CertBlaze

Microsoft

SC-300 Free Practice Questions — Page 4

Question 16

You have a Microsoft Entra tenant. You need to add the Facebook social identity provider to the tenant. What should you do first?

A. Add a custom domain
B. Add a WS-Fed identity provider.
C. Add a SAML identity provider.
D. Set Enable guest self-service sign up via user flows to Yes.
Show Answer
Correct Answer: D
Explanation:
To add a social identity provider such as Facebook in a Microsoft Entra tenant, guest self-service sign-up via user flows must be enabled first. Without enabling this setting, adding or using built-in social identity providers results in an error indicating that self-service sign-up for guest users is not enabled. The other options (custom domain, WS-Fed, or SAML providers) are not prerequisites for adding Facebook.

Question 17

You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses. You are deploying Global Secure Access. You need to ensure that connections to www.microsoft.com are bypassed by Global Secure Access. Which profiles should you update?

A. Intemet access profile only
B. Microsoft traffic profile only
C. Microsoft traffic profile and Internet access profile only
D. Microsoft traffic profile, Private access profile, and Internet access profile
Show Answer
Correct Answer: B
Explanation:
www.microsoft.com is classified as Microsoft traffic. In Global Secure Access, destinations covered by the Microsoft traffic profile are excluded from the Internet access profile by design. Setting a bypass rule in the Microsoft traffic profile ensures that this traffic is not acquired by Global Secure Access, and there is no need to update the Internet access or Private access profiles.

Question 17

SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Microsoft 365 Username: Microsoft 365 Password: =1122334455667788 If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 99999999 - You need to ensure that all users can consent to apps that require permission to read their user profile. Users must be prevented from consenting to apps that require any other permissions. To complete this task, sign in to the appropriate admin center.

Show Answer
Correct Answer: Microsoft Entra admin center Identity > Applications > Enterprise applications > Consent and permissions 1) Permission classifications: classify Microsoft Graph User.Read as Low impact 2) User consent settings: Allow user consent for apps from verified publishers, for selected permissions
Explanation:
Classifying only the Microsoft Graph User.Read permission as low impact ensures users can consent to apps that read their own profile. Configuring user consent to allow only selected low‑impact permissions from verified publishers prevents users from consenting to any other permissions.

Question 18

You have multiple on-premises devices that run either Windows or Linux. You have a Microsoft 365 E5 subscription. You configure Microsoft Entra Internet Access. You need to ensure that all the on-premises devices access the internet by using Global Secure Access. What should you do in the Microsoft Entra admin center?

A. Create a remote network.
B. Create a named location.
C. Create an access package.
D. Deploy the Global Secure Access client.
Show Answer
Correct Answer: A
Explanation:
To ensure that all on-premises devices (both Windows and Linux) access the internet through Microsoft Entra Global Secure Access, you must account for the fact that the Global Secure Access client is not available for Linux. Creating a remote network allows traffic from an entire on-premises location (for example, via a branch router or VPN device) to be routed through Global Secure Access without requiring a client on each device. Other options do not enforce internet access through Global Secure Access for all devices.

Question 18

You have a Microsoft Entra tenant that contains an access package named Package1 and a user named User1. Package1 is configured as shown in the following exhibit. You need to ensure that User1 can modify the review frequency of Package1. The solution must use the principle of least privilege. Which role should you assign to User1?

A. Privileged Role Administrator
B. External Identity Provider Administrator
C. Identity Governance Administrator
D. Security Administrator
Show Answer
Correct Answer: C
Explanation:
Modifying the review frequency of an access package is an Identity Governance task within Microsoft Entra ID. The Identity Governance Administrator role has permissions to manage access packages, including access reviews and their settings. Other roles listed are either too broad (Privileged Role Administrator, Security Administrator) or unrelated (External Identity Provider Administrator). Therefore, assigning Identity Governance Administrator follows the principle of least privilege.

Question 19

HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table. The tenant contains the Microsoft 365 groups shown in the following table. You create an access review named Access1 that has the following settings: • Select what to review: Teams + Groups • Review scope: All Microsoft groups with guest users • Scope: Guest users only • Select reviewers: Users review their own access For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 19 Illustration for SC-300 question 19 Illustration for SC-300 question 19
Show Answer
Correct Answer: No No No
Explanation:
The access review targets only guest users in Microsoft 365 groups that contain guests. User1 and User3 are members, not guests. Group2 has no guest users and is out of scope. Group3 is a dynamic group, which is not reviewed. Therefore, none of the listed users can review their membership.

Question 19

You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server. You enable Microsoft Entra login for the virtual machines. Users report that they cannot sign in to the virtual machines by using their Microsoft Entra credentials. You need to ensure that the users can sign in to the virtual machines. What should you do first?

A. From the Microsoft Entra admin center, delete the device registrations of the virtual machines.
B. Revoke the primary refresh token.
C. Enable SSH client support for OpenSSH.
D. Ensure that the virtual machines can access https://enterpriseregistration.windows.net.
Show Answer
Correct Answer: D
Explanation:
Microsoft Entra login for Windows virtual machines requires the VM to register with Microsoft Entra ID. This registration depends on outbound connectivity to the enterprise registration endpoint. If the VMs cannot reach https://enterpriseregistration.windows.net, Entra authentication fails and users cannot sign in. Verifying and ensuring this network access is the first required step before troubleshooting tokens, device records, or other configurations.

Question 20

HOTSPOT - You have two Microsoft Entra tenants named contoso.com and fabrikam.com. Contoso.com contains the users shown in the following table. You configure cross-tenant synchronization from contoso.com to fabrikam.com by using the following settings: • Users and groups: Group1 • Provisioning Mode: Automatic • Attribute Mappings o Source Object Scope: Filter1, Filter2 Filter1 is configured as shown in the following table. Filter2 is configured as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 20 Illustration for SC-300 question 20 Illustration for SC-300 question 20 Illustration for SC-300 question 20
Show Answer
Correct Answer: User1: Yes User2: No User3: Yes
Explanation:
Only members of Group1 are in scope (User1, User3). Multiple scoping filters are evaluated with OR logic, while clauses within a filter use AND logic. Filter1: department = IT AND jobTitle present → matches User1. Filter2: city includes "M" → matches User3 (Montreal). User2 is not in Group1, so it never syncs.

Question 21

HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. Contoso.com contains the identities shown in the following table. You have a Microsoft Entra tenant that contains a user named User1. You deploy Microsoft Entra Cloud Sync and configure a scoping filter by using the following string: CN=Group1,OU=OU1,DC=contoso,DC=com. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 21 Illustration for SC-300 question 21
Show Answer
Correct Answer: Contoso\User1: Yes Contoso\User2: No Contoso\Group1: Yes
Explanation:
The scoping filter targets the group object CN=Group1 in OU1. Cloud Sync includes the specified group and all objects within scope of that group membership. User1 is a direct member of Group1 and is synced. User2 is only a member of Group2, which is not in scope, so it is not synced. Group1 itself is within the scoped DN and is therefore synced.

Question 22

You have a Microsoft Entra tenant. You have the end-user desktop environments shown in the following table. You need to deploy Global Secure Access. In which environments can you install the Global Secure Access client?

A. Contractors, Developers, Frontline workers, Office staff, and Senior managers
B. Frontline workers and Senior managers only
C. Contractors and Office staff only
D. Developers, Office staff, and Senior managers only
Show Answer
Correct Answer: D
Explanation:
The Global Secure Access client can only be installed on supported Windows devices that are Microsoft Entra joined or hybrid joined, running 64-bit Windows 10 or Windows 11. Supported virtual environments include Windows 365 and Azure Virtual Desktop single-session; multi-session and Entra-registered devices are not supported. Based on typical role-to-device mappings in the table, only Developers, Office staff, and Senior managers use supported device types, while Contractors and Frontline workers do not.

$19

Get all 397 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SC-300 study guide →