connect

   Source: Adapted from community discussion — MajorUrs

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 296 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.com. You implement entitlement management to provide resource access to users at a company named Fabrikam, Inc. Fabrikam uses a domain named fabrikam.com. Fabrikam users must be removed automatically from the tenant when access is no longer required. You need to configure the following settings: ✑ Block external user from signing in to this directory: No ✑ Remove external user: Yes ✑ Number of days before removing external user from this directory: 90 What should you configure on the Identity Governance blade?

   • AAccess packages
   • BEntitlement management settings
   • CTerms of use
   • DAccess reviews settings

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Entitlement management settings. The entitlement management settings page is where you configure the settings for managing access to resources in your Azure AD tenant. This includes settings for external users, such as whether to allow them to sign in and how long to keep their accounts active after their access is no longer required.

   Source: Adapted from community discussion — haazybanj

   References

   • Microsoft Learn

   Next question

7. Question 297 · 394 in bank

   You have an Azure Active Directory (Azure AD) P1 tenant. You need to review the Azure AD sign-in logs to investigate sign-ins that occurred in the past. For how long does Azure AD store events in the sign-in logs?

   • A14 days
   • B30 days
   • C90 days
   • D365 days

   Show answer

   Answer: B

   Explanation

   Correct - 30 days however this requires AADP1 or P2 licence as AD free only keeps 7 days of sign in logs. Wording should be clearer on question.

   Source: Adapted from community discussion — Eltooth

   Next question

8. Question 298 · 394 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   For which resources can you create an access review?

   • AGroup1, Role1, and Contributor only
   • BGroup1 only
   • CGroup1, App1, Contributor, and Role1
   • DRole1 and Contributor only

   Show answer

   Answer: C

   Explanation

   Yeah, it is possible to create access reviews for both Azure AND Azure AD roles. Tested in Azure portal. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review

   Source: Adapted from community discussion — researched_answer_boi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 299 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that uses conditional access policies. You plan to use third-party security information and event management (SIEM) to analyze conditional access usage. You need to download the Azure AD log by using the administrative portal. The log file must contain changes to conditional access policies. What should you export from Azure AD?

   • Aaudit logs in CSV format
   • Bsign-ins in CSV format
   • Caudit logs in JSON format
   • Dsign-ins in JSON format

   Show answer

   Answer: C

   Explanation

   You can also choose to download the filtered data, up to 250,000 records, by selecting the Download button. You can download the logs in either CSV or JSON format So this question, can be one of those that you will got Corect if you choose any of both csv or JSON, You can use the JSON transform feature in the Power Query Editor in Excel to split each property in the JSON object in the AuditData column into multiple columns so that each property has its own column. So my vote goes to C, JSON https://docs.microsoft.com/en-us/microsoft-365/compliance/export-view-audit-log-records?view=o365-worldwide

   Source: Adapted from community discussion — melatocaroca

   References

   • Microsoft Learn

   Next question

10. Question 300 · 394 in bank

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant. You have 100 IT administrators who are organized into 10 departments. You create the access review shown in the exhibit. (Click the Exhibit tab.)

    

    You discover that all access review requests are received by Megan Bowen. You need to ensure that the manager of each department receives the access reviews of their respective department. Solution: You add each manager as a fallback reviewer. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Answer: B

    Explanation

    The correct answer should be B: NO The option of Fallback reviewer is when you set as reviewer to the manager or group owner and somehow that user is not having a manager in the directory. In those case, the fallback reviewer, which could be a department head would be the reviewer. "Fallback reviewers are asked to do a review when the user has no manager specified in the directory or the group does not have an owner."

    Source: Adapted from community discussion — julioglez88

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 291. 394 questions available.