SC-300 practice questions 301–310

1. Question 301 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.

   

   Which objects can you add as eligible in Azure AD Privileged Identity Management (PIM) for an Azure AD role?

   • AUser1, Guest1, and Identity1
   • BUser1 and Guest1 only
   • CUser1 only
   • DUser1 and Identity1 only

   Show answer

   Answer: B

   Explanation

   For Azure AD Privileged Identity Management (PIM), you can assign eligible roles to Azure AD user accounts but not to Managed Identities, as they are used for service-to-service authentications and do not require interactive access rights like human users. In the options provided: - User1 and Guest1 are both types of user accounts (regular and guest, respectively), so they can be added as eligible in PIM. - Identity1, being a Managed Identity, is not suitable for assignment in PIM. Therefore, the correct answer is **B. User1 and Guest1 only**.

   Source: Adapted from community discussion — Sc300ExamDemo

   Next question

2. Question 302 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the following group: ✑ Name: Group1 ✑ Members: User1, User2 ✑ Owner: User3 On January 15, 2021, you create an access review as shown in the exhibit. (Click the Exhibit tab.)

   

   Users answer the Review1 question as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I would say NO, YES, NO. According to the doc, "You can change your response at any time until the access review has ended" which refers to the duration of the review (15 days). Therefore, the user can change her response until January 29th, and will then be able to answer again on February 25th.

   Source: Adapted from community discussion — Elpida

   

   Next question

3. Question 303 · 394 in bank

   HOTSPOT - Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company has a business partner named Fabrikam, Inc. Fabrikam uses Azure AD and has two verified domain names of fabrikam.com and litwareinc.com. Both domain names are used for Fabrikam email addresses. You plan to create an access package named package1 that will be accessible only to the users at Fabrikam. You create a connected organization for Fabrikam. You need to ensure that the package1 will be accessible only to users who have fabrikam.com email addresses. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-request-policy https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-create

   Source: Adapted from community discussion — marsot

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 304 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains the groups shown in the following table.

   

   For which groups can you create an access review?

   • AGroup1 only
   • BGroup1 and Group4 only
   • CGroup1 and Group2 only
   • DGroup1, Group2, Group4, and Group5 only
   • EGroup1, Group2, Group3, Group4 and Group5

   Show answer

   Answer: D

   Explanation

   Tested: Technically you can create access review for Dynamic Device group (no errors/warnings during the creation), however it doesn't work and you will see a hitch "Warning - No access to review" for that access review in the list.

   Source: Adapted from community discussion — zmlapq99

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 305 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure AD Identity Protection policies enforced. You create an Azure Sentinel instance and configure the Azure Active Directory connector. You need to ensure that Azure Sentinel can generate incidents based on the risk alerts raised by Azure AD Identity Protection. What should you do first?

   • AAdd a Microsoft Sentinel data connector.
   • BConfigure the Notify settings in Azure AD Identity Protection.
   • CCreate a Microsoft Sentinel playbook.
   • DModify the Diagnostics settings in Azure AD.

   Show answer

   Answer: A

   Explanation

   Add a Microsoft Sentinel Data connector is the wrong answer. Meant to mislead. Because question itself mentions that AAD connector was added. Which seem to cover all AAD functionality including Identity Protection feature. What you are asked to do is generate incidents based on the risk alerts. For that you use playbooks in Sentinel. Which automates tasks that SOC engineers need to such as generte risk alerts. So answer is C.

   Source: Adapted from community discussion — DeepMoon

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 306 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs. You receive more than 100 email alerts each day for failed Azure AD user sign-in attempts. You need to ensure that a new security administrator receives the alerts instead of you. Solution: From Azure AD, you create an assignment for the Insights administrator role. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   The Insights administrator role in Azure AD is primarily focused on providing access to insights and logs, but it does not control the configuration of alerts or notifications. To change the recipient of the alerts, you would need to adjust the alert settings within Azure Monitor. Specifically, you would need to:Navigate to Azure Monitor and locate the alert rules.Edit the alert rule to change the action group or notification settings.Specify the new security administrator's contact details in the action group to ensure they receive the alerts.Simply assigning the Insights administrator role will not redirect the alert emails to the new security administrator. Therefore, the correct answer remains: B. No.

   Source: Adapted from community discussion — Sc300ExamDemo

   References

   • Microsoft Learn

   Next question

7. Question 307 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs. You receive more than 100 email alerts each day for failed Azure AD user sign-in attempts. You need to ensure that a new security administrator receives the alerts instead of you. Solution: From Azure AD, you modify the Diagnostics settings. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Modifying the Diagnostics settings in Azure AD is one way to ensure that a new security administrator receives the alerts instead of you for failed Azure AD user sign-in attempts. To do this, follow these steps: Sign in to the Azure portal as a global administrator or security reader. Navigate to Azure Active Directory > Diagnostic settings. Select the diagnostic setting that you want to modify. In the email notification section, add the email address of the new security administrator. Click Save to apply the changes. This will ensure that the new security administrator receives email alerts for failed Azure AD user sign-in attempts, instead of you.

   Source: Adapted from community discussion — Nazir97

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 308 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs. You receive more than 100 email alerts each day for failed Azure AD user sign-in attempts. You need to ensure that a new security administrator receives the alerts instead of you. Solution: From Azure Monitor, you create a data collection rule. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Given Answer is Correct. Data Collection Rules is not the way to go here. Data Collection Rules (DCRs) define the data collection process in Azure Monitor. DCRs specify what data should be collected, how to transform that data, and where to send that data. Some DCRs will be created and managed by Azure Monitor to collect a specific set of data to enable insights and visualizations. From

   Source: Adapted from community discussion — DeepMoon

   Next question

9. Question 309 · 394 in bank

   You have an Azure Active Directory Premium P2 tenant. You create a Log Analytics workspace. You need to ensure that you can view Azure Active Directory (Azure AD) audit log information by using Azure Monitor. What should you do first?

   • ARun the Set-AzureADTenantDetail cmdlet.
   • BCreate an Azure AD workbook.
   • CModify the Diagnostics settings for Azure AD.
   • DRun the Get-AzureADAuditDirectoryLogs cmdlet.

   Show answer

   Answer: C

   Explanation

   Given Answer is Correct. AAD/Diagnostic Settings/Add Diagnostic Settings/Export Settings/Send to Log Analytic Workspace https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor Hybrid identity and access management best practices - BRK3243

   Source: Adapted from community discussion — DeepMoon

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 310 · 394 in bank

    HOTSPOT - You have an Azure Active Directory (Azure AD) tenant contains the users shown in the following table.

    

    In Azure AD Privileged Identity Management (PIM), you configure the Global administrator role as shown in the following exhibit.

    

    User1 is eligible for the Global administrator role. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: Yes - MFA is required on activation - Box 2: No - The Privileged Authentication Administrator can set or reset any authentication method for any user, including Global Administrators. The Privileged Role Administrator can manage role assignments, including the Global Administrator role, in Azure Active Directory, as well as within Azure AD Privileged Identity Management. In addition, this role allows management of all aspects of Privileged Identity Management and administrative units. Box 3: No - The Privileged Authentication Administrator can set or reset any authentication method for any user, including Global Administrators. The Privileged Role Administrator can manage role assignments, including the Global Administrator role, in Azure Active Directory, as well as within Azure AD Privileged Identity Management. In addition, this role allows management of all aspects of Privileged Identity Management and administrative units.

    Source: Adapted from community discussion — dejo

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 301. 394 questions available.