Microsoft

SC-300 Free Practice Questions — Page 10

Question 78

SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username: Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to ensure the owner of each Microsoft 365 group is notified to renew their group every 180 days. Groups that are NOT renewed must be deleted. For groups without an owner, the notifications must be sent to Allan Deyoung. To complete this task, sign in to the appropriate admin center.

Show Answer
Correct Answer: Microsoft Entra ID admin center → Groups → Expiration Group lifetime (days): 180 Email contact for groups with no owners: Allan Deyoung Enable expiration for Microsoft 365 groups: All Save
Explanation:
Microsoft 365 group expiration policies notify group owners to renew before the 180‑day expiration. Groups not renewed are automatically deleted. The configured email contact ensures notifications are sent to Allan Deyoung when a group has no owner.

Question 79

HOTSPOT - You have an Azure subscription named Sub1 that contains the resources shown in the following table. Sub1 contains the managed identities shown in the following table. Sub1 has the role-based access control (RBAC) role assignments shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 79 Illustration for SC-300 question 79 Illustration for SC-300 question 79 Illustration for SC-300 question 79
Show Answer
Correct Answer: Automation1 can access the contents of the secrets stored in Vault1: No Identity2 can be assigned to Automation2 to gain access to the contents of the secrets stored in Vault1: Yes VM1 can access the contents of the secrets stored in Vault1: Yes
Explanation:
Vault1 is in RG1. Identity1 (used by Automation1) has access only at RG2, so it cannot access Vault1. Identity2 has Key Vault Secrets User at subscription scope, which includes RG1, so it can access Vault1 when assigned to Automation2. Identity3 (used by VM1) has Key Vault Secrets User at RG1 scope, which includes Vault1.

Question 81

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users. You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort. What should you use?

A. the Set-MgUserLicense cmdlet
B. the Identity Governance blade in the Microsoft Entra admin center
C. the Groups blade in the Microsoft Entra admin center
D. the Update-MgGroup cmdlet
Show Answer
Correct Answer: A
Explanation:
The E3 licenses are assigned directly to individual users, not via a group. To remove a directly assigned license at scale with the least administrative effort, you should use automation. The Set-MgUserLicense cmdlet allows bulk removal of directly assigned licenses across many users. The Groups blade can manage group-based licenses only, Identity Governance is unrelated, and Update-MgGroup manages group properties rather than user license removal.

Question 82

HOTSPOT - You have a Microsoft 365 E5 subscription that contains two attribute sets named Set1 and Set2. The subscription contains the users shown in the following table. You have the custom security attributes shown in the following table. You assign User2 the Attribute Definition Administrator role for Set1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 82 Illustration for SC-300 question 82 Illustration for SC-300 question 82
Show Answer
Correct Answer: User1 can modify the configuration of Secure1: No User2 can view the value of Secure2 for all users: No User3 can view the value of Secure3 for all users: Yes
Explanation:
Global Administrators have no permissions on custom security attributes unless explicitly assigned an attribute role. The Attribute Definition Administrator role allows managing attribute definitions in its assigned set but does not allow reading attribute values on users. The Attribute Assignment Administrator role allows viewing and assigning attribute values for users within the relevant attribute set.

Question 83

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users. You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort. What should you use?

A. the Identity Governance blade in the Microsoft Entra admin center
B. the Update-MgGroup cmdlet
C. the Set-MgUserLicense cmdlet
D. the Administrative units blade in the Microsoft Entra admin center
Show Answer
Correct Answer: C
Explanation:
The E3 licenses are assigned directly to individual users, not via a group. To remove a directly assigned license from many users with the least administrative effort, you should use automation rather than portal-based changes. The Set-MgUserLicense cmdlet allows you to programmatically remove the Office 365 E3 SKU from all affected users in bulk, making it the most efficient and appropriate option. Group, Identity Governance, and Administrative Units do not remove directly assigned licenses.

Question 84

HOTSPOT - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains computers that run Windows 11. You have a Microsoft 365 E5 subscription. You plan to enable hybrid join and enroll the computers in Microsoft Intune. You need to recommend the software that should be deployed to the domain, and the actions that should be performed in Intune. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 84
Show Answer
Correct Answer: Domain: Intune Connector for Active Directory Intune: Modify the mobile device management (MDM) user scope.
Explanation:
The Intune Connector for Active Directory enables hybrid Azure AD join for on-premises domain-joined Windows devices. Modifying the MDM user scope allows eligible users/devices to automatically enroll into Microsoft Intune.

Question 86

You have an Azure subscription that contains the resources shown in the following table. You need to grant permissions to the resources by using attribute-based access control (ABAC). To which resource can you grant permissions?

A. Vault1
B. VM1
C. App1
D. Storage1
Show Answer
Correct Answer: D
Explanation:
In Azure, attribute-based access control (ABAC) using role assignment conditions is currently supported only for specific data-plane resources, notably Azure Storage (Blob and Queue data actions). Other resources like virtual machines, web apps, or Key Vault do not support ABAC conditions on role assignments in this context. Therefore, permissions using ABAC can be granted only to the storage account resource.

Question 87

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. You create a Microsoft Entra user named User1. Which identities can you add to VM1 and App1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

Illustration for SC-300 question 87 Illustration for SC-300 question 87
Show Answer
Correct Answer: VM1: Managed2 only App1: A system-assigned managed identity and Managed2 only
Explanation:
VMs can have one system-assigned identity and multiple user-assigned identities, but a Microsoft Entra user cannot be added as a managed identity. From the options, only Managed2 applies. App Service web apps support a system-assigned managed identity and user-assigned managed identities; from the choices, this corresponds to a system-assigned managed identity plus Managed2.

Question 88

SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username: Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to ensure that when users in the sg-Operations group go to the My Apps portal, a tab named Operations appears that contains only the following applications: • LinkedIn • Box To complete this task, sign in to the appropriate admin center.

Show Answer
Correct Answer: Microsoft Entra admin center Identity > Enterprise applications > App launchers > Collections Create a new Collection named Operations Add applications: LinkedIn, Box Assign Users and groups: sg-Operations Create
Explanation:
A My Apps tab is created by using App launcher Collections in Microsoft Entra. Creating a collection named Operations, adding only LinkedIn and Box, and assigning it to the sg-Operations group ensures those users see a dedicated Operations tab containing only those apps in the My Apps portal.

Question 89

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. You create a Microsoft Entra user named User1. Which identities can you add to VM1 and App1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

Illustration for SC-300 question 89 Illustration for SC-300 question 89
Show Answer
Correct Answer: VM1: Managed2 only App1: A system-assigned managed identity and Managed2 only
Explanation:
VM1 supports user-assigned managed identities, but based on the table only Managed2 is available to VM1; Microsoft Entra users cannot be added as managed identities. App1 (Azure App Service) can have one system-assigned managed identity and also be linked to user-assigned managed identities; from the listed options, this is the system-assigned identity plus Managed2.

$19

Get all 397 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.