SC-300 practice questions 351–360

1. Question 351 · 394 in bank

   You have a Microsoft 365 tenant. In Microsoft Entra ID, you configure the terms of use. You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access. What should you configure?

   • ATerms and conditions in Microsoft Intune
   • Ban access policy in Microsoft Defender for Cloud Apps
   • Ca conditional access policy in Microsoft Entra ID
   • Da compliance policy in Microsoft Intune

   Show answer

   Answer: C

   Explanation

   C. a conditional access policy in Microsoft Entra ID. A conditional access policy is a feature that allows you to enforce granular controls over access to cloud apps based on user, location, device, and app. You can use a conditional access policy along with terms of use to require users to accept the terms of use policy before getting access to the resources in the tenant. You can also designate reviewers who can view and act on the consent requests in the Microsoft 365 admin center.

   Source: Adapted from community discussion — Sozo

   Next question

2. Question 352 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a user named User1. User1 is eligible for the Application Administrator role. User1 needs to configure a new connector group for an application proxy. What should you use to activate the role for User1?

   • Athe Microsoft 365 Defender portal
   • Bthe Microsoft 365 admin center
   • Cthe Microsoft Intune admin center
   • Dthe Azure Active Directory admin center

   Show answer

   Answer: D

   Explanation

   The question is only about activating the role with PIM, don’t let the sentence about connector group to mess you up. When you need to assume a Microsoft Entra role, you can request activation by opening My roles in Privileged Identity Management. NOTE! Azure Active Directory admin center is now Microsoft Entra admin center. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-activate-role#activate-a-role

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn

   Next question

3. Question 353 · 394 in bank

   Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a certification authority (CA) named CA1. You have an Azure AD tenant. You need to implement certificate-based authentication in Azure AD. The solution must ensure that users can sign in by using certificates issued by CA1. What should you do first?

   • ADeploy an Azure key vault.
   • BAdd CA1 as a Certificate Authority to the Microsoft Entra ID tenant.
   • CEnable auto-enrollment for CA1.
   • DDeploy Windows Hello for Business.

   Show answer

   Answer: B

   Explanation

   I think answer is correct Ref: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication Prerequisites Make sure that the following prerequisites are in place: Configure at least one certification authority (CA) and any intermediate CAs in Microsoft Entra ID. The user must have access to a user certificate (issued from a trusted Public Key Infrastructure configured on the tenant) intended for client authentication to authenticate against Microsoft Entra ID. Each CA should have a certificate revocation list (CRL) that can be referenced from internet-facing URLs. If the trusted CA doesn't have a CRL configured, Microsoft Entra ID won't perform any CRL checking, revocation of user certificates won't work, and authentication won't be blocked.

   Source: Adapted from community discussion — cpaljchc4

   References

   • Microsoft Learn

   Next question

4. Question 354 · 394 in bank

   You have accounts for the following cloud platforms: • Azure • Alibaba Cloud • Amazon Web Services (AWS) • Google Cloud Platform (GCP) You configure an Azure subscription to use Microsoft Entra Permissions Management to manage the permissions in Azure only. Which additional cloud platforms can be managed by using Permissions Management?

   • AAWS only
   • BAlibaba Cloud and AWS only
   • CAlibaba Cloud and GCP only
   • DAWS and GCP only
   • EAlibaba Cloud, AWS, and GCP

   Show answer

   Answer: D

   Explanation

   As a multicloud product, Permissions Management offers a comprehensive experience across multiple cloud environments; Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). Permissions Management provides you with granular visibility into what's happening in your cloud environments and offers actionable insights on both a high- and low-level. Just a few of the things that Permissions Management can help you discover are: • Exposed/Vulnerable storage containers • Over-permissioned users and groups • Inactive users, groups, resources, and applications • Global Administrator identities in your environment • Open network security groups https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 355 · 394 in bank

   You have three Azure subscriptions that are linked to a single Microsoft Entra tenant. You need to evaluate and remediate the risks associated with highly privileged accounts. The solution must minimize administrative effort. What should you use?

   • AGlobal Secure Access
   • BPrivileged Identity Management (PIM)
   • CMicrosoft Entra Permissions Management
   • DMicrosoft Entra Verified ID

   Show answer

   Answer: B

   Explanation

   To evaluate and remediate the risks associated with highly privileged accounts across multiple Azure subscriptions linked to a single Microsoft Entra tenant, you should use Privileged Identity Management (PIM) (Option B). Microsoft Entra PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. It helps you manage, control, and monitor access within your organization, which includes access to Azure resources and other Microsoft services. Please note that while Microsoft Entra Permissions Management can provide visibility into permissions across multicloud infrastructures, it doesn’t specifically target the management of highly privileged accounts. Global Secure Access and Microsoft Entra Verified ID do not provide the specific capabilities required for this scenario.

   Source: Adapted from community discussion — Steingalen

   Next question

6. Question 356 · 394 in bank

   You have an Azure subscription named Sub1 that uses Microsoft Entra Permissions Management. Sub1 contains a user named User1. User1 is granted multiple permissions across Sub1. You need to replace all the permissions granted to User1 with read-only permissions. The solution must minimize administrative effort. What should you do on the Remediation tab in Permissions Management?

   • AFrom the Role/Policy Template subtab, create a template.
   • BFrom the My Requests subtab, create a new request.
   • CFrom the Roles/Policies subtab, create a role.
   • DFrom the Permissions subtab, use a quick action.

   Show answer

   Answer: D

   Explanation

   There are four quick actions that can be used to manage users: Revoke Unused Tasks Revoke High-Risk Tasks Revoke Delete Tasks Assign Read-Only Status https://learn.microsoft.com/en-us/training/permissions-management/explore-features-of-permissions-management/9-act-on-your-findings-with-remediation-tab

   Source: Adapted from community discussion — Saynot

   References

   • Microsoft Learn

   Next question

7. Question 357 · 394 in bank

   You have an Azure subscription that contains a user named User1. The subscription is onboarded to Microsoft Entra Permissions Management. You need to provide User1 with access to Permissions Management. The solution must meet the following requirements: • Follow the principle of least privilege. • Minimize administrative effort. What should you do first?

   • AFrom the Role/Policy Template subtab of Permissions Management, create a template.
   • BFrom the Microsoft Entra admin center, create a security group.
   • CFrom the My Requests subtab of Permissions Management, create a new request.
   • DFrom the Microsoft Entra admin center, assign a role to User1.

   Show answer

   Answer: B

   Explanation

   "Permissions Management entitlements work through group-based access. To add a new user, you must add a user to a group through Microsoft Entra ID." https://learn.microsoft.com/en-us/entra/permissions-management/how-to-add-remove-user-to-group https://learn.microsoft.com/en-us/answers/questions/1504869/how-to-grant-end-user-reader-access-to-entra-permi

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 358 · 394 in bank

   DRAG DROP - You have an Azure subscription that contains the resources shown in the following table.

   

   The subscription uses Privileged Identity Management (PIM). You need to configure the following access controls by using PIM: • Ensure that User1 can read and update Secret1. • Ensure that User2 can read the contents of the secrets stored in Vault2. The solution must follow the principle of least privilege. Which authorization method should you use for each user? To answer, drag the appropriate authorization methods to the correct users. Each authorization method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Questions says: ”You need to configure the following access controls by using PIM”. So, with PIM, you’ll need a (RBAC) role, so you cannot use Access Policy permissions. For User1, the least privileged role is Key Vault Secrets Officer. Key Vault Secrets Officer can perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model. For User2, the least privileged role is Key Vault Secrets User. Key Vault Secrets User can read secret contents including secret portion of a certificate with private key. Only works for key vaults that use the 'Azure role-based access control' permission model. NOTE! In reality, the better way would be to use custom role for more fine-grained permissions. https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-migration

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 359 · 394 in bank

   You have a Microsoft 365 tenant. The Sign-ins activity report shows that an external contractor signed in to the Exchange admin center. You need to review access to the Exchange admin center at the end of each month and block sign-ins if required. What should you create?

   • Aan access package that targets users outside your directory
   • Ban access package that targets users in your directory
   • Ca group-based access review that targets guest users
   • Dan application-based access review that targets guest users

   Show answer

   Answer: C

   Explanation

   Answer: C You can target a group with a conditional policy to detect and remediate the login at the end of each month Not valid, A, B, D D admin is not using an app is using a privileged role to use Exchange admin center A and B No An access package. A bundle of resources that a team or project needs and is governed with policies. Access packages are defined in containers called catalogs. To reduce the risk of stale access, you should enable periodic reviews of users who have active assignments to an access package in Azure AD entitlement management

   Source: Adapted from community discussion — melatocaroca

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 360 · 394 in bank

    HOTSPOT - You have two Azure subscriptions named Sub1 and Sub2 that are linked to a Microsoft Entra tenant. The tenant contains three groups named Group1, Group2, and Group3. The subscriptions contain the resources shown in the following table.

    

    The tenant contains the users shown in the following table.

    

    You manage the subscriptions by using Microsoft Entra Permissions Management. Permissions Management is configured as shown in the following table.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    No - User1 is part of the group that can request access to sub1, not sub2 No - User1 can request access to Sub1 on behalf of other identities, not user2 Yes - User3's group can approve access requests for all subscriptions

    Source: Adapted from community discussion — Sneekygeek

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 351. 394 questions available.