Pass SC-300 Exam to Get Microsoft Certification

1. You have an Azure subscription that contains a user named User! and two resource groups named RG1 and RG2.

You need to ensure that User1 can perform the following tasks:

• View all resources.

• Restart virtual machines.

• Create virtual machines in RG1 only.

• Create storage accounts in RG1 only.

What is the minimum number of role-based access control (RBAC) role assignment* required?

2. Your company has an Azure AD tenant that contains the users shown in the following table.





You have the app registrations shown in the following table.





A company policy prevents changes to user permissions.

Which user can create appointments in the calendar of each user at the company?

3. You have an Azure subscription named Sub1 that contains a virtual machine named VM1.

You need to enable Microsoft Entra login for VM1 and configure VM1 to access the resources in Sub1.

Which type of identity should you assign to VM1?

4. You have a Microsoft Entra tenant that contains the users shown in the following table.





You have an administrative unit named Au1.Group1, User2, and User3are members of Au1.

User5 is assigned the User Administrator role for Au1.

For which users can User5 reset passwords?

5. You have an Azure Active Directory (Azure AD) tenant that contains the following objects:

✑ A device named Device1

✑ Users named User1, User2, User3, User4, and User5

✑ Groups named Group1, Group2, Group3, Group4, and Group5

The groups are configured as shown in the following table.





To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

6. You have an Azure AD tenant that contains the users shown in the following table.





You add an enterprise application named App1 to Azure AD and set User1 as the owner of App1 requires admin consent to access Azure AD before the app can be used.

You configure the Admin consent requests strong as shown in the following exhibit.

Admin consent requests.

7. You have a Microsoft 365 subscription that contains the following:

• An Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium P2 license

• A Microsoft SharePoint Online site named Site1

• A Microsoft Teams team named Team1

You need to create an entitlement management workflow to manage Site1 and Team1.

What should you do first?

8. SIMULATION

Task 3

You need to add the Linked ln application as a resource to the Sales and Marketing access package.

The solution must NOT remove any other resources from the access package.

9. You have a Microsoft 365 tenant.

You need to ensure that you tan view Azure Active Directory (Azure AD) audit log information by using Azure Monitor.

What should you do first?

10. You have an Azure subscription that contains an Azure Automation account named Automation1 and an Azure key vault named Vault1. Vault1 contains a secret named Secret 1. You enable a system-assigned managed identity for Automation1.

You need to ensure that Automation! can read the contents of Secret1.

The solution must meet the following requirements:

• Prevent Automation1 from accessing other secrets stored in Vault1.

• Follow the principle of least privilege.

What should you do?

11. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result, these questions will not appear in the review screen.

You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.

You deploy an Azure subscription and enable Microsoft 365 Defender.

You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.

Solution: From the Microsoft 365 Defender portal, you add the Amazon Web Services app connector.

Does this meet the goal?

12. You have an Azure Active Directory (Azure AD) tenant named contoso.com.

You implement entitlement management to provide resource access to users at a company named Fabrikam, Inc. Fabrikam uses a domain named fabrikam.com.

Fabrikam users must be removed automatically from the tenant when access is no longer required.

You need to configure the following settings:

✑ Block external user from signing in to this directory: No

✑ Remove external user: Yes

✑ Number of days before removing external user from this directory: 90

What should you configure on the Identity Governance blade?

13. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains an administrative unit named Department1.

Department1 has the users shown in the Users exhibit. (Click the Users tab.)





Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)





Department1 has the user administrator assignments shown in the Assignments exhibit. (Click The Assignments tab.)





The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

14. HOTSPOT

You have an Azure subscription named Sub1 that contains two resource groups named RG1 and RG2.

Sub1 contains the users shown in the following table.





Sub1 contains the resources shown in the following table.





You create the role-based access control (RBAC) role assignments shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No NOTE: Each correct selection is worth one point.

15. You have three Azure subscriptions that are linked to a single Microsoft Entra tenant.

You need to evaluate and remediate the risks associated with highly privileged accounts. The solution must minimize administrative effort.

What should you use?

16. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result these questions will not appear in the review screen.

You have a Microsoft 365 ES subscription.

You create a user namedUser1.

You need to ensure that User1 can update the status of identity Secure Score improvement actions.

Solution: You assign the Security Operator role User1.

Does this meet the goal?

17. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not initiate.

Solution: From the Microsoft Entra admin center, you configure the Notifications settings for multi-factor authentication (MFA).

Does this meet the goal?

18. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium Plan 2 license.

The tenant contains the users shown in the following table.





You have the Device Settings shown in the following exhibit.





User1 has the devices shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

19. You have an Azure Ad tenant that contains the users show in the following table.





You create a dynamic user group and configure the following rule syntax.





Which users will be added to the group?

20. HOTSPOT

You have a Microsoft Entra tenant that contains the users shown in the following table.





You have a user risk policy that has the following settings:

• Assignments:

o Include: Group1

o Exclude: Group2

• Sign-in risk Medium and above

• Access controls:

o Grant access: Require password change

When the users attempt to sign in. user risk levels are detected as shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No.

21. HOTSPOT

You have a Microsoft Entra tenant that contains an administrative unit named AU1. AU1 is configured for assigned membership.

The tenant contains the users shown in the following table.





The tenant contains the groups shown in the following table.





For AU1, you update the following configurations:

. Membership type: Dynamic User

・ Dynamic membership rule: (user.department -eq "hr")

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

22. DRAG DROP

Your company has an Azure Active Directory (Azure AD) tenant named contoso.com.

The company is developing a web service named App1.

You need to ensure that App1 can use Microsoft Graph to read directory data in contoso.com.

Which three actions should yon perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them In the correct order.

23. HOTSPOT

You have two Microsoft Entra tenants named contoso.com and fabhkam.com.

Contoso.com contains the users shown in the following table.





Contoso.com contains the groups shown in the following table.





You configure cross-tenant synchronization from contoso.com to fabrikam.com and enable cross-tenant synchronization for User3 and Group2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

24. You have an Azure AD tenant and a .NET web app named App1. You need to register App1 for Azure AD authentication.

What should you configure for App1?

25. You need to resolve the issue of I-.Group1.

What should you do first?

26. You have an Azure subscription that contains an Azure SQL database named db1.

You deploy an Azure App Service web app named App1 that provide product information to users that connect to App1 anonymously.

You need to provide App1 with Access to db1.

The solution must meet the following requirements:

* Credentials must only be available to App1.

* Administrative effort must be minimized.

Which type of credentials should you use?

27. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.

An administrator deletes User1.

You need to identity the following:

• How many days after the account of User1 is deleted can you restore the account?

• Which is the least privileged role that can be used to restore User1?

What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

28. You have an Azure AD tenant that contains a user named User1 and a registered app named App1.

User1 deletes the app registration of Appl.

You need to restore the app registration.

What is the maximum number of days you have to restore the app registration from when it was deleted?

29. You have an Azure subscription named Sub1.

You purchase a Microsoft Entra Permissions Management license.

You need to onboard Permissions Management.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE; Each correct selection is worth one point.

30. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that has the default App registrations settings.

The tenant contains the users shown in the following table.





You purchase two cloud apps named App1 and App2. The global administrator registers App1 in Azure AD.

You need to identify who can assign users to App1, and who can register App2 in Azure AD.

What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

31. HOTSPOT

You have Microsoft Entra tenant.

You need to configure the following External Identities features:

• B2B collaboration

• Monthly active users (MAU)-based pricing

Which two settings should you configure? To answer, select the settings in the answer area. NOTE: Each correct selection is worth one point.

32. You need to modify the settings of the User administrator role to meet the technical requirements.

Which two actions should you perform for the role? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

33. Topic 2, Contoso, Ltd



Overview

Contoso, Ltd is a consulting company that has a main office in Montreal offices in London and Seattle.

Contoso has a partnership with a company named Fabrikam, Inc Fabcricam has an Azure Active Diretory (Azure AD) tenant named fabrikam.com.



Existing Environment

The on-premises network of Contoso contains an Active Directory domain named contos.com. The domain contains an organizational unit (OU) named Contoso_Resources. The Contoso_Resoureces OU contains all users and computers.

The Contoso.com Active Directory domain contains the users shown in the following table.







Microsoft 365/Azure Environment

Contoso has an Azure AD tenant named Contoso.com that has the following associated licenses:

✑ Microsoft Office 365 Enterprise E5

✑ Enterprise Mobility + Security

✑ Windows 10 Enterprise E5

✑ Project Plan 3



Azure AD Connect is configured between azure AD and Active Directory Domain Serverless (AD DS). Only the Contoso Resources OU is synced.

Helpdesk administrators routinely use the Microsoft 365 admin center to manage user settings.

User administrators currently use the Microsoft 365 admin center to manually assign licenses, All user have all licenses assigned besides following exception:

The users in the London office have the Microsoft 365 admin center to manually assign licenses.



All user have licenses assigned besides the following exceptions:

✑ The users in the London office have the Microsoft 365 Phone System License unassigned.

✑ The users in the Seattle office have the Yammer Enterprise License unassigned. Security defaults are disabled for Contoso.com.

Contoso uses Azure AD Privileged identity Management (PIM) to project administrator roles.



Problem Statements

Contoso identifies the following issues:

• Currently, all the helpdesk administrators can manage user licenses throughout the entire Microsoft 365 tenant.

• The user administrators report that it is tedious to manually configure the different license requirements for each Contoso office.

• The helpdesk administrators spend too much time provisioning internal and guest access to the required Microsoft 365 services and apps.

• Currently, the helpdesk administrators can perform tasks by using the: User administrator role without justification or approval.

• When the Logs node is selected in Azure AD, an error message appears stating that Log Analytics integration is not enabled.



Planned Changes

Contoso plans to implement the following changes.

Implement self-service password reset (SSPR). Analyze Azure audit activity logs by using Azure Monitor-Simplify license allocation for new users added to the tenant. Collaborate with the users at Fabrikam on a joint marketing campaign. Configure the User administrator role to require justification and approval to activate.

Implement a custom line-of-business Azure web app named App1. App1 will be accessible from the internet and authenticated by using Azure AD accounts.

For new users in the marketing department, implement an automated approval workflow to provide access to a Microsoft SharePoint Online site, group, and app.

Contoso plans to acquire a company named Corporation. One hundred new A Datum users will be created in an Active Directory OU named Adatum. The users will be located in London and Seattle.



Technical Requirements

Contoso identifies the following technical requirements:

• AH users must be synced from AD DS to the contoso.com Azure AD tenant.

• App1 must have a redirect URI pointed to https://contoso.com/auth-response.

• License allocation for new users must be assigned automatically based on the location of the user.

• Fabrikam users must have access to the marketing department's SharePoint site for a maximum of 90 days.

• Administrative actions performed in Azure AD must be audited. Audit logs must be retained for one year.

• The helpdesk administrators must be able to manage licenses for only the users in their respective office.

• Users must be forced to change their password if there is a probability that the users' identity was compromised.



HOTSPOT

You need to meet the technical requirements for license management by the helpdesk administrators.

What should you create first, and which tool should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

34. You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs.

Yon receive more than 100 email alerts each day for tailed Azure Al) user sign-in attempts.

You need to ensure that a new security administrator receives the alerts instead of you.

Solution: From Azure monitor, you modify the action group.

Does this meet the goal?

35. HOTSPOT

You have an Azure AD tenant named contoso.com that has Email one-time passcode for guests set to Yes.

You invite the guest users shown in the following table.





Which users will receive a one-time passcode, and how long will the passcode be valid? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

36. HOTSPOT

Your network contains an on-premises Active Directory domain named contoso.com.

The domain contains the objects shown in the following table.





You install Microsoft Entra Connect.

You configure the Domain and OU filtering settings as shown in the Domain and OU Filtering exhibit. (Click the Domain and OU Filtering tab.)





You configure the Filter users and devices settings as shown in the Filter Users and Devices exhibit. (Click the Filter Users and Devices tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

37. You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit. (Click the Exhibit tab.)





You are evaluating the following passwords:

✑ Pr0jectlitw@re

✑ T@ilw1nd

✑ C0nt0s0

Which passwords will be blocked?

38. You have a Microsoft Entra tenant that has a Microsoft Entta ID P2 license. You create a Log Analytics workspace.

You need to ensure that you can view Microsoft Entra ID audit log information by using Azure Monitor.

What should you do first?

39. HOTSPOT

You have an Azure AD tenant that contains multiple storage accounts.

You plan to deploy multiple Azure App Service apps that will require access to the storage accounts.

You need to recommend an identity solution to provide the apps with access to the storage accounts.

The solution must minimize administrative effort.

Which type of identity should you recommend, and what should you recommend using to control access to the storage accounts? To answer, select the appropriate options in the answer area.

40. You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com. Several users use their contoso.com email address for self-service sign-up to 1 Microsoft Entra. You gain global administrator privileges to the Microsoft Entra tenant that contains the self-signed users.

You need to prevent the users from creating user accounts in the contoso.com 2 Microsoft Entra tenant for self-service sign-up to Microsoft 365 services.

Which PowerShell cmdlet should you run?

41. HOTSPOT

You have an Azure subscription.

You need to create two custom roles named Role1 and Role2.

The solution must meet the following requirements:

• Users that are assigned Role1 can create or delete instances of Azure Container Apps.

• Users that are assigned Role2 can enforce adaptive network hardening rules.

Which resource provider permissions are required for each role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

42. You have an Azure AD tenant named Contoso that contains a terms of use (ToU) named Terms1 and an access package. Contoso users collaborate with an external organization named Fabrikam. Fabrikam users must accept Terms1 before being allowed to use the access package. You need to identify which users accepted or declined Terms1.

What should you use?

43. DRAG DROP

Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect. Attire AD Connect is installed on a server named Server 1.

You deploy a new server named Server? that runs Windows Server 2019.

You need to implement a failover server for Azure AD Connect. The solution must minimize how long it takes to fail over if Server1 fails.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

44. HOTSPOT

You have a Microsoft 365 E5 subscription that contains the users shown in the following table.





The users are assigned the roles shown in the following table.





For which users can User1 and User4 reset passwords? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

45. SIMULATION

Task 2

You need to implement a process to review guest users who have access to the Salesforce app.

The review must meet the following requirements:

• The reviews must occur monthly.

• The manager of each guest user must review the access.

• If the reviews are NOT completed within five days, access must be removed.

• If the guest user does not have a manager, Megan Bowen must review the access.

46. HOTSPOT

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant. You need to ensure that user authentication always occurs by validating passwords against the AD DS domain.

What should you configure, and what should you use? To answer, select the appropriate options in the answer area. NOTE: Each coned selection is worth one point.

47. You have a Microsoft 365 ES subscription that user Microsoft Defender for Cloud Apps and Yammer.

You need prevent users from signing in to Yammer from high-risk locations.

What should you do in the Microsoft Defender for Cloud Apps portal?

48. HOTSPOT

You have an Azure subscription named Sub1 ilia1 contains a storage account named storage1.

You need to deploy two apps named App1 and App2 that will have the following configurations:

• App1 will be deployed as a registered app in Sub1.

• App1 will access storage1 by using Microsoft Entra authentication.

• App2 will access storage1 by using a single Microsoft Entra identity.

• App2 be hosted on two new virtual machines named VM1 and VM2.

The solution must minimize administrative effort.

Which type of identity will each app use to access storage1? To answer, select the appropriate options in the answer area.

49. HOTSPOT

You have a Microsoft Entra tenant that contains the users shown in the following table.





The tenant contains the identities shown in the following table.





Which users can create custom security attributes, and to which identities can the attributes be assigned? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

50. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result these questions will not appear in the review screen.

You have a Microsoft 365 E5 subscription.

You create a user named User1.

You need to ensure that User1 can update the status of identity Secure Score improvement actions.

Solution: You assign the User Administrator role to User1.

Does this meet the goal?

51. HOTSPOT

You have a Microsoft 36S tenant.

You create a named location named HighRiskCountries that contains a list of high-risk countries. You need to limit the amount of time a user can stay authenticated when connecting from a high-risk country.

What should you configure in a conditional access policy? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

52. DRAG DROP

You have an on-premises Microsoft Exchange organization that uses an SMTP address space of contoso.com.

You discover that users use their email address for self-service sign-up to Microsoft 365 services.

You need to gain global administrator privileges to the Azure Active Directory (Azure AD) tenant that contains the self-signed users.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

53. SIMULATION

Task 4

You need to ensure that all users can consent to apps that require permission to read their user profile. Users must be prevented from consenting to apps that require any other permissions.

54. HOTSPOT

You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.





You plan to manage the lifecycles of the groups.

Which groups can be set to expire, and what is the shortest group lifetime you can set? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

55. Topic 5, SIMULATIONS and TASK



SIMULATION

Task 1

You need to deploy multi factor authentication (MFA).

The solution must meet the following requirements:

• Require MFA registration only for members of the Sg-Finance group.

• Exclude Debra Berger from having to register for MFA.

• Implement the solution without using a Conditional Access policy.

56. HOTSPOT

You need to implement on-premises application and SharePoint Online restrictions to meet the authentication requirements and the access requirements.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

57. HOTSPOT

You have a Microsoft Entra tenant that contains two remote networks named RemoteNetwork1 and RemoteNetwork2 and the users shown in the following table.





You have the devices shown in the following table.

58. DRAG DROP

You need to resolve the recent security incident issues.

What should you configure for each incident? To answer, drag the appropriate policy types to the correct issues. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

59. You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.





Which objects can you add as eligible in Azure Privileged identity Management (PIM) for an Azure AD role?

60. HOTSPOT

You have a Microsoft 365 tenant.

You need to identify users who have leaked credentials.

The solution must meet the following requirements.

• Identity sign-Ins by users who ate suspected of having leaked credentials.

• Rag the sign-ins as a high risk event.

• Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.

What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

61. You have a Microsoft Entra tenant that contains the groups shown in the following table.





You need to implement Privileged Identity Management (PIM) for the groups.

Which groups can be managed by using PIM?

62. You have a Microsoft 365 E5 subscription.

You purchase the app governance add-on license.

You need to enable app governance integration.

Which portal should you use?

63. You have an Azure subscription named Sub1 that uses Microsoft Entra Permissions Management.

Sub1 contains a user named User1. User1 is granted multiple permissions across Sub1.

You need to replace all the permissions granted to User1 with read-only permissions. The solution must minimize administrative effort.

What should you do on the Remediation tab in Permissions Management?

64. You have an Azure AD tenant that uses Azure AD Identity Protection and contains the resources shown in the following table.





Azure Multi-Factor Authentication (MFA) is enabled for all users.

User1 triggers a medium severity alert that requires additional investigation.

You need to force User1 to reset his password the next time he signs in. the solution must minimize administrative effort.

What should you do?

65. You have a Microsoft 365 subscription that contains a user named User1.

You need to ensure that User1 can create access reviews for Azure AD roles. The solution must use the principal of least privilege.

Which role should you assign to User1?

66. HOTSPOT

You have an on-premises datacenter that contains the hosts shown in the following table.





You have an Azure Active Directory (Azure AD) tenant that syncs to the Active Directory forest. Multi-factor authentication (MFA) is enforced for Azure AD.

You need to ensure that you can publish App1 to Azure AD users.

What should you configure on Server and Firewall1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

67. You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4.

You plan to assign the users the following roles for RG1:

• User1: Reader

• User2: Contributor

• User3: Storage Blob Data Reader

• User4: Virtual Machine Contributor

You are evaluating the use of attribute-based access control (ABAC).

Which user's role will support the use of ABAC?

68. You have an Azure subscription that contains the users shown in the following table.





You need to implement Azure AD Privileged Identity Management (PIM).

Which users can use PIM to activate their role permissions?

69. You have an Azure Active Directory (Azure AD) tenant that contains the groups shown in the following table.





For which groups can you create an access review?

70. You have an Azure Active Directory (Azure AD) tenant that contains cloud-based enterprise apps.

You need to group related apps into categories in the My Apps portal.

What should you create?

71. HOTSPOT

You need to implement password restrictions to meet the authentication requirements.

You install the Azure AD password Protection DC agent on DC1.

What should you do next? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

72. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.





You plan to implement Azure AD Identity Protection.

Which users can configure the user risk policy, and which users can view the risky users report? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

73. You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant contains the groups shown in the following table.





In Azure AD. you add a new enterprise application named Appl.

Which groups can you assign to App1?

74. DRAG DROP

You have a Microsoft 365 E5 subscription.

You need to perform the following tasks:

• Identify the locations and IP addresses used by Azure AD users to sign in

• Review the Azure AD security settings and identify improvement recommendations.

• Identify changes to Azure AD users or service principle.

What should you use for each task? To answer, drag the appropriate resources to the correct requirements. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

75. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest.

You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.

You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

Solution: You configure password writeback.

Does this meet the goal?

76. HOTSPOT

You have a Microsoft 365 tenant and an Active Directory domain named adatum.com.

You deploy Azure AD Connect by using the Express Settings.

You need to configure self-service password reset (SSPR) to meet the following requirements:

When users reset their password, they must be prompted to respond to a mobile app notification or answer three predefined security questions.

Passwords must be synced between the tenant and the domain regardless of where the password was reset.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

77. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result, these questions will not appear in the review screen.

You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.

You deploy an Azure subscription and enable Microsoft 365 Defender.

You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.

Solution: From the Microsoft 365 Defender portal, you add the Google Workspace app connector.

Does this meet the goal?

78. You configure a new Microsoft 36S tenant to use a default domain name of contosso.com.

You need to ensure that you can control access to Microsoft 365 resource-, by using conditional access policy.

What should you do first?

79. Your company requires that users request access before they can access corporate applications. You register a new enterprise application named MyApp1 in Azure Active Dilatory (Azure AD) and configure single sign-on (SSO) for MyApp1.

Which settings should you configure next for MyApp1?

80. HOTSPOT

You have a Microsoft 365 E5 subscription.

You need to create a dynamic user group that will include all the users that do NOT have a department defined in their user profile.

How should you complete the membership rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

81. You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not Initiate.

Solution: From the Azure portal, you configure the Account lockout settings for multi-factor

authentication (MFA).

Does this meet the goal?

82. You have a Microsoft 36S subscription. The subscription contains users that use Microsoft Outlook 2016 and Outlook 2013 clients. You need to implement tenant restrictions. The solution must minimize administrative effort.

What should you do first?

83. You have an Azure subscription that containes a registered app named App1.

You need to review the sign-in activity for App1.

The solution must meet the following requirements:

• Identify the number of failed sign-ins.

• Identify the success rate of sign-ins.

• Minimize administrative effort.

What should you use?

84. You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain.

The domain contains the servers shown in the following table.





The domain controllers are prevented from communicating to the internet.

You implement Azure AD Password Protection on Server1 and Server2.

You deploy a new server named Server4 that runs Windows Server 2019.

You need to ensure that Azure AD Password Protection will continue to work if a single server fails.

What should you implement on Server4?

85. You have an Azure AD tenant.

You need to bulk create 25 new user accounts by uploading a template file.

Which properties are required in the template file?

86. You have a Microsoft 365 E5 subscription.

You plan to deploy a third-party software as a service (SaaS) app named App1.

You need to onboard App1 to Microsoft Defender for Cloud Apps. The solution must ensure that you can implement session control policies.

What should you do first?

87. Your network contains an on-premises Active Directory domain that syncs to an Azure AD tenant.

Users sign in to computers that run Windows 10 and are joined to the domain.

You plan to implement Azure AD Seamless Single Sign-On (Azure AD Seamless SSO). You need to configure the Windows 10 computers to support Azure AD Seamless SSO.

What should you do?

88. Your company has two divisions named Contoso East and Contoso West.

The Microsoft 365 identity architecture tor both divisions is shown in the following exhibit.





You need to assign users from the Contoso East division access to Microsoft SharePoint Online sites in the Contoso West tenant. The solution must not require additional Microsoft 3G5 licenses.

What should you do?

89. You have an Azure Active Directory (Azure AD) tenant named conto.so.com that has Azure AD Identity Protection enabled. You need to Implement a sign-in risk remediation policy without blocking access.

What should you do first?

90. You have a Microsoft Entra tenant.

You discover that a large number of new apps were added to the tenant.

You need to implement an approval process for new enterprise applications.

What should you do?

91. You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain. Users connect to the internet by using a hardware firewall at your company. The users authenticate to the firewall by using their Active Directory credentials.

You plan to manage access to external applications by using Azure AD.

You need to use the firewall logs to create a list of unmanaged external applications and the users who access them.

What should you use to gather the information?

92. DRAG DROP

You have a Microsoft 365 E5 subscription. The subscription contains 500 devices that run Windows. You deploy the Global Secure Access client to the devices.

You need to prevent users from accessing httpsy/contoso.com from the devices

Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

93. You have a Microsoft Entra tenant.

You need to ensure that only users from specific external domains can be invited as guests to the tenant.

Which settings should you configure?

94. You have an Azure subscription that contains the custom roles shown in the following table.





You need to create a custom Azure subscription role named Role3 by using the Azure portal. Role3 will use the baseline permissions of an existing role.

Which roles can you clone to create Role3?

95. SIMULATION

Task 5

You need to assign a Windows 10/11 Enterprise E3 license to the Sg-Retail group.

96. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You use Azure Monitor to analyze Azure Active Directory (Azure AD) activity logs.

You receive more than 100 email alerts each day for failed Azure AD user sign-in attempts.

You need to ensure that a new security administrator receives the alerts instead of you.

Solution: From Azure AD, you modify the Diagnostics settings.

Does this meet the goal?

97. HOTSPOT

You need to support the planned changes and meet the technical requirements for MFA.

Which feature should you use, and how long before the users must complete the registration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

98. HOTSPOT

You have an azure subscription that contains a resource group named RG1, RG1 contains two virtual machines named VM1 and VM2 that have Microsoft intra ID login enabled.

The subscription contains the users shown in the following, table.





Which users can sign in to VM1. and which users can sign in to VM?? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

99. HOTSPOT

You need to configure app registration in Azure AD to meet the delegation requirements.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.