Microsoft Microsoft Certifications SC-300 Questions & Answers

• Question 191:

  You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs.

  Yon receive more than 100 email alerts each day for tailed Azure Al) user sign-in attempts.

  You need to ensure that a new security administrator receives the alerts instead of you.

  Solution: From Azure monitor, you create a data collection rule.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 192:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest.

  You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

  You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

  Solution: You configure pass-through authentication.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn

• Question 193:

  Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant-

  Users sign in to computers that run Windows 10 and are joined to the domain.

  You plan to implement Azure AD Seamless Single Sign-On (Azure AD Seamless SSO).

  You need to configure the computers for Azure AD Seamless SSO.

  What should you do?

  A. Enable Enterprise State Roaming.

  B. Configure Sign-in options.

  C. Install the Azure AD Connect Authentication Agent.

  D. Modify the Intranet Zone settings.

  Correct Answer: D

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start

• Question 194:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named SecAdmin1. SecAdmin1 is

  assigned the Security administrator role.

  SecAdmin1 reports that she cannot reset passwords from the Azure AD Identity Protection portal.

  You need to ensure that SecAdmin1 can manage passwords and invalidate sessions on behalf of non-administrative users. The solution must use the principle of least privilege.

  Which role should you assign to SecAdmin1?

  A. Authentication administrator

  B. Helpdesk administrator

  C. Privileged authentication administrator

  D. Security operator

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 195:

  You have a Microsoft 365 tenant.

  You currently allow email clients that use Basic authentication to conned to Microsoft Exchange Online.

  You need to ensure that users can connect t to Exchange only run email clients that use Modern authentication protocols.

  What should you implement?

  You need to ensure that use Modern authentication

  A. a compliance policy in Microsoft Endpoint Manager

  B. a conditional access policy in Azure Active Directory (Azure AD)

  C. an application control profile in Microsoft Endpoint Manager

  D. an OAuth policy in Microsoft Cloud App Security

  Correct Answer: B

  The question says nothing about what type of device or what tjhe application being used is so setting an App control policy will not do anything. CA polciies allow legacy auth to be blocked regardless of device.

• Question 196:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.

  You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

  You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

  Solution: You configure Azure AD Password Protection.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 197:

  You have an Azure Active Directory (Azure AD) tenant.

  You need to review the Azure AD sign-in logs to investigate sign-ins that occurred in the past.

  For how long does Azure AD store events in the sign-in logs?

  A. 14 days

  B. 30 days

  C. 90 days

  D. 365 days

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-reports-dataretention#how-long-does-azure-ad-store-the-data

• Question 198:

  You have an Azure Active Directory (Azure AD) tenant that contains the following objects:

  1.

  A device named Device1

  2.

  Users named User1, User2, User3, User4, and User5

  3.

  Groups named Group1, Group2, Group3, Group4, and Group5 The groups are configured as shown in the following table.

  

  To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

  A. Group1 and Group4 only

  B. Group1, Group2, Group3, Group4, and Group5

  C. Group1 and Group2 only D. Group1 only

  E. Group1, Group2, Group4, and Group5 only

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced