SC-300 practice questions 331–340

1. Question 331 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3. You have two Azure AD roles that have the Activation settings shown in the following table.

   

   The Azure AD roles have the Assignment settings shown in the following table.

   

   The Azure AD roles have the eligible users shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   N - Approvers cannot approve their own role activation requests (Topic 4 Question 34) N - User1 is not an approver for Role2 N - Justification is not required for Role1

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 332 · 394 in bank

   HOTSPOT - You have a hybrid Microsoft 365 subscription that contains the users shown in the following table.

   

   You plan to deploy an on-premises app named App1. App1 will be registered in Azure AD and will use Azure AD Application Proxy. You need to delegate the installation of the Application Proxy connector and ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which user should perform the installation, and which role should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The second answer might be Application developer. This MS Learn page says that you have to be at least a Cloud application administrator: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app However, another MS Learn page says that Application developer is enough: https://learn.microsoft.com/en-us/azure/active-directory/develop/web-app-tutorial-01-register-application I think I will go with Application developer, cause it's least privileged.

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 333 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   The users are assigned the roles shown in the following table.

   

   For which users can User1 and User4 reset passwords? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct User1 -> User2, User3, User4, User5 User4 -> User1, User2 & User3 Can reset passwords for non-administrators and Password Administrators https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#who-can-reset-passwords

   Source: Adapted from community discussion — kanag1

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 334 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a user named User1. User is eligible for the Application administrator role. User1 needs to configure a new connector group for an application proxy. What should you use to activate the role for User1?

   • Athe Microsoft Defender for Cloud Apps portal
   • Bthe Microsoft 365 admin center
   • Cthe Azure Active Directory admin center
   • Dthe Microsoft 365 Defender portal

   Show answer

   Answer: C

   Explanation

   The sentence "User1 needs to configure a new connector group for an application proxy" is there to just mess you up. Don't mind it. Correct answer is Azure AD Admin Center (now Microsoft Entra admin center). Look at the Charlies link.

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 335 · 394 in bank

   You have an Azure subscription that contains a registered app named App1. You need to review the sign-in activity for App1. The solution must meet the following requirements: • Identify the number of failed sign-ins. • Identify the success rate of sign-ins. • Minimize administrative effort. What should you use?

   • ASign-in logs
   • BAccess reviews
   • CAudit logs
   • DUsage & insights

   Show answer

   Answer: D

   Explanation

   A: sign in logs Admin needs to filter for app1 sign in D: usage and insights Already filtered view for app 1. Therefore answer is D

   Source: Adapted from community discussion — Sc300ExamDemo

   References

   • Microsoft Learn

   Next question

6. Question 336 · 394 in bank

   Your company has an Azure AD tenant that contains a user named User1. The company has two departments named marketing and finance. You need to grant permissions to User1 to manage only the users in the marketing department. The solution must ensure that User1 does NOT have permissions to manage the users in the finance department. What should you create first?

   • Aa management group
   • Ban administrative unit
   • Ca resource group
   • Da Microsoft 365 group

   Show answer

   Answer: B

   Explanation

   Correct answer. B. an administrative unit. "Administrative units restrict permissions in a role to any portion of your organization that you define. You could, for example, use administrative units to delegate the Helpdesk Administrator role to regional support specialists, so they can manage users only in the region that they support." https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units

   Source: Adapted from community discussion — cgonIT

   References

   • Microsoft Learn

   Next question

7. Question 337 · 394 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1. User1 has the devices shown in the following table.

   

   On November 5, 2020, you create and enforce terms of use in contoso.com that has the following settings: ✑ Name: Terms1 ✑ Display name: Contoso terms of use ✑ Require users to expand the terms of use: On ✑ Require users to consent on every device: On ✑ Expire consents: On ✑ Expire starting on: December 10, 2020 ✑ Frequency: Monthly On November 15, 2020, User1 accepts Terms1 on Device3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes because User1 has not yet accepted the terms on Device1. Box 2: Yes because User1 has not yet accepted the terms on Device2. User1 will be prompted to register the device before the terms can be accepted. Box 3: No because User1 has already accepted the terms on Device3. The terms do not expire until December 10 and then monthly after that. th Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/terms-of-use

   Source: Adapted from community discussion — Borbz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 338 · 394 in bank

   You have an Azure AD tenant that contains an access package named Package1 and a user named User1. Package1 is configured as shown in the following exhibit.

   

   You need to ensure that User1 can modify the review frequency of Package1. The solution must use the principle of least privilege. Which role should you assign to User1?

   • ASecurity administrator
   • BPrivileged role administrator
   • CExternal Identity Provider administrator
   • DUser administrator

   Show answer

   Answer: D

   Explanation

   Tried this with all the suggested answer, and none of them can modify the review frequency of Package1. See explanation below. Security Admin - Cannot update Policy Privileged role administrator - Gets “No access” to Access Packages. External Identity Provider administrator - Gets “No access” to Access Packages. User administrator - Gets “No access” to Access Packages. User administrator used to be the right choice for this question. However, things have now changed: The User Administrator role is no longer allowed to manage catalogs and access packages in Azure AD Entitlement Management. Please transition to the Identity Governance Administrator role to continue managing access without disruption, or go to the Entitlement Management settings page if you need to temporarily opt out. So, if there is an option in this question to choose Identity Governance Administrator, choose that. https://learn.microsoft.com/azure/active-directory/governance/identity-governance-overview?WT.mc_id=Portal-Microsoft_Azure_ELMAdmin#appendix---least-privileged-roles-for-managing-in-identity-governance-features

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 339 · 394 in bank

   HOTSPOT - You have an Azure subscription. Azure AD logs are sent to a Log Analytics workspace. You need to query the logs and graphically display the number of sign-ins per user. How should you complete the query? To answer, select the appropriate options in the answer area, NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   SigninLogs | where ResultType == 0 | summarize login_count = count() by Identity | render columnchart To view and query the logs, you will need to open Log Analytics, click on your workspace and then click on the Logs page. Logs are queried using a language called Kusto Query Language (KQL). Kusto Query Language (KQL) is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and more. The query uses schema entities that are organized in a hierarchy similar to SQLs: databases, tables, and columns. ResultType - The result of the sign-in operation can be 0 for success or an error code for failure. In this question it shows successful logins. The summarize operator is essential to performing aggregations over your data. The summarize operator groups together rows based on the by clause and then uses the provided aggregation function to combine each group in a single row. Find the number of events by Identity using summarize with the count aggregation function. Render operator instructs the user agent to render a visualization of the query results. In this question, it uses column chart.

   Source: Adapted from community discussion — penatuna

   

   Next question

10. Question 340 · 394 in bank

    You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps. You need to identify which users access Facebook from their devices and browsers. The solution must minimize administrative effort. What should you do first?

    • ACreate a Conditional Access policy.
    • BCreate a Defender for Cloud Apps access policy.
    • CCreate an app configuration policy in Microsoft Endpoint Manager.
    • DFrom the Microsoft Defender for Cloud Apps portal, unsanction Facebook.

    Show answer

    Answer: D

    Explanation

    Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the Cloud Discovery filters. You can then notify users of the unsanctioned app and suggest an alternative safe app for their use, or generate a block script using the Defender for Cloud Apps APIs to block all unsanctioned apps. https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

    Source: Adapted from community discussion — kanag1

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 331. 394 questions available.