SC-300 practice questions 341–350

1. Question 341 · 394 in bank

   You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM). You need to identify users that are eligible for the Cloud Application Administrator role. Which blade in the Privileged Identity Management settings should you use?

   • AAzure resources
   • BPrivileged access groups
   • CReview access
   • DAzure AD roles

   Show answer

   Answer: D

   Explanation

   A. Role does not fit B. Blade does not exist C. Makes sense only if an access review would exist D: Easiest way: Azure AD roles -> Assignments Any other suggestions?

   Source: Adapted from community discussion — nils241

   Next question

2. Question 342 · 394 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You need to create a dynamic user group that will include all the users that do NOT have a department defined in their user profile. How should you complete the membership rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   user.department -eq null- "NOT DEFINED" user.department -eq null → Includes users where the department attribute is not set. user.department -eq "" → Includes users where the department attribute is set but empty.

   Source: Adapted from community discussion — rvln7

   References

   • Microsoft Learn

   

   Next question

3. Question 343 · 394 in bank

   You have an Azure AD Premium P2 tenant. You create a Log Analytics workspace. You need to ensure that you can view Azure AD audit log information by using Azure Monitor. What should you do first?

   • AModify the Diagnostics settings for Azure AD.
   • BRun the Update-MgOrganization cmdlet.
   • CRun the Update-MgDomain cmdlet.
   • DCreate an Azure AD workbook.

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Modify the Diagnostics settings for Azure AD. To ensure that you can view Azure AD audit log information by using Azure Monitor, you must first modify the Diagnostics settings for Azure AD to enable streaming of those logs to Azure Monitor.

   Source: Adapted from community discussion — haazybanj

   References

   • Microsoft Learn

   Next question

4. Question 344 · 394 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains two storage accounts named storage1 and storage2 and the blob containers shown in the following table.

   

   Sub1 contains the users shown in the following table.

   

   Condition1 has the following definition:

   

   NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

5. Question 345 · 394 in bank

   You have a Microsoft 365 subscription that contains the users shown in the following table.

   

   From the tenant, you configure a naming policy for groups. Which users are affected by the naming policy?

   • AUser2 only
   • BUser3only
   • CUser2 and User3 only
   • DUser3 and User4 only
   • EUser1, User2, and User3 only
   • FUser1, User2, User3, and User4

   Show answer

   Answer: D

   Explanation

   Admin override Some administrators are exempted from these policies, across all group workloads and endpoints, so that they can create groups with these blocked words and with their desired naming conventions. The following are the list of administrator roles exempted from the group naming policy. Global admin Partner Tier 1 Support Partner Tier 2 Support User account admin https://learn.microsoft.com/en-us/microsoft-365/solutions/groups-naming-policy?view=o365-worldwide#admin-override Some administrator roles are exempted from these policies, across all group workloads and endpoints, so that they can create groups using blocked words and with their own naming conventions. The following administrator roles are exempted from the group naming policy: Global Administrator User Administrator https://learn.microsoft.com/en-us/entra/identity/users/groups-naming-policy#roles-and-permissions

   Source: Adapted from community discussion — haazybanj

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 346 · 394 in bank

   You have an Azure subscription that contains the users shown in the following table.

   

   You need to implement Azure AD Privileged Identity Management (PIM). Which users can use PIM to activate their role permissions?

   • AAdmin1 only
   • BAdmin2 only
   • CAdmin3 only
   • DAdmin1 and Admin2 only
   • EAdmin2 and Admin3 only
   • FAdmin1, Admin2, and Admin3

   Show answer

   Answer: C

   Explanation

   Classic subscription administrator roles You cannot manage the following classic subscription administrator roles in Privileged Identity Management: Account Administrator Service Administrator Co-Administrator https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-roles

   Source: Adapted from community discussion — Krankenwagen

   References

   • Microsoft Learn

   Next question

7. Question 347 · 394 in bank

   HOTSPOT - You have an Azure AD tenant. You perform the tasks shown in the following table.

   

   On April 5, an administrator deletes App1, App2, App3, and App4. You need to restore the apps and the settings. Which apps can you restore on April 16, and which settings can you restore for App4 on April 16? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   After you delete an app registration, the app remains in a suspended state for 30 days. During that 30-day window, the app registration can be restored, along with all its properties. Box 1: App1, App2, App3, and App4 Box 2: App roles, Users and groups, client secrets, and Self-service https://learn.microsoft.com/en-us/entra/identity-platform/howto-restore-app

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 348 · 394 in bank

   Your company recently implemented Azure Active Directory (Azure AD) Privileged Identity Management (PIM). While you review the roles in PIM, you discover that all 15 users in the IT department at the company have permanent security administrator rights. You need to ensure that the IT department users only have access to the Security administrator role when required. What should you configure for the Security administrator role assignment?

   • AExpire eligible assignments after from the Role settings details
   • BExpire active assignments after from the Role settings details
   • CAssignment type to Active
   • DAssignment type to Eligible

   Show answer

   Answer: D

   Explanation

   I think the best way to read this question is "What should you configure FIRST for the Security administrator role assignment?" You would setup "D. Assignment type to Eligible" so the admins can request the role in future, for a limited time based on the Role Setting of "Activation maximum duration (hours): 8 (by default)" Only then would you set "B. Expire active assignments after from the Role settings details" So D is the correct answer.

   Source: Adapted from community discussion — 007Ali

   References

   • Microsoft Learn

   Next question

9. Question 349 · 394 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account. You deploy an Azure subscription and enable Microsoft 365 Defender. You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps. Solution: From the Microsoft 365 Defender portal, you add the GitHub app connector. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   The Microsoft Defender for Cloud Apps app permissions enable you to see which user-installed OAuth applications have access to Microsoft 365 data, Google Workspace data, and Salesforce data. Defender for Cloud Apps tells you what permissions the apps have and which users granted these apps access to their Microsoft 365, Google Workspace, and Salesforce accounts. https://learn.microsoft.com/en-us/defender-cloud-apps/manage-app-permissions#oauth-app-auditing

   Source: Adapted from community discussion — francescoc

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 350 · 394 in bank

    You have an Azure AD tenant. You plan to implement Azure AD Privileged Identity Management (PIM). Which roles can you manage by using PIM?

    • AGlobal Administrator only
    • BGlobal Administrator and Security Administrator only
    • CGlobal Administrator, Security Administrator, and Security Contributor only
    • DAccount Administrator, Global Administrator, Security Administrator, and Security Contributor only

    Show answer

    Answer: B

    Explanation

    Global Administrator and Security Administrator are Microsoft Entra roles, so you can manage them by using PIM. I cannot find Security Contributor role in links below, so I think it’s deprecated. If I remember correctly, there was this role in Microsoft Sentinel, but it’s now renamed Microsoft Sentinel Contributor. You cannot manage the following classic subscription administrator roles in Privileged Identity Management: Account Administrator Service Administrator Co-Administrator https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

    Source: Adapted from community discussion — penatuna

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 341. 394 questions available.