SC-300 practice questions 311–320

1. Question 311 · 394 in bank

   You have a Microsoft 365 subscription that contains the following: ✑ An Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium P2 license ✑ A Microsoft SharePoint Online site named Site1 ✑ A Microsoft Teams team named Team1 You need to create an entitlement management workflow to manage Site1 and Team1. What should you do first?

   • AConfigure an app registration.
   • BCreate an Administrative unit.
   • CCreate an access package.
   • DCreate a catalog.

   Show answer

   Answer: D

   Explanation

   Went to my tenant, tried creating access package under resource Roles with teams and sharepoint site and it is saying No groups in Default catalog, however, there is a checkbox which allows all groups and teams NOT in default catalog to show up, so technically I CAN create access package without creating a catalog first, but this is MS and question says "First" so I pick D, Create a catalog

   Source: Adapted from community discussion — Zak366

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 312 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs. You receive more than 100 email alerts each day for failed Azure AD user sign-in attempts. You need to ensure that a new security administrator receives the alerts instead of you. Solution: From Azure Monitor, you modify the action group. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Yes, modifying the action group in Azure Monitor will allow you to change the recipient of the email alerts for failed Azure AD user sign-in attempts.

   Source: Adapted from community discussion — haazybanj

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 313 · 394 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the groups shown in the following table.

   

   The tenant contains the users shown in the following table.

   

   You create an access review as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   This should be N N N. User1's membership cannot be managed since he is a member of a nested group. User2's membership cannot be managed since he is a part of Group2 which is an AD group (not AAD). User3 is not the member of Group2.

   Source: Adapted from community discussion — f3dj4

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 314 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a web app named App1. Guest users are regularly granted access to App1. You need to ensure that the guest users that have NOT accessed App1 during the past 30 days have their access removed. The solution must minimize administrative effort. What should you configure?

   • Aa Conditional Access policy
   • Ba compliance policy
   • Ca guest access review
   • Dan access review for application access

   Show answer

   Answer: D

   Explanation

   The best answer is D. an access review for application access. Access reviews for application access allow you to review and approve or deny user access to specific applications. This is the most specific and targeted solution to the problem, as it allows you to focus on the guest users that have not accessed App1 in the past 30 days. Conditional access policies, compliance policies, and guest access reviews are all more general solutions that could be used to address the problem, but they would require more administrative effort to configure and manage.

   Source: Adapted from community discussion — haazybanj

   Next question

5. Question 315 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   User1 is the owner of Group1. You create an access review that has the following settings: ✑ Users to review: Members of a group ✑ Scope: Everyone ✑ Group: Group1 ✑ Reviewers: Members (self) Which users can perform access reviews for User3?

   • AUser1, User2, and User3
   • BUser3 only
   • CUser1 only
   • DUser1 and User2 only

   Show answer

   Answer: B

   Explanation

   - When Reviewers is set to Members (Self), then only each individual member can review their own access, and if they do not then it is reported as no response - [https://learn.microsoft.com/en-us/azure/active-directory/governance/create-access-review](https://learn.microsoft.com/en-us/azure/active-directory/governance/create-access-review) - [https://learn.microsoft.com/en-us/azure/active-directory/governance/create-access-review](https://learn.microsoft.com/en-us/azure/active-directory/governance/create-access-review)

   Source: Adapted from community discussion — ThotSlayer69

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 316 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) ten-ant: that contains the groups shown in the following table.

   

   You create an access review for Group1 as shown in the following table.

   

   You create an access review for Group2 as shown in the following table.

   

   What is the minimum member of Azure Active Directory Premium P2 licenses required for each group? To answer, select the appropriate, options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: 525 - For Group1: Review scope: All Users, Reviewers: Users review own access Note: How many licenses must you have? Your directory needs at least as many Azure AD Premium P2 licenses as the number of employees who will be performing the following tasks: Member users who are assigned as reviewers Member users who perform a self-review Member users as group owners who perform an access review Member users as application owners who perform an access review For guest users, licensing needs will depend on the licensing model you're using. However, the below guest users' activities are considered Azure AD Premium P2 usage: Guest users who are assigned as reviewers Guest users who perform a self-review Guest users as group owners who perform an access review Guest users as application owners who perform an access review Box 2: 1 - For Group2: Review scope: Guest users only. Reviewers: Group Owner. Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#license-requirements

   Source: Adapted from community discussion — jack987

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 317 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a group named All Company and has the following Identity Governance settings: ✑ Block external users from signing in to this directory: Yes ✑ Remove external user. Yes ✑ Number of days before removing external user from this directory: 30 On March 11, 2.022, you create an access package named Package1 that has the following settings: ✑ Resource rales 1. Name: All Company 2. Type: Group and Team 3. Role: Member ✑ Lifecycle 1. Access package assignment expire: On date 2. Assignment expiration date: April 1, 2022 On March 1, 2022, you assign Package1 to the guest users shown in the following table.

   

   On March 2, 2022, you assign the Reports reader role to Guest1. On April 1, 2022, you invite a guest user named Guest3 to contoso.com. On April 4, 2022, you add Guest3 to the All Company group. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - On March 2, 2022, you assign the Reports reader role to Guest1. On April 1 the access package assignment expires. After another 30 days, well before May 5, the guest user account is removed. Box 2: No - On April 1 the access package assignment expires. After another 30 days, well before May 5, the guest user account is removed. Box 3: Yes - Note: Lifecycle - On the Lifecycle tab, you specify when a user's assignment to the access package expires. You can also specify whether users can extend their assignments. In the Expiration section, set Access package assignments expires to On date, Number of days, Number of hours, or Never. For On date, select an expiration date in the future. For Number of days, specify a number between 0 and 3660 days. For Number of hours, specify a number of hours. Based on your selection, a user's assignment to the access package expires on a certain date, a certain number of days after they are approved, or never. Note 2: By default, when an external user no longer has any access package assignments, they are blocked from signing in to your directory. After 30 days, their guest user account is removed from your directory. Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-lifecycle-policy https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users

   Source: Adapted from community discussion — dobriv

   References

   • Microsoft Learn

   

   Next question

8. Question 318 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant named Contoso that contains a terms of use (Toll) named Terms1 and an access package. Contoso users collaborate with an external organization named Fabrikam. Fabrikam users must accept Terms1 before being allowed to use the access package. You need to identify which users accepted or declined Terms1. What should you use?

   • Asign-in logs
   • Bthe Usage and Insights report
   • Cprovisioning logs
   • Daudit logs

   Show answer

   Answer: D

   Explanation

   The correct answer is D. audit logs. Audit logs contain a record of all administrative actions and changes made within Azure AD, such as user and group management, application assignments, and policy modifications.

   Source: Adapted from community discussion — haazybanj

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 319 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   User1 is the owner of Group1. You create an access review that has the following settings: ✑ What to review: Teams + Groups ✑ Scope: All users ✑ Group: Group1 ✑ Reviewers: Users review their own access Which users can perform access reviews for User3?

   • AUser1 only
   • BUser3 only
   • CUser1 and User2 only
   • DUser1, User2, and User3

   Show answer

   Answer: B

   Explanation

   Correct answer is B: User3 You can ask the guests themselves or a decision maker to participate in an access review and recertify (or attest) to the guests' access. Refer to the below article: https://learn.microsoft.com/en-us/azure/active-directory/governance/manage-guest-access-with-access-reviews

   Source: Adapted from community discussion — JakeLi

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 320 · 394 in bank

    HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains three users named User1, User2, and User3. You create a group named Group1. You add User2 and User3 to Group1. You configure a role in Azure AD Privileged Identity Management (PIM) as shown in the Application Administrator exhibit. (Click the Application Administrator tab.)

    

    Group1 is configured as the approver for the Application administrator role. You configure User2 to be eligible for the Application administrator role. For User1 you add an assignment to the Application administrator role as shown in the Assignment exhibit. (Click the Assignment tab.)

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    N-Y-N 1. User1 is set as eligible, not active. 2. Approvers are not able to approve their own role activation requests. 3. Assignment expires on 31 Jan at 23:59. Full stop.

    Source: Adapted from community discussion — Nyamnyam

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 311. 394 questions available.