SC-300 practice questions 61–70

1. Question 61 · 394 in bank

   You have an Azure AD tenant that contains a user named User1 and a Microsoft 365 group named Group1. User1 is the owner of Group1. You need to ensure that User1 is notified every three months to validate the guest membership of Group1. What should you do?

   • AConfigure the External collaboration settings.
   • BCreate an access review.
   • CConfigure an access package.
   • DCreate a group expiration policy.

   Show answer

   Answer: B

   Explanation

   C. An access package is a bundle of resources that a team or project needs and is governed with policies. Access packages are defined in containers called catalogs. To reduce the risk of stale access, you should enable periodic reviews of users who have active assignments to an access package in entitlement management. You can enable reviews when you create a new access package or edit an existing access package assignment policy. D. Group expiration policy can help remove inactive groups from the system and make things cleaner. It only removes inactive groups, it will NOT validate guest membership of group. https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create https://learn.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-groups-expiration-policy?view=o365-worldwide

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 62 · 394 in bank

   You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to be notified if a user downloads more than 50 files in one minute from Site1. Which type of policy should you create in the Microsoft Defender for Cloud Apps?

   • Asession policy
   • Bactivity policy
   • Cfile policy
   • Dapp discovery policy

   Show answer

   Answer: B

   Next question

3. Question 63 · 394 in bank

   HOTSPOT - You have a Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1. Department1 has the users shown in the Users exhibit. (Click the Users tab.)

   

   Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)

   

   The User Administrator role assignments are shown in the Assignments exhibit (Click the Assignments tab.)

   

   The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   No No Yes Adding a group to an administrative unit brings the group itself into the management scope of the administrative unit, but not the members of the group. In other words, an administrator scoped to the administrative unit can manage properties of the group, such as group name or membership, but they cannot manage properties of the users or devices within that group (unless those users and devices are separately added as members of the administrative unit).

   Source: Adapted from community discussion — Bossdwarf

   References

   • Microsoft Learn

   

   Next question

4. Question 64 · 394 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains an Active Directory Federation Services (AD FS) instance and a member server named Server1 that runs Windows Server. The domain contains the users shown in the following table.

   

   You have a Microsoft Entra tenant named contoso.com that is linked to a Microsoft 365 subscription. You establish federation between fabrikam.com and contoso.com by using a Microsoft Entra Connect instance that is configured as shown in the following exhibit.

   

   You perform the following tasks in contoso.com: • Create a group named Group1. • Disable User2. • Enable User3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I would say: Yes: Group1 is created in the entra ID tenant, and the user is synced, so this is possible. It doesn't state that the group should be visible on-prem Yes: The user is a directory-synced user, so authority lies on-prem. Disabling it from the Entra ID portal will have no effect. The server is also an on-prem server. Disabling should be done in on-prem adds No: for the same reason as above, you enable the account in the entra id tenant, but the account is directory synced, so authority lies with the on-prem AD, enabling from the portal is not possible...

   Source: Adapted from community discussion — MatExam

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 65 · 394 in bank

   You have a Microsoft Entra tenant that contains the identities shown in the following table.

   

   You register an app named App1 in the tenant. To which identities can you assign the Owner role for App1?

   • AUser1 only
   • BUser1 and Group1 only
   • CUser1 and SP1 only
   • DUser1, Group1, and Group2 only
   • EUser1, Group1, and SP1 only
   • FUser1, Groupl, Group2, and SP1

   Show answer

   Answer: A

   Next question

6. Question 66 · 394 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.

   

   Which objects can you add as members to Group3?

   • AUser2 and Group2 only
   • BUser2, Group1, and Group2 only
   • CUser1, User2, Group1 and Group2
   • DUser1 and User2 only
   • EUser2 only

   Show answer

   Answer: E

   Explanation

   The answer is E - User2 Only. When you try to add a member to a Mail-enabled Security Group, you won't be able to see unlicensed Users. I had to test this when I saw contradictory comments.

   Source: Adapted from community discussion — Diginomad

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 67 · 394 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps and Conditional Access policies. You need to block access to cloud apps when a user is assessed as high risk. Which type of policy should you create in the Microsoft Defender for Cloud Apps?

   • Aapp discovery policy
   • BOAuth app policy
   • Cactivity policy
   • Daccess policy

   Show answer

   Answer: D

   Next question

8. Question 68 · 394 in bank

   HOTSPOT - You have a Microsoft Entra tenant that has a Microsoft Entra ID P2 service plan. The tenant contains the users shown in the following table.

   

   You have the Device settings shown in the following exhibit.

   

   User1 has the devices shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise. select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NOTE: Additional local administrators on Microsoft Entra joined devices: This setting allows you to select the users who are granted local administrator rights on a device. These users are added to the Device Administrators role in Microsoft Entra ID. Global Administrators in Microsoft Entra ID and device owners are granted local administrator rights by default. This option is a premium edition capability available through products like Microsoft Entra ID P1 or P2 and Enterprise Mobility + Security. https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-register https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-administrator-privileges-using-microsoft-entra-groups-preview https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities

   Source: Adapted from community discussion — penatuna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 69 · 394 in bank

   You have a Microsoft Entra tenant. You discover that a large number of new apps were added to the tenant. You need to implement an approval process for new enterprise applications. What should you do?

   • AFrom the Microsoft Defender portal, configure an app connector.
   • BFrom the Microsoft Entra admin center, configure an access review.
   • CFrom the Microsoft Defender portal, create an app detection policy.
   • DFrom the Microsoft Entra admin center, configure the Admin consent settings.

   Show answer

   Answer: D

   Next question

10. Question 70 · 394 in bank

    You have an Azure subscription named Sub1 that contains a user named User1. You need to ensure that User1 can purchase a Microsoft Entra Permissions Management license for Sub1. The solution must follow the principle of least privilege. Which role should you assign to User1?

    • AGlobal Administrator
    • BBilling Administrator
    • CPermissions Management Administrator
    • DUser Access Administrator

    Show answer

    Answer: B

    Explanation

    To complete this task, you must have at least Billing Administrator permissions. You can't enable Permissions Management as a user from another tenant who has signed in via B2B or via Azure Lighthouse. Prerequisites To enable Permissions Management in your organization: You must be eligible for or have an active assignment to the Permissions Management Administrator role as a user in that tenant. Therefore, I think that Permissions Management Administrator might be the best role. C. https://learn.microsoft.com/en-us/entra/permissions-management/onboard-enable-tenant

    Source: Adapted from community discussion — throwaway10188

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 61. 394 questions available.