SC-300: Microsoft Identity and Access AdministratorDemo

Your company has an Azure AD tenant that includes a user named User1.

The company has two departments: marketing and finance.

You need to grant User1 permission to manage only users in the marketing department. The solution must ensure that User1 does NOT have permission to manage users in the finance department.

What should you create first?

An Azure AD tenant has multi-factor authentication (MFA) enforced and self-service password reset (SSPR) enabled.

Combined registration is enabled in interrupt mode.

A new user named User1 is created.

Which two authentication methods can User1 use to finish the combined registration process? Each correct answer provides a complete solution.

> NOTE: Each correct selection is worth one point.

You have an Azure subscription.

You are assessing enterprise software-as-a-service (SaaS) apps.

You must ensure that the apps support automatic provisioning of Azure AD users.

Which specification must the apps support?

You create a Conditional Access policy that blocks access when a user triggers a high-severity sign-in alert.

You need to test the policy under these conditions:

• A user signs in from a different country.
• A user triggers a sign-in risk.

What should you use to perform the test?

You have a Microsoft 365 subscription that contains the following:

• An Azure Active Directory (Azure AD) tenant with an Azure Active Directory Premium P2 license
• A Microsoft SharePoint Online site named Site1
• A Microsoft Teams team named Team1

You need to create an entitlement management workflow to manage Site1 and Team1.

What should you do first?

Your company has two divisions, named Contoso East and Contoso West. The Microsoft 365 identity architecture for the two divisions is shown in the following exhibit.

You need to grant users in the Contoso East division access to Microsoft SharePoint Online sites in the Contoso West tenant. The solution must not require any additional Microsoft 365 licenses.

What should you do?

You have an Azure subscription containing the resources shown in the following table.

You create a Microsoft Entra user named User1.

Which identities can you add to VM1 and App1?

You have a Microsoft 365 E5 subscription that includes a Microsoft SharePoint Online site named Site1.

You need to enable Microsoft Defender for Cloud Apps session control for Site1.

Which type of policy should you create first?

You have two Azure subscriptions named Sub1 and Sub2 that are linked to a Microsoft Entra tenant. The tenant includes three groups: Group1, Group2, and Group3.

The subscriptions contain the resources shown in the following table.

The tenant includes the users shown in the following table.

You manage the subscriptions by using Microsoft Entra Permissions Management. Permissions Management is configured as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

You need to fulfill the technical requirements concerning the likelihood that user identities have been compromised.

What must users do first, and what should you configure?

You have a Microsoft 365 E5 subscription containing three users: User1, User2, and User3. Configure the users as shown in the following table.

Which portal should be used to configure each user? Each portal can be used once, multiple times, or not at all.

You have an Azure Active Directory (Azure AD) tenant containing three users named User1, User2, and User3.

You create a group named Group1 and add User2 and User3 to Group1. You configure an Azure AD Privileged Identity Management (PIM) role as shown in the Application Administrator exhibit. (Click the Application Administrator tab.)

Group1 is configured as the approver for the Application administrator role. You configure User2 to be eligible for the Application administrator role. For User1, you add an assignment to the Application administrator role as shown in the Assignment exhibit. (Click the Assignment tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

HOTSPOT -

An Azure Active Directory (Azure AD) tenant contains the users shown in the following table.

In Azure AD Privileged Identity Management (PIM), the Global administrator role is configured as shown in the following exhibit.

User1 is eligible for the Global administrator role.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.

You need to receive a notification when a user downloads more than 50 files from Site1 within one minute.

Which policy type should you create in the Microsoft Defender for Cloud Apps portal?

Your on-premises network has an Active Directory Domain Services (AD DS) domain containing computers that run Windows 11.

You have a Microsoft 365 E5 subscription and plan to enable hybrid join and enroll the computers in Microsoft Intune.

You need to recommend the software to deploy to the domain and the actions to perform in Intune.

What should the recommendation include?

How should access to the on-premises applications be configured?

Solution: Create a separate access review for every role.

Does this meet the goal?

Solution: Modify the properties of the IT administrator user accounts.

Does this achieve the goal?

Solution: Set Reviewers to Member (self).

Does this meet the goal?

Solution: Add every manager as a fallback reviewer.

Does this meet the goal?

You have a Microsoft Entra tenant containing two remote networks, RemoteNetwork1 and RemoteNetwork2, and the users shown in the following table.

You have the devices shown in the following table.

You have a Conditional Access policy with these settings:

• Name: CAPolicy1
• Assignments
  • Users: Group1, Group2
  • Target resources: All internet resources with Global Secure Access
• Access controls
  • Grant: Require multifactor authentication
• Enable policy: On

Global Secure Access traffic forwarding is configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

You have a Microsoft Entra tenant containing 1,000 users. The users have Microsoft Entra Suite licenses.

You are deploying Global Secure Access.

You need to ensure that connections to www.microsoft.com bypass Global Secure Access.

Which profiles should you update?

You have an Azure subscription containing the resources shown in the following table.

The subscription contains the virtual machines shown in the following table.

Which identities can receive the Owner role for RG1, and which virtual machines can be assigned Managed2?

You have an Azure Active Directory (Azure AD) tenant containing the users shown in the following table.

You have the locations shown in the following table.

The tenant has a named location with these settings:

• Name: Location1
• Mark as trusted location: Enabled
• IPv4 range: 10.10.0.0/16

MFA has a trusted IP address range of 193.17.17.0/24.

CAPolicy1 has the following configuration:

• Assignments
  • Users or workload identities: Group1
  • Cloud apps or actions: All cloud apps
• Conditions
  • Locations: All trusted locations
• Access controls
  • Grant access: Require multi-factor authentication
  • Session: 0 controls selected
• Enable policy: On

For each of the following statements, select Yes if the statement is true. Otherwise, select No.