CertBlaze

Microsoft

SC-300 Free Practice Questions — Page 19

Question 178

HOTSPOT - You have an Azure subscription. From Entitlement management, you plan to create a catalog named Catalog1 that will contain a custom extension. What should you create first, and what should you use to distribute Catalog1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 178
Show Answer
Correct Answer: First create: An Azure Logic App Distribute Catalog1 by using: An access package
Explanation:
Custom extensions in Entitlement Management are implemented using Azure Logic Apps, so the logic app must exist before being added to the catalog. Entitlement management catalogs are distributed to users through access packages, which reference the catalog contents.

Question 179

You have a Microsoft 365 tenant. You currently allow email clients that use Basic authentication to connect to Microsoft Exchange Online. You need to ensure that users can connect to Exchange Online only from email clients that use Modern authentication protocols. What should you implement?

A. a conditional access policy in Azure AD
B. a compliance policy in Microsoft Intune
C. an OAuth policy in Microsoft Defender for Cloud Apps
D. an application control profile in Microsoft Intune
Show Answer
Correct Answer: A
Explanation:
To restrict Exchange Online access to clients using Modern authentication, you must block legacy (Basic) authentication. This is done by creating an Azure AD (Entra ID) Conditional Access policy that blocks legacy authentication protocols for Exchange Online. The other options do not control authentication methods for Exchange Online sign-ins.

Question 180

Your company purchases a Microsoft 365 E5 subscription. A user named User1 is assigned the Security Administrator role. You need to ensure that User1 can create Microsoft Defender for Cloud Apps session policies. What should you do first?

A. Create a Conditional Access policy and select Require app protection policy.
B. Create a Conditional Access policy and select Use Conditional Access App Control.
C. Assign the Cloud Application Administrator role to User1.
D. Assign the Cloud App Security Administrator role to User1.
Show Answer
Correct Answer: B
Explanation:
A Security Administrator already has full permissions in Microsoft Defender for Cloud Apps, including creating session policies. However, session policies require integration with Microsoft Entra Conditional Access using Conditional Access App Control. Therefore, the first required action is to create a Conditional Access policy and select **Use Conditional Access App Control** so that Defender for Cloud Apps session policies can be created and enforced.

Question 181

You plan to deploy a new Azure AD tenant. Which multifactor authentication (MFA) method will be enabled by default for the tenant?

A. Microsoft Authenticator
B. SMS
C. voice call
D. email OTP
Show Answer
Correct Answer: A
Explanation:
New Azure AD (Microsoft Entra ID) tenants have Security Defaults enabled by default. Under Security Defaults, users are required to use multifactor authentication with the Microsoft Authenticator app (push notifications or codes). SMS, voice call, and email OTP are not the default MFA methods in this scenario.

Question 182

You have an Azure AD Tenant. You configure self-service password reset (SSPR) by using the following settings: • Require users to register when signing in: Yes • Number of methods required to reset: 1 What is a valid authentication method available to users?

A. an FIDO2 security token
B. a mobile app code
C. a Microsoft Teams chat
D. a Windows Hello PIN
Show Answer
Correct Answer: B
Explanation:
With SSPR configured to require one authentication method, valid methods are those explicitly supported for self-service password reset. A mobile app code (from Microsoft Authenticator) is a supported SSPR authentication method. FIDO2 security keys, Microsoft Teams chat, and Windows Hello PIN are not valid SSPR methods.

Question 183

HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD and contains the users shown in the following table. In Azure AD Connect, Domain/OU Filtering is configured as shown in the following exhibit. Azure AD Connect is configured as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 183 Illustration for SC-300 question 183 Illustration for SC-300 question 183 Illustration for SC-300 question 183
Show Answer
Correct Answer: Yes Yes No
Explanation:
OU filtering syncs OU1 but not OU2, so only User1 exists in Azure AD. Password writeback is enabled, allowing SSPR for synced users when configured. Pass-through authentication is enabled, so User1 is authenticated by the on-premises domain controller. User2 is not synchronized and therefore cannot be added as a SharePoint Online member.

Question 184

DRAG DROP - You have an Azure subscription that is linked to an Azure AD tenant named contoso.com. The subscription contains a group named Group1 and a virtual machine named VM1. You need to meet the following requirements: • Enable a system-assigned managed identity for VM1. • Add VM1 to Group1. How should you complete the PowerShell script? To answer, drag the appropriate cmdlets to the correct targets. Each cmdlet may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 184
Show Answer
Correct Answer: Get-AzVM Get-AzADServicePrincipal
Explanation:
Get-AzVM retrieves the VM object so Update-AzVM can enable a system-assigned managed identity. Get-AzADServicePrincipal retrieves the service principal created for the VM’s managed identity, which is then added to the Azure AD group.

Question 185

HOTSPOT - You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table. The users have the devices shown in the following table. You create the following two Conditional Access policies: • Name: CAPolicy1 • Assignments o Users or workload identities: Group1 o Cloud apps or actions: Office 365 SharePoint Online o Conditions Filter for devices: Exclude filtered devices from the policy Rule syntax: device.displayName -startsWith “Device” o Access controls Grant: Block access Session: 0 controls selected o Enable policy: On • Name: CAPolicy2 • Assignments o Users or workload identities: Group2 o Cloud apps or actions: Office 365 SharePoint Online o Conditions: 0 conditions selected • Access controls o Grant: Grant access Require multifactor authentication o Session: 0 controls selected • Enable policy: On All users confirm that they can successfully authenticate using MFA. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 185 Illustration for SC-300 question 185 Illustration for SC-300 question 185
Show Answer
Correct Answer: User1 can access Site1 from Device1: No User2 can access Site1 from Device2: Yes User3 can access Site1 from Device3: Yes
Explanation:
CAPolicy1 blocks Group1 unless the device is excluded by the filter. Device filters require an Azure AD–registered/joined device; for unregistered devices, device attributes are null, so the exclusion (displayName startsWith "Device") does not apply and access is blocked (User1/Device1). CAPolicy2 grants access to Group2 with MFA, which succeeds (User2/Device2). User3 is in both groups; Device3 is Azure AD registered and matches the exclusion, so CAPolicy1 doesn’t block, and CAPolicy2 allows with MFA.

Question 186

DRAG DROP - You have an Azure AD tenant that contains a user named Admin1. Admin1 uses the Require password change for high-risk users policy template to create a new Conditional Access policy. Who is included and excluded by default in the policy assignment? To answer, drag the appropriate options to the correct target. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point

Illustration for SC-300 question 186
Show Answer
Correct Answer: Include: All users Exclude: Admin1
Explanation:
The Require password change for high-risk users Conditional Access template includes all users by default and automatically excludes the current user who creates the policy to prevent administrative lockout. In this case, the current user is Admin1.

Question 187

You have an Azure AD tenant. You need to implement smart lockout with a lockout threshold of 10 failed sign-ins. What should you configure in the Azure AD admin center?

A. Authentication strengths
B. Password protection
C. User risk policy
D. Sign-in risk policy
Show Answer
Correct Answer: B
Explanation:
Smart lockout settings, including the lockout threshold for failed sign-ins, are configured under **Password protection** in the Azure AD (Microsoft Entra ID) admin center. Authentication strengths and risk policies are unrelated to configuring smart lockout thresholds.

$19

Get all 397 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SC-300 study guide →