Microsoft Microsoft Certifications SC-300 Questions & Answers

• Question 171:

  Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory

  (Azure AD) tenant named contoso.com by using Azure AD Connect.

  You need to prevent the synchronization of users who have the extensionAttribute15 attribute set to NoSync.

  What should you do in Azure AD Connect?

  A. Create an inbound synchronization rule for the Windows Azure Active Directory connector.

  B. Configure a Full Import run profile.

  C. Create an inbound synchronization rule for the Active Directory Domain Services connector.

  D. Configure an Export run profile.

  Correct Answer: C

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration

• Question 172:

  You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit. (Click the Exhibit tab.)

  

  You are evaluating the following passwords:

  Pr0jectlitw@re T@ilw1nd C0nt0s0

  Which passwords will be blocked?

  A. Pr0jectlitw@re and T@ilw1nd only

  B. C0nt0s0 only

  C. C0nt0s0, Pr0jectlitw@re, and T@ilw1nd

  D. C0nt0s0 and T@ilw1nd only

  E. C0nt0s0 and Pr0jectlitw@re only

  Correct Answer: C

  Reference: https://blog.enablingtechcorp.com/azure-ad-password-protection-password-evaluation

• Question 173:

  Your company has a Microsoft 365 tenant.

  The company has a call center that contains 300 users. In the call center, the users share desktop computers and might use a different computer every day. The call center computers are NOT configured for biometric identification.

  The users are prohibited from having a mobile phone in the call center.

  You need to require multi-factor authentication (MFA) for the call center users when they access Microsoft 365 services.

  What should you include in the solution?

  A. a named network location

  B. the Microsoft Authenticator app

  C. Windows Hello for Business authentication

  D. FIDO2 tokens

  Correct Answer: D

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless

• Question 174:

  You have a Microsoft 365 tenant.

  The Sign-ins activity report shows that an external contractor signed in to the Exchange admin center.

  You need to review access to the Exchange admin center at the end of each month and block sign-ins if required.

  What should you create?

  A. an access package that targets users outside your directory

  B. an access package that targets users in your directory

  C. a group-based access review that targets guest users

  D. an application-based access review that targets guest users

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 175:

  You configure a new Microsoft 365 tenant to use a default domain name of contoso.com.

  You need to ensure that you can control access to Microsoft 365 resources by using conditional access policies.

  What should you do first?

  A. Disable the User consent settings.

  B. Disable Security defaults.

  C. Configure a multi-factor authentication (MFA) registration policy.

  D. Configure password protection for Windows Server Active Directory.

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

• Question 176:

  You have a Microsoft 365 tenant.

  All users have mobile phones and laptops.

  The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity.

  While working from the remote locations, the users connect their laptop to a wired network that has internet access.

  You plan to implement multi-factor authentication (MFA).

  Which MFA authentication method can the users use from the remote location?

  A. a verification code from the Microsoft Authenticator app

  B. security questions

  C. voice

  D. SMS

  Correct Answer: A

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept- authentication-authenticator-app#verification-code-from-mobile-app

• Question 177:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 tenant.

  You have 100 IT administrators who are organized into 10 departments.

  You create the access review shown in the exhibit. (Click the Exhibit tab.)

  

  You discover that all access review requests are received by Megan Bowen.

  You need to ensure that the manager of each department receives the access reviews of their respective department.

  Solution: You add each manager as a fallback reviewer.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 178:

  You have an Azure subscription that contains the resources shown in the following table.

  

  For which resources can you create an access review?

  A. Group1, App1, Contributor, and Role1

  B. Hotel and Contributor only

  C. Group1, Role1, and Contributor only

  D. Group1 only

  Correct Answer: A

  Access reviews require an Azure AD Premium P2 license.

  Access reviews for Group1 and App1 can be configured in Azure AD Access Reviews.

  Access reviews for the Contributor role and Role1 would need to be configured in Privileged Identity Management (PIM). PIM is included in Azure AD Premium P2.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review?toc=/azure/active-directory/governance/toc.json https://docs.microsoft.com/en-us/azure/active-directory/governance/ access-reviews-overview

• Question 179:

  Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

  

  All the users work remotely.

  Azure AD Connect is configured in Azure AD as shown in the following exhibit.

  

  Connectivity from the on-premises domain to the internet is lost. Which users can sign in to Azure AD?

  A. User1 and User3 only

  B. User1 only

  C. User1, User2, and User3

  D. User1 and User2 only

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations

• Question 180:

  You have a Microsoft 365 tenant.

  All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

  Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

  You need to block the users automatically when they report an MFA request that they did not Initiate.

  Solution: From the Azure portal, you configure the Fraud alert settings for multi-factor authentication (MFA).

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The fraud alert feature lets users report fraudulent attempts to access their resources. When an unknown and suspicious MFA prompt is received, users can report the fraud attempt using the Microsoft Authenticator app or through their phone.

  The following fraud alert configuration options are available:

  1.

  Automatically block users who report fraud.

  2.

  Code to report fraud during initial greeting.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings