CertBlaze

Microsoft

SC-300 Free Practice Questions — Page 6

Question 55

HOTSPOT - You have an Azure subscription that uses Microsoft Entra Permissions Management. You have an Amazon Web Services (AWS) account. You plan to connect Permissions Management to AWS. You need to create a Permissions Management app in Azure. How should you complete the PowerShell command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 55
Show Answer
Correct Answer: New-AzureADApplication -IdentifierUris
Explanation:
Create a new Azure AD application with New-AzureADApplication and specify the application URI using the -IdentifierUris parameter (for example, api://mciem-aws-oidc-app).

Question 57

HOTSPOT - You have a Microsoft Entra tenant that contains a user named User1. An administrator deletes User1. You need to identify the following: • What is the maximum number of days for which you have the option to restore the User1 account? • Which is the least privileged role that can be used to restore User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 57
Show Answer
Correct Answer: 30 User Administrator
Explanation:
Deleted Microsoft Entra user accounts can be restored for up to 30 days. The least privileged built-in role that can restore deleted users is User Administrator.

Question 58

DRAG DROP - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server and hosts a shared folder named Share1. The domain contains 500 devices that run Windows 11. You have a Microsoft 365 E5 subscription that syncs with the domain. From Global Secure Access, you enable the Private access profile and deploy the Global Secure Access client to all the devices. You need to ensure that the devices can connect to Share1 remotely by using Global Secure Access. Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for SC-300 question 58
Show Answer
Correct Answer: 1. Install a connector on Server1. 2. Create an enterprise application. 3. Create an application segment.
Explanation:
For Microsoft Entra Global Secure Access Private Access, first deploy a connector to reach on-premises resources, then create the enterprise application, and finally define the application segment (IP/FQDN/ports) that exposes the SMB resource through the connector.

Question 59

HOTSPOT - You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table. The subscription contains a Conditional Access policy that has the following settings: • Name: Policy1 • Assignments o Include - Users and Groups: Group1 - Directory roles: Global Administrator o Exclude - Users and Groups: Group2 o Target resources - Include - All cloud apps - Access controls - Grant - Require multifactor authentication For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 59 Illustration for SC-300 question 59
Show Answer
Correct Answer: Yes No No
Explanation:
Included users/groups and directory roles are targeted, but Conditional Access exclusions take precedence over any inclusion. User1 is included via Group1 only, so MFA is required. User2 is also in the excluded Group2, so excluded. User3 is included via Global Administrator role but is also in excluded Group2, so the exclusion overrides and the policy does not apply.

Question 60

HOTSPOT - You have an Azure subscription that contains a resource group named RG1. RG1 contains two virtual machines named VM1 and VM2 that have Microsoft Entra ID login enabled. The subscription contains the users shown in the following table. Which users can sign in to VM1, and which users can sign in to VM2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 60 Illustration for SC-300 question 60
Show Answer
Correct Answer: VM1: User1 and User3 only VM2: User1 only
Explanation:
Virtual Machine User Login allows sign-in at its assigned scope and below, so User1 can sign in to both VMs. Virtual Machine Administrator Login allows sign-in with admin privileges at the assigned scope, so User3 can sign in only to VM1. Virtual Machine Contributor manages VMs but does not grant login rights.

Question 61

HOTSPOT - You have a Microsoft 365 E5 subscription that contains a Microsoft Teams team named Team1 and two Microsoft 365 groups named Group1 and Group2. The subscription contains the users shown in the following table. You create an access package that has the following settings: • Name: Package1 • Resource roles: o Team1: Owner • Users who can request access: For users in your directory o Specific Users and Groups: Group1 • Require approval: Yes o Require requestor justification: No o How many stages: 1 o First Approver: Team1, User3 o Require approver justification: Yes • Enable new requests: Yes • Expiration: o Access package assignments expire: 7 days o Users can request specific timeline: Yes For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 61 Illustration for SC-300 question 61
Show Answer
Correct Answer: Yes No No
Explanation:
Only members of Group1 can request the package; User1 is in Group1, User2 is not. Although User3 is an approver, approvers cannot approve their own access package requests.

Question 62

You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server. You enable Microsoft Entra login for the virtual machines. Users report that they cannot sign in to the virtual machines by using their Microsoft Entra credentials. You need to ensure that the users can sign in to the virtual machines. What should you do first?

A. From the Microsoft Entra admin center, delete the device registrations of the virtual machines.
B. Revoke the primary refresh token.
C. Enable SSH client support for OpenSSH.
D. Ensure that the virtual machines can access https://enterpriseregistration.windows.net.
Show Answer
Correct Answer: D
Explanation:
Microsoft Entra login for Windows VMs depends on the VM being able to reach Microsoft Entra device registration and authentication endpoints. If users cannot sign in after enabling Microsoft Entra login, the first step is to verify network connectivity to the required endpoint, including https://enterpriseregistration.windows.net. Deleting device registrations, revoking a primary refresh token, or enabling OpenSSH client support do not address the fundamental sign-in prerequisite for Windows VM Microsoft Entra login.

Question 64

HOTSPOT - You have a Microsoft Entra tenant that contains a user named User1. You have an Azure subscription named Sub1. User1 is assigned the Owner role for Sub1. You need to ensure that User1 can onboard Sub1 to Permissions Management. The solution must follow the principle of least privilege. Which role should you assign for Sub1, and which role should you assign to User1 for the tenant? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 64
Show Answer
Correct Answer: Sub1: User Access Administrator Tenant: Permissions Management Administrator
Explanation:
To onboard an Azure subscription to Microsoft Entra Permissions Management with least privilege, assign the Azure RBAC role that can manage access assignments (User Access Administrator) at the subscription, and the Microsoft Entra role specifically intended for Permissions Management administration (Permissions Management Administrator) at the tenant.

Question 65

HOTSPOT - You have a Microsoft 365 subscription. You configure a Global Secure Access security profile named SecurityProfile1. You need to create a Conditional Access policy named CAPolicy1 that will use SecurityProfile1. Which two settings should you configure to ensure that CAPolicy1 uses SecurityProfile1? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 65
Show Answer
Correct Answer: Target resources Session
Explanation:
To apply a Global Secure Access security profile in a Conditional Access policy, scope the policy to the desired Target resources and configure the Session control to use the specified Global Secure Access security profile (SecurityProfile1).

Question 67

HOTSPOT - You have two Microsoft Entra tenants named contoso.com and fabrikam.com. Contoso.com contains the users shown in the following table. Contoso.com contains the groups shown in the following table. You configure cross-tenant synchronization from contoso.com to fabrikam.com and enable cross-tenant synchronization for User3 and Group2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for SC-300 question 67 Illustration for SC-300 question 67 Illustration for SC-300 question 67
Show Answer
Correct Answer: User1: No User2: Yes User3: No
Explanation:
Cross-tenant synchronization scoped to a group includes only direct user members; nested group membership does not cascade. User2 is a direct member of Group2, User1 is only in nested Group1, and guest users are not synchronized as source users.

$19

Get all 387 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SC-300 study guide →