Get SC-300 Actual Free Exam Q&As to Prepare for Your Microsoft Certification
Microsoft Actual Free Exam Questions And Answers
Microsoft SC-300 exam is an essential certification for individuals who want to enhance their skills and knowledge in managing and securing identity and access solutions in Microsoft Azure and other Microsoft cloud services. By passing SC-300 exam and earning the certification, candidates can demonstrate their proficiency to potential employers and advance their careers in the IT and security industry.
Microsoft SC-300 Certification Exam is a great opportunity for professionals who want to advance their career in the field of Identity and Access Management. Microsoft Identity and Access Administrator certification exam is recognized by Microsoft and is a valuable credential that demonstrates the candidate's skills and knowledge in managing Identity and Access solutions in Microsoft Azure. Microsoft Identity and Access Administrator certification can help the candidates to stand out in the job market and can lead to better job opportunities and higher salaries.
Microsoft SC-300 exam is a rigorous and comprehensive certification exam that tests the skills and knowledge of IT professionals in managing user identities and access in cloud-based environments. By passing SC-300 exam, IT professionals can demonstrate their expertise in this critical area of IT, and advance their careers in identity and access management.
NEW QUESTION # 131
You have a Microsoft 365 tenant that has 5,000 users. One hundred of the users are executives. The executives have a dedicated support team.
You need to ensure that the support team can reset passwords and manage multi-factor authentication (MFA) settings for only the executives. The solution must use the principle of least privilege.
Which object type and Azure Active Directory (Azure AD) role should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 132
You have a Microsoft Entra tenant that contains two remote networks named RemoteNetworkl and RemoteNetwork2 and the users shown in the following table.
You have the devices shown in the following table.
Answer:
Explanation:
Explanation:
NEW QUESTION # 133
You have a Microsoft 365 tenant named contoso.com.
Guest user access is enabled.
Users are invited to collaborate with contoso.com as shown in the following table.
From the External collaboration settings in the Azure Active Directory admin center, you configure the Collaboration restrictions settings as shown in the following exhibit.
From a Microsoft SharePoint Online site, a user invites [email protected] to the site.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Yes
Invitations can only be sent to outlook.com. Therefore, User1 can accept the invitation and access the application.
Box 2. Yes
Invitations can only be sent to outlook.com. However, User2 has already received and accepted an invitation so User2 can access the application.
Box 3. No
Invitations can only be sent to outlook.com. Therefore, User3 will not receive an invitation.
NEW QUESTION # 134
You have an Azure AD tenant that contains the users shown in the following table.
You enable self-service password reset (SSPR) for all the users and configure SSPR to require security questions as the only authentication method.
Which users must use security questions when resetting their password?
- A. User1, User3, and User4 only
- B. User4 only
- C. User1, User2, User3, and User4
- D. User1 and User4 only
- E. User3 and User4 only
Answer: E
Explanation:
Basically, some administrative roles, by design can only use strong, two-gate password reset policy, regardles of SSPR settings.
User Administrator and Password Administrator will be always forced to use two methods and cannot use security questions.
Securiry Reader and User will use whatever is set under SSPR, so security questions in this case.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr- policy#administrator-reset-policy-differences
NEW QUESTION # 135
You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.
Which objects can you add as members to Group3?
- A. User2, Group1, and Group2 only
- B. User2 only
- C. User1 and User2 only
- D. User1, User2, Group1 and Group2
- E. User2 and Group2 only
Answer: C
Explanation:
Azure AD supports several group types with different membership rules. For Microsoft 365 groups, "group nesting isn't supported; only user identities can be members." For mail-enabled security groups used in Azure AD/Exchange Online, the SC-300 materials emphasize that only user objects are supported as members when managed in Azure AD, while "Microsoft 365 groups can't be added to other groups." Security groups are commonly nestable for access scenarios, but the mail-enabled security group membership experience in Azure AD limits member selection to users; thus you cannot add Group1 (security group) or Group2 (Microsoft 365 group) as members of Group3 (mail-enabled security group). Licensing assignments shown in the table are irrelevant to membership eligibility. Consequently, the only valid members you can add to Group3 are the user objects - User1 and User2.
NEW QUESTION # 136
You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3.
You have two Azure AD roles that have the Activation settings shown in the following table.
The Azure AD roles have the Assignment settings shown in the following table.
The Azure AD roles have the eligible users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 137
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1 and the groups shown in the following table.
In the tenant, you create the groups shown in the following table.
Which members can you add to GroupA and GroupB? To answer, select the appropriate options in the answer area.
NOTE:Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://bitsizedbytes.wordpress.com/2018/12/10/distribution-security-and-office-365-groups-nesting/
NEW QUESTION # 138
You need to implement the planned changes and technical requirements for the marketing department.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-organization
NEW QUESTION # 139
You have an Azure subscription that contains the resources shown in the following table.
You need to configure access to Vault1. The solution must meet the following requirements:
* Ensure that User1 can manage and create keys in Vault1.
* Ensure that User2 can access a certificate stored in Vault1.
* Use the principle of least privilege.
Which role should you assign to each user? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
A screenshot of a computer Description automatically generated
NEW QUESTION # 140
You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.
Which objects can you add as eligible in Azure Privileged identity Management (PIM) for an Azure AD role?
- A. User1 and Guest1 only
- B. User1 only
- C. User1. Guest1, and Identity
- D. User1 and Identity1 only
Answer: A
Explanation:
According to the Microsoft SC-300: Identity and Access Administrator Study Guide and official Microsoft Learn content under "Manage Azure AD roles in Privileged Identity Management (PIM)", Azure AD Privileged Identity Management (PIM) allows organizations to assign eligible roles to users who need on- demand administrative access.
The official documentation specifies the following:
* User accounts (members of the tenant) can be added as eligible for Azure AD roles.
* Guest users (B2B collaboration users) can also be added as eligible for Azure AD roles, provided they exist in the Azure AD directory and are properly invited.
* Managed identities, however, cannot be assigned Azure AD directory roles. Managed identities are designed for service-to-service authentication within Azure resources and cannot perform administrative directory functions in Azure AD. They are used with Azure resources such as Virtual Machines, Logic Apps, or Azure Functions - not with Azure AD administrative roles.
From Microsoft documentation:
"Privileged Identity Management (PIM) supports user and guest accounts for eligible role assignment.
Managed identities cannot be assigned Azure AD directory roles."
NEW QUESTION # 141
You have an Azure subscription.
Azure AD logs are sent to a Log Analytics workspace.
You need to query the logs and graphically display the number of sign-ins per user.
How should you complete the query? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
NEW QUESTION # 142
You have a Microsoft 365 tenant.
You need to identify users who have leaked credentials. The solution must meet the following requirements.
* Identity sign-Ins by users who ate suspected of having leaked credentials.
* Rag the sign-ins as a high risk event.
* Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module "Implement and manage Azure AD Identity Protection," Azure AD Identity Protection is the service responsible for detecting risky behaviors such as leaked credentials, suspicious sign-ins, and compromised accounts in a Microsoft 365 or Azure AD environment.
Identity Protection automatically flags leaked or compromised credentials detected through Microsoft's threat intelligence signals and dark web monitoring. It classifies these users with a high user risk level.
"Identity Protection detects leaked credentials and marks the user risk as high when evidence of compromise is found." Thus, the feature used for this classification is Azure AD Identity Protection.
Remediation for leaked credentials is driven by User Risk policies. The User risk policy in Identity Protection can automatically respond to users identified as high-risk. This triggers actions such as forcing a password reset.
"User risk policy can be configured to respond to risky users by requiring password change or blocking access." Hence, User risk is the correct trigger.
To allow users to continue accessing applications after remediation, the proper action is Grant access but require password change. This enforces an immediate credential reset to mitigate the compromise but still allows access once the user remediates their risk.
"To automatically remediate high user risk while maintaining access, configure the policy to grant access but require a password change."
NEW QUESTION # 143
Task 6
You need to implement additional security checks before the members of the Sg-Executive can access any company apps. The members must meet one of the following conditions:
* Connect by using a device that is marked as compliant by Microsoft Intune.
* Connect by using client apps that are protected by app protection policies.
Answer:
Explanation:
See the Explanation for the complete step by step solution
Explanation:
To implement additional security checks for the Sg-Executive group members before they can access any company apps, you can use Conditional Access policies in Microsoft Entr a. Here's a step-by-step guide:
Sign in to the Microsoft Entra admin center:
Ensure you have the role of Global Administrator or Security Administrator.
Navigate to Conditional Access:
Go to Security > Conditional Access.
Create a new policy:
Select + New policy.
Name the policy appropriately, such as "Sg-Executive Security Checks".
Assign the policy to the Sg-Executive group:
Under Assignments, select Users and groups.
Choose Select users and groups and then Groups.
Search for and select the Sg-Executive group.
Define the application control conditions:
Under Cloud apps or actions, select All cloud apps to apply the policy to any company app.
Set the device compliance requirement:
Under Conditions > Device state, configure the policy to include devices marked as compliant by Microsoft Intune.
Set the app protection policy requirement:
Under Conditions > Client apps, configure the policy to include client apps that are protected by app protection policies.
Configure the access controls:
Under Access controls > Grant, select Grant access.
Choose Require device to be marked as compliant and Require approved client app.
Ensure that the option Require one of the selected controls is enabled.
Enable the policy:
Set Enable policy to On.
Review and save the policy:
Review all settings to ensure they meet the requirements.
Click Create to save and implement the policy.
By following these steps, you will ensure that the Sg-Executive group members can only access company apps if they meet one of the specified conditions, either by using a compliant device or a protected client app. This enhances the security posture of your organization by enforcing stricter access controls for executive-level users.
NEW QUESTION # 144
You have a Microsoft Entra tenant that contains the users shown in the following table.
You have a user risk policy that has the following settings:
* Assignments:
o Include: Group1
o Exclude: Group2
* Sign-in risk Medium and above
* Access controls:
o Grant access: Require password change
When the users attempt to sign in. user risk levels are detected as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Answer:
Explanation:
Explanation:
NEW QUESTION # 145
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1 and the groups shown in the following table.
In the tenant, you create the groups shown in the following table.
Which members can you add to GroupA and GroupB? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Reference:
https://bitsizedbytes.wordpress.com/2018/12/10/distribution-security-and-office-365-groups-nesting/
NEW QUESTION # 146
You have an Azure subscription that contains the custom roles shown in the following table.
You need to create a custom Azure subscription role named Role3 by using the Azure portal.
Role3 will use the baseline permissions of an existing role.
Which roles can you clone to create Role3?
- A. built-in Azure subscription roles and Role2 only
- B. Role2 only
- C. built-in Azure subscription roles only
- D. Role1, Role2 built-in Azure subscription roles, and built-in Azure AD roles
- E. built-in Azure subscription roles and built-in Azure AD roles only
Answer: A
Explanation:
https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal#clone-a- role
NEW QUESTION # 147
You need to support the planned changes and meet the technical requirements for MFA.
Which feature should you use, and how long before the users must complete the registration? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 148
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the objects shown in the following table.
You install Microsoft Entra Connect. You configure the Domain and OU filtering settings as shown in the Domain and OU Filtering exhibit. (Click the Domain and OU Filtering tab.)
You configure the Filter users and devices settings as shown in the Filter Users and Devices exhibit. (Click the Filter Users and Devices tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 149
You have a Microsoft 365 tenant that has 5,000 users. One hundred of the users are executives. The executives have a dedicated support team.
You need to ensure that the support team can reset passwords and manage multi-factorauthentication (MFA) settings for only the executives. The solution must use the principle of least privilege.
Which object type and Azure Active Directory (Azure AD) role should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 150
You have a Microsoft 365 tenant.
Sometimes, users use external, third-party applications that require limited access to the Microsoft 365 data of the respective user. The users register the applications in Azure Active Directory (Azure AD).
You need to receive an alert if a registered application gains read and write access to the users' email.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/cloud-app-security/app-permission-policy
NEW QUESTION # 151
You have a Microsoft 365 E5 subscription and an Azure subscription. You need to meet the following requirements:
* Ensure that users can sign in to Azure virtual machines by using their Microsoft 365 credentials.
* Delegate the ability to create new virtual machines.
What should you use for each requirement? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Answer:
Explanation:
Explanation:
A white background with black text Description automatically generated
NEW QUESTION # 152
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Active Directory forest that syncs to a Microsoft Entra tenant.
You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Microsoft Entra for up to 30 minutes.
You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Microsoft Entra.
Solution: You configure Microsoft Entra Password Protection.
Does this meet the goal?
- A. Yes
- B. No
Answer: B
Explanation:
The SC-300 curriculum emphasizes synchronization behavior between on-premises Active Directory (AD) and Microsoft Entra ID using Microsoft Entra Connect. By default, directory synchronization occurs every 30 minutes, which means a user disabled in AD can still authenticate to Microsoft Entra for up to 30 minutes until the next synchronization cycle.
The proposed solution-Microsoft Entra Password Protection-is not related to authentication delay or sign-in blocking. Password Protection enforces strong password policies and prevents the use of weak or compromised passwords during account creation or reset. It does not control sign-in states or enforce real- time disablement.
To meet the goal of immediately blocking authentication when an account is disabled in AD, you must implement Microsoft Entra Connect with Pass-through Authentication (PTA) or federation (AD FS).
These options validate sign-ins against the on-premises AD in real time, ensuring instant blocking of disabled accounts.
Microsoft documentation confirms:
"Password Protection does not affect authentication latency or synchronization frequency. To ensure disabled accounts cannot sign in, use Pass-through Authentication or federation for real-time validation."
NEW QUESTION # 153
Hotspot Question
You have a Microsoft 365 E5 subscription.
You need to create a dynamic user group that will include all the users that do NOT have a department defined in their user profile.
How should you complete the membership rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic- membership#use-of-null-values
NEW QUESTION # 154
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.
User1 has the devices shown in the following table.
On November 5, 2020, you create and enforce terms of use in contoso.com that has the following settings:
Name: Terms1
Display name: Contoso terms of use
Require users to expand the terms of use: On
Require users to consent on every device: On
Expire consents: On
Expire starting on: December 10, 2020
Frequency: Monthly
On November 15, 2020, User1 accepts Terms1 on Device3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 155
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.
An administrator deletes User1.
You need to identity the following:
* How many days after the account of User1 is deleted can you restore the account?
* Which is the least privileged role that can be used to restore User1?
What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
NEW QUESTION # 156
......
SC-300 Questions Truly Valid For Your Microsoft Exam: https://dumpsvce.exam4free.com/SC-300-valid-dumps.html
