Microsoft

SC-300 Free Practice Questions — Page 14

Question 147

You have a Microsoft Entra tenant that uses Microsoft Entra ID Premium licenses. You plan to configure a terms of use (ToU) for the tenant. You need to upload the ToU document. Which format should you use for the document?

A. HTML
B. RTF
C. PDF
D. DOCX
Show Answer
Correct Answer: C
Explanation:
Microsoft Entra Terms of Use requires the uploaded document to be in PDF format. When creating a Terms of Use policy, you upload a PDF that users review and accept.

Question 148

You have a Microsoft 365 tenant that uses the domain name fabrikam.com. The External collaboration settings are configured as shown in the Collaboration exhibit. (Click the Collaboration tab.) The Email one-time passcode for guests setting is enabled for the tenant. A user named shares a Microsoft SharePoint Online document library to the users shown in the following table. Which users will be emailed a passcode?

A. User1 only
B. User2 only
C. User1 and User2 only
D. User1, User2, and User3
Show Answer
Correct Answer: B
Explanation:
Email one-time passcode applies to new guest redemption when no Microsoft Entra ID, Microsoft account, or federated identity can be used. Enabling the feature does not change the redemption/authentication method for existing redeemed guest users. Therefore, only the newly invited eligible external user receives the emailed passcode.

Question 150

You have a Microsoft Entra tenant that contains the groups shown in the following table. You need to implement Privileged Identity Management (PIM) for the groups. Which groups can be managed by using PIM?

A. Group1 only
B. Group1 and Group2 only
C. Group1 and Group3 only
D. Group3 and Group4 only
E. Group1, Group2, Group3, and Group4
Show Answer
Correct Answer: C
Explanation:
PIM for Groups supports Microsoft Entra security groups and Microsoft 365 groups, but not dynamic groups or groups synchronized from on-premises Active Directory. Therefore, the manageable groups are the eligible cloud-managed security/Microsoft 365 groups only, corresponding to Group1 and Group3.

Question 151

You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4. You plan to assign the users the following roles for RG1: • User1: Reader • User2: Contributor • User3: Storage Blob Data Reader • User4: Virtual Machine Contributor You are evaluating the use of attribute-based access control (ABAC). Which user's role will support the use of ABAC?

A. User1
B. User2
C. User3
D. User4
Show Answer
Correct Answer: C
Explanation:
Azure ABAC conditions are currently supported for specific Azure Storage data access roles that include blob/queue data actions. Among the listed roles, Storage Blob Data Reader supports role assignment conditions (ABAC). Reader, Contributor, and Virtual Machine Contributor do not support ABAC conditions for this scenario.

Question 153

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users. You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort. What should you use?

A. the Set-WindowsProductKey cmdlet
B. the Update-MgGroup cmdlet
C. the Set-MgUserLicense cmdlet
D. the Update-MgUser cmdlet
Show Answer
Correct Answer: C
Explanation:
The correct choice is C. After assigning the Microsoft 365 E5 license via group-based licensing, the previously assigned direct E3 licenses remain until explicitly removed. The Microsoft Graph PowerShell cmdlet Set-MgUserLicense is used to add and remove license assignments on user objects, including removing directly assigned licenses. The other cmdlets are unrelated to Microsoft 365 license removal: Set-WindowsProductKey manages Windows product keys, Update-MgGroup updates group properties, and Update-MgUser updates user properties rather than license assignments.

Question 154

You have an Azure subscription named Sub1 that contains a virtual machine named VM1. You need to enable Microsoft Entra login for VM1 and configure VM1 to access the resources in Sub1. Which type of identity should you assign to VM1?

A. Microsoft Entra user account
B. user-assigned managed identity
C. Azure Automation account
D. system-assigned managed identity
Show Answer
Correct Answer: D
Explanation:
A system-assigned managed identity is the appropriate identity for a single Azure VM that needs to authenticate to Azure resources in the same subscription. Microsoft Entra login for Azure VMs enables user sign-in, while the managed identity is used by the VM itself to access Azure resources without storing credentials. A user-assigned managed identity is typically chosen when the same identity must be shared across multiple resources; otherwise, a system-assigned managed identity is the recommended choice.

Question 155

DRAG DROP - Your network contains an on-premises Active Directory domain named contoso.com that syncs with Microsoft Entra ID by using Microsoft Entra Connect. The domain contains the users shown in the following table. From Active Directory Users and Computers, you add the following user: • Name: User3 • UPN: • Proxy addresses: smtp: , smtp: From Active Directory Users and Computers, you update the proxyAddresses attribute for each user as shown in the following table. You trigger a manual synchronization. Which sync status will Microsoft Entra Connect sync return for each user? To answer, drag the appropriate status to the correct users. Each status may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 155 Illustration for SC-300 question 155 Illustration for SC-300 question 155
Show Answer
Correct Answer: [email protected] — Successfully synced [email protected] — AttributeValueMustBeUnique error occurs [email protected] — InvalidSoftMatch error occurs
Explanation:
User1's updated proxy is unique after its change. User2 attempts to use a proxy address that conflicts with another existing Microsoft Entra object, causing AttributeValueMustBeUnique. The new User3 matches an existing cloud object by proxy/UPN but has a different source anchor, resulting in InvalidSoftMatch.

Question 156

You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table. Which resources can use Managed1 as their identity?

A. WebApp1 only
B. storage1 and WebApp1 only
C. VM1 and WebApp1 only
D. VM1, storage1, and WebApp1
Show Answer
Correct Answer: C
Explanation:
User-assigned managed identities can be attached to supported Azure resources across regions within the same Microsoft Entra tenant; the identity's regional creation does not prevent cross-region assignment. However, Azure Storage accounts do not support being assigned a managed identity as their own identity. Azure VMs and App Service web apps do support user-assigned managed identities, so the applicable resources are VM1 and WebApp1 only.

Question 157

You have a Microsoft Entra tenant. You need to configure continuous access evaluation for app sign-ins and assign the configuration to users that are assigned the Application Administrator role. What should you configure?

A. a sign-in risk policy
B. an access review
C. a Conditional Access policy
D. the Admin consent settings
Show Answer
Correct Answer: C
Explanation:
Continuous Access Evaluation (CAE) settings for app sign-ins are configured and targeted through Conditional Access policies. Conditional Access can be assigned to specific users, groups, or directory roles such as Application Administrator. Sign-in risk policies address risk-based access, access reviews are for periodic access recertification, and admin consent settings govern application consent, not CAE.

Question 159

HOTSPOT - You have an Azure subscription named Sub1. You plan to onboard Microsoft Entra Permissions Management. You need to ensure that Permissions Management users can manage role assignments for Sub1. The solution must follow the principle of least privilege. Which role should you assign and to which identity should you assign the role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 159
Show Answer
Correct Answer: Role: User Access Administrator Identity: Cloud Infrastructure Entitlements Management
Explanation:
To allow Microsoft Entra Permissions Management to manage Azure role assignments with least privilege, assign the User Access Administrator role to the Cloud Infrastructure Entitlements Management service principal at the subscription scope.

$19

Get all 387 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.