SC-300 practice questions 81–90

1. Question 81 · 394 in bank

   You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users. You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort. What should you use?

   • Athe Set-WindowsProductKey cmdlet
   • Bthe Update-MgGroup cmdlet
   • Cthe Set-MgUserLicense cmdlet
   • Dthe Update-MgUser cmdlet

   Show answer

   Answer: C

   Explanation

   C. the Set-MgUserLicense cmdlet To remove the Office 365 Enterprise E3 licenses from the users who are now part of a group with Office 365 Enterprise E5 licenses assigned, you should use the Set-MgUserLicense cmdlet. This cmdlet allows you to modify the licenses assigned to a user. By using this cmdlet, you can remove the Office 365 Enterprise E3 licenses from all users who are part of the group where you assigned the Office 365 Enterprise E5 licenses.

   Source: Adapted from community discussion — dzdz

   References

   • Microsoft Learn

   Next question

2. Question 82 · 394 in bank

   DRAG DROP - You have an on-premises Microsoft Exchange organization that uses an SMTP address space of contoso.com. You discover that users use their email address for self-service sign-up to Microsoft 365 services. You need to gain global administrator privileges to the Azure Active Directory (Azure AD) tenant that contains the self-signed users. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-admin-takeover

   Source: Adapted from community discussion — slayer78

   References

   • Microsoft Learn

   

   Next question

3. Question 83 · 394 in bank

   Your company has a Microsoft Entra tenant that contains a user named User1. The company has two departments named marketing and finance. You need to grant permissions to User1 to manage only the users in the marketing department. What should you create first?

   • Aa Microsoft 365 group
   • Ban administrative unit
   • Ca management group
   • Da resource group

   Show answer

   Answer: B

   Next question

4. Question 84 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to ensure the owner of each Microsoft 365 group is notified to renew their group every 180 days. Groups that are NOT renewed must be deleted. For groups without an owner, the notifications must be sent to Allan Deyoung. To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Entra ID | Groups | Expiration - Group lifetime (in days): 180 - Email contact for groups with no owners: correo@correo.com - Enable expiration for these Microsoft 365 groups: All

   Source: Adapted from community discussion — Oskarma

   

   Next question

5. Question 85 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to prevent all users from using passwords that are variations of the word Falcon. To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Entra ID | Authentication methods | Password protection - Custom banned passwords - Enforce custom list: Yes - Custom banned password list: Falcon

   Source: Adapted from community discussion — Oskarma

   

   Next question

6. Question 86 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to assign a Windows 10/11 Enterprise E3 license to the sg-Retail group. To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Microsoft 365 | Billing | Licenses | Windows 10/11 Enterprise E3 - Groups tab - Assign licenses - Choose sg-Retail - Assign

   Source: Adapted from community discussion — Oskarma

   

   Next question

7. Question 87 · 394 in bank

   SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to create a group named Audit. The solution must ensure that the members of Audit can activate the Security Reader role. To complete this task, sign in to the appropriate admin center.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Entra ID (it’s possible from Microsoft 365 admin center too) | Groups | All groups - New group - Group name: Audit - Microsoft Entra roles can be assigned to the group: Yes - Create

   Source: Adapted from community discussion — Oskarma

   

   Next question

8. Question 88 · 394 in bank

   HOTSPOT - You have a Microsoft Entra tenant named contoso.com that contains an administrative unit named AU1 and two users named User1 and User2. User1 is a member of AU1. You need to perform the following role assignments: • User1: Security Administrator • User2: User Administrator For which scopes can each user be assigned the role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   thats right 1. Security Admin cannot be scoped to AUs 2. you dont need to be memeber of AU to be given administrative rights to it;

   Source: Adapted from community discussion — armid

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 89 · 394 in bank

   You have an Azure subscription that contains a storage account named storage1. You plan to deploy an app named App1 that will be hosted on multiple virtual machines. The virtual machines will authenticate to a third-party API by using secrets. You need to recommend an authentication solution for the virtual machines. The solution must meet the following requirements: • Securely store secrets. • Ensure that credentials do NOT need to be stored in the App1 code. • Ensure that the virtual machines can access Azure resources by using Microsoft Entra authentication • Minimize administrative effort. What should you include in the recommendation?

   • Auser accounts and Storage Service Encryption
   • Buser-assigned managed identities and Azure Key Vault
   • Cuser accounts and Azure Key Vault
   • Dsystem assigned managed identities and Storage Service Encryption

   Show answer

   Answer: B

   Explanation

   The best recommendation for your scenario is B. user-assigned managed identities and Azure Key Vault. Here's why: Securely Store Secrets: Azure Key Vault is designed to securely store and manage secrets, keys, and certificates. Credentials Not in Code: By using managed identities, you avoid hardcoding credentials in your application code. Managed identities allow your virtual machines to authenticate to Azure Key Vault without storing credentials in the code. Microsoft Entra Authentication: Managed identities use Microsoft Entra ID (formerly Azure AD) for authentication, ensuring secure access to Azure resources. Minimize Administrative Effort: User-assigned managed identities provide flexibility and can be reused across multiple resources, reducing administrative overhead12. This combination ensures secure, efficient, and manageable authentication for your virtual machines and their interactions with the third-party API.

   Source: Adapted from community discussion — test123123

   Next question

10. Question 90 · 394 in bank

    HOTSPOT - You have an Azure subscription named Sub1 that contains the resources shown in the following table.

    

    Sub1 contains the managed identities shown in the following table.

    

    Sub1 has the role-based access control (RBAC) role assignments shown in the following table.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    1: Automation1 has Identity1 assigned to it. Identity1 has the Key Vault Secrets User role at the RG2 scope. Vault1 is in RG1, not RG2. Since Identity1 has access to secrets in RG2, but Vault1 is in RG1, Automation1 cannot access the secrets in Vault1. Answer: ❌ No 2: Identity2 is a system-assigned managed identity for Automation2. Identity2 has the Key Vault Secrets User role at the Subscription (Sub1) level. Sub1 includes RG1, where Vault1 is located. Since Identity2 has permission at the subscription level, which includes RG1, it already has access to Vault1. Answer: ✅ Yes 3: VM1 has Identity3 assigned to it. Identity3 has the Key Vault Secrets User role at the RG1 scope. Vault1 is in RG1. Since Identity3 has permissions for RG1, and Vault1 is in RG1, VM1 can access the secrets in Vault1. Answer: ✅ Yes

    Source: Adapted from community discussion — Frank9020

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 81. 394 questions available.