Pass SC-300 Exam to Get Microsoft Certification

1. You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1.

A contractor uses the credentials of [email protected].

You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected].

What should you do?

2. HOTSPOT

You have an Azure AD tenant that contains the users shown in the following table.





User2 reports that he can only configure multi-factor authenticating (MFA) to use the Microsoft Authenticator app.

You need to ensure that User2 can configure alternate MFA methods.

Which configuration is required, and which user should perform the configuration? To answer, select the appropriate options in the answer area.

3. DRAG DROP

Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect.

Attire AD Connect is installed on a server named Server 1.

You deploy a new server named Server? that runs Windows Server 2019.

You need to implement a failover server for Azure AD Connect. The solution must minimize how long it takes to fail over if Server1 fails.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

4. HOTSPOT

Your network contains an on-premises Active Directory Domain services (AD DS) domain that syncs with an Azure AD tenant.

The AD DS domain contains the organizational units (OUs) shown in the following table.





You need to create a break-glass account named BreakGlass.

Where should you create BreakGlass, and which role should you assign to BreakGlass? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

5. You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest. The tenant-uses through authentication.

A corporate security policy states the following:

✑ Domain controllers must never communicate directly to the internet.

✑ Only required software must be- installed on servers.

The Active Directory domain contains the on-premises servers shown in the following table.





You need to ensure that users can authenticate to Azure AD if a server fails.

On which server should you install an additional pass-through authentication agent?

6. You have a Microsoft 365 subscription that contains the users shown in the following table.





From the tenan1, you configure a naming policy for groups.

Which users are affected by the naming policy?

7. HOTSPOT

You have an Azure AD tenant named contoso.com that contains a group named All Company and has the following Identity Governance settings:

• Block external users from signing in to this directory: Yes

• Remove external user Yes

• Number of days before removing external user from this directory: 30

On March 1, 2022, you create an access package named Package1 that has the following settings:

• Resource roles

o Name: All Company

o Type: Group and Team

o Role: Member

• Lifecycle

o Access package assignment expire: On date

o Assignment expiration date: April 1, 2022

On March 1, 2022, you assign Package1 to the guest users shown in the following table.





On March 2, 2022, you assign the Reports reader role to Guest1.

On April 1(2022, you invite a guest user named Guest3 to contoso.com.

On April 4, 2022, you add Guest3 to the All Company group.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

8. HOTSPOT

Your on-premises network contains an Active Directory domain that uses Azure AD Connect to sync with an Azure AD tenant.

You need to configure Azure AD Connect to meet the following requirements:

• User sign-ins to Azure AD must be authenticated by an Active Directory domain controller.

• Active Directory domain users must be able to use Azure AD self-service password reset (SSPR).

What should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

9. DRAG DROP

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2.

You need to ensure that User1 can create access reviews for groups, and that User2 can review the history report for all the completed access reviews. The solution must use the principle of least privilege.

Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

10. You have a Microsoft Entra tenant.

You need to ensure that only users from specific external domains can be invited as guests to the tenant.

Which settings should you configure?

11. HOTSPOT

You have a Microsoft 365 E5 subscription.

You need to configure app consent for the subscription.

The solution must meet the following requirements:

• Disable user consent to apps.

• Configure admin consent workflow for apps.

Which portal should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point

12. You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.

You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

What should you use?

13. You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server.

You enable Microsoft Entra login for the virtual machines.

Users report that they cannot sign in to the virtual machines by using their Microsoft Entra credentials.

You need to ensure that the users can sign in to the virtual machines.

What should you do first?

14. You have an Azure Active Directory Premium P2 tenant.

You create a Log Analytics workspace.

You need to ensure that you can view Azure Active Directory (Azure AD) audit log information by using Azure Monitor.

What should you do first?

15. HOTSPOT

You have an Azure subscription.

Azure AD logs are sent to a Log Analytics workspace.

You need to query the logs and graphically display the number of sign-ins per user.

How should you complete the query? To answer, select the appropriate options in the answer area.

16. Topic 5, SIMULATIONS and TASK



Task 1

You need to deploy multi factor authentication (MFA).

The solution must meet the following requirements:

• Require MFA registration only for members of the Sg-Finance group.

• Exclude Debra Berger from having to register for MFA.

• Implement the solution without using a Conditional Access policy.

17. HOTSPOT

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table.

The users have the devices shown in the following table.

You create the following two Conditional Access policies:

• Name: CAPolicy1

• Assignments

o Users or workload identities: Group 1

o Cloud apps or actions: Office 365 SharePoint Online

o Conditions

■ Filter for devices: Exclude filtered devices from the policy

■ Rule syntax: device.displayName -starts With "Device*" o Access controls

■ Grant: Block access

■ Session: 0 controls selected

o Enable policy: On

• Name: CAPolicy2

• Assignments

o Users or workload identities: Group2

o Cloud apps or actions: Office 365 SharePoint Online

o Conditions: 0 conditions selected

• Access controls

o Grant: Grant access

■ Require multifactor authentication

o Session:

0 controls selected

• Enable policy: On

All users confirm that they can successfully authenticate using MFA.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

18. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains an administrative unit named Department1.

Department1 has the users shown in the Users exhibit. (Click the Users tab.)





Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)





Department1 has the user administrator assignments shown in the Assignments exhibit. (Click the Assignments tab.)





The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

19. HOTSPOT

You have a Microsoft 365 tenant and an Active Directory domain named adatum.com.

You deploy Azure AD Connect by using the Express Settings.

You need to configure self-service password reset (SSPR) to meet the following requirements:

When users reset their password, they must be prompted to respond to a mobile app notification or answer three predefined security questions.

Passwords must be synced between the tenant and the domain regardless of where the password was reset.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

20. HOTSPOT

You have an Azure subscription named Sub1 that contains two resource groups named RG1 and RG2.

Sub1 contains the users shown in the following table.





Sub1 contains the resources shown in the following table.





You create the role-based access control (RBAC) role assignments shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No NOTE: Each correct selection is worth one point.

21. HOTSPOT

You have a Microsoft 365 tenant.

You need to identify users who have leaked credentials.

The solution must meet the following requirements.

• Identity sign-Ins by users who ate suspected of having leaked credentials.

• Rag the sign-ins as a high risk event.

• Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.

What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

22. HOTSPOT

Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant.

The tenant contains the groups shown in the following table.





The tenant contains the users shown in the following table.





You create an access review as shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

23. HOTSPOT

You have an Azure AD tenant.

You perform the tasks shown in the following table.





On April 5, an administrator deletes App1, App2, App3, and App4.

You need to restore the apps and the settings.

Which apps can you restore on April 16, and which settings can you restore for App4 on April 16? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

24. HOTSPOT

You need to implement password restrictions to meet the authentication requirements.

You install the Azure AD password Protection DC agent on DC1.

What should you do next? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

25. You need to implement the planned changes for Package1.

Which users can create and manage the access review?

26. You have the Azure resources show in the following table.





To Which identities can you assign the Contributor role for RG1?

27. HOTSPOT

You have an Azure subscription that contains the following virtual machine Name: VM1

Azure region: East US

System-assigned managed identity: Disabled

You create the managed identities shown in the following table.





You perform the following actions:

• Assign Managed1 to VM1.

• Create a resource group named RG1 in the West US region.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

28. HOTSPOT

You have an Azure AD tenant that contains the users shown in the following table.





You have the Azure AD Identity Protection policies shown in the following table.





You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

29. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.





For which users can you configure the Job title property and the Usage location property in Azure AD? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

30. HOTSPOT

You have a Microsoft 365 E5 subscription that contains the users shown in the following table.





The users are assigned the roles shown in the following table.





For which users can User1 and User4 reset passwords? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

31. You have an Azure Active Directory (Azure AD) tenant.

You open the risk detections report.

Which risk detection type is classified as a user risk?

32. You have an Azure AD tenant that has multi-factor authentication (MFA) enforced and self-service password reset (SSPR) enabled.

You enable combined registration in interrupt mode.

You create a new user named User1.

Which two authentication methods can User1 use to complete the combined registration process? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

33. You plan to deploy a new Azure AD tenant.

Which multifactor authentication (MFA) method will be enabled by default for the tenant?

34. You have a Microsoft 365 tenant.

All users have mobile phones and laptops.

The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity.

While working from the remote locations, the users connect their laptop to a wired network that has internet access.

You plan to implement multi-factor authentication (MFA).

Which MFA authentication method can the users use from the remote location?

35. DRAG DROP

Your network contains an on-premises Active Directory domain named contoso.com that syncs with a Microsoft Entra tenant by using Microsoft Entra Connect.

The domain contains the users shown in the following table.





From Active Directory Users and Computers, you add the following user

• Name: User3

• UPN: [email protected]

• Proxy addresses: smtp: [email protected], smtp: [email protected]

From Active Directory Users and Computers, you update the proxyAddresses attribute for each user as shown in the following table.





You trigger a manual synchronization.

Which sync status will Microsoft Entra Connect sync return for each user? To answer, drag the appropriate status to the correct users. Each status may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

36. You have a Microsoft 365 tenant that uses the domain named fabrikam.com.

The Guest invite settings for Azure Active Directory (Azure AD) are configured as shown in the exhibit. (Click the Exhibit tab.)





A user named [email protected] shares a Microsoft SharePoint Online document library to the users shown in the following table.





Which users will be emailed a passcode?

37. You have an Azure subscription that containes a registered app named App1.

You need to review the sign-in activity for App1.

The solution must meet the following requirements:

• Identify the number of failed sign-ins.

• Identify the success rate of sign-ins.

• Minimize administrative effort.

What should you use?

38. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium Plan 2 license.

The tenant contains the users shown in the following table.





You have the Device Settings shown in the following exhibit.





User1 has the devices shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

39. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result, these questions will not appear in the review screen.

You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.

You deploy an Azure subscription and enable Microsoft 365 Defender

You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.

Solution: From the Microsoft 365 Defender portal, you add the Microsoft Azure app connector.

Does this meet the goal?

40. You have an Azure subscription that contains a user named User1.

You need to meet the following requirements:

• Prevent User1 from being added as an owner of newly registered apps.

• Ensure that User1 can manage the application proxy settings.

• Ensure that User2 can register apps.

• Use the principle of least privilege.

Which role should you assign to User1?

41. You have an Azure subscription that contains an Azure Automation account named Automation1 and an Azure key vault named Vault1. Vault1 contains a secret named Secret 1.

You enable a system-assigned managed identity for Automation1.

You need to ensure that Automation! can read the contents of Secret1.

The solution must meet the following requirements:

• Prevent Automation1 from accessing other secrets stored in Vault1.

• Follow the principle of least privilege.

What should you do?

42. You have an Azure AD tenant that contains the users shown in the following table.





The User settings for enterprise applications have the following configuration.

• Users can consent to apps accessing company data on their behalf:

• Users can consent to apps accessing company data for the groups they

• Users can request admin consent to apps they are unable to consent to: Yes

• Who can review admin consent requests: Admin2, User2

User1 attempts to add an app that requires consent to access company data.

Which user can provide consent?

43. HOTSPOT

You have an Azure AD tenant that contains the groups shown in the following table.





You create an access review for Group1 as shown in the following table.





You create an access review for Group2 as shown in the following table.





What is the minimum number of Azure AD Premium P2 licenses required for each group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

44. DRAG DROP

You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com. The subscription contains a group named Group1 and a virtual machine named VM1.

You need to meet the following requirements:

• Enable a system-assigned managed identity for VM1.

• AddVM1 to Group1.

How should you complete the PowerShell script? To answer, drag the appropriate cmdlets to the correct targets. Each cmdlet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

45. You have a Microsoft 365 tenant.

You need to ensure that you tan view Azure Active Directory (Azure AD) audit log information by using Azure Monitor.

What should you do first?

46. You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.





User1 is the owner of Group1.

You create an access review that has the following settings:

✑ Users to review: Members of a group

✑ Scope: Everyone

✑ Group: Group1

✑ Reviewers: Members (self)

Which users can perform access reviews for User3?

47. You have an Azure subscription.

You are evaluating enterprise software as a service (SaaS) apps.

You need to ensure that the apps support automatic provisioning of Microsoft Entra users.

Which specification should the apps support?

48. You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain.

Users connect to the internet by using a hardware firewall at your company. The users authenticate to the firewall by using their Active Directory credentials.

You plan to manage access to external applications by using Azure AD.

You need to use the firewall logs to create a list of unmanaged external applications and the users who access them.

What should you use to gather the information?

49. You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to be notified if a user downloads more than 50 files in one minute from Site1.

Which type of policy should you create in the Microsoft Defender for Cloud Apps portal?

50. You have a Microsoft Entra tenant that has a Microsoft Entra ID P1 license.

You need to review the Microsoft Entra ID sign-in logs to investigate sign-ins that occurred in the past.

For how long does Microsoft Entra ID store events in the sign-in logs?

51. You have an Azure Active Directory (Azure AD) tenant named contoso.com.

You implement entitlement management to provide resource access to users at a company named Fabrikam, Inc. Fabrikam uses a domain named fabrikam.com.

Fabrikam users must be removed automatically from the tenant when access is no longer required.

You need to configure the following settings:

✑ Block external user from signing in to this directory: No

✑ Remove external user: Yes

✑ Number of days before removing external user from this directory: 90

What should you configure on the Identity Governance blade?

52. You have an Azure AD tenant that contains the users shown in the following table.





The tenant has the authentication methods shown in the following table.





Which users will sign in to cloud apps by matching a number shown in the app with a number shown on their phone?

53. You need to resolve the issue of the sales department users.

What should you configure for the Azure AD tenant?

54. You need implement the planned changes for application access to organizational data.

What should you configure?

55. HOTSPOT

You have an Azure subscription.

From Entitlement management, you plan to create a catalog named Catalog1 that will contain a custom extension.

What should you create first and what should you use to distribute Catalog1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

56. You have an Azure Active Directory (Azure AD) tenant that contains the groups shown in the following table.





For which groups can you create an access review?

57. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. as a result, these questions will not appear in the review screen.

You have an Amazon Web Services (AWS) account a Google Workspace subscription, and a GitHub account

You deploy an Azure subscription and enable Microsoft 365 Defender.

You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.

Solution: From the Microsoft 365 Defender portal, you add the GitHub app connector.

Does this meet the goal?

58. HOTSPOT

You have a Microsoft 365 tenant that contains a group named Group1 as shown in the Group1 exhibit. (Click the Group1 tab.)





You create an enterprise application named App1 as shown in the App1 Properties exhibit. (Click the App1 Properties tab.)





You configure self-service for App1 as shown in the App1 Self-service exhibit. (Click the App1 Self-service tab.)





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

59. HOTSPOT

You have Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1.

Department has the users shown in the Users exhibit. (Click the Users tab.)





Department1 has the groups shown in the Groups exhibit (Click the Groups tab.)





The User Administrator role assignments are shown in the Assignments exhibit. (Click the Assignments tab.)





The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

60. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that has multi-factor authentication (MFA) enabled.

The account lockout settings are configured as shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

61. You have a Microsoft 365 tenant.

In Azure Active Directory (Azure AD), you configure the terms of use.

You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access.

What should you configure?

62. DRAG DROP

You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3.

You need to configure the users as shown in the following table.





Which portal should you use to configure each user? To answer, drag the appropriate portals to the correct users. Each portal may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

63. You create a new Microsoft 365 E5 tenant.

You need to ensure that when users connect to the Microsoft 365 portal from an anonymous IP address, they are prompted to use multi-factor authentication (MFA).

What should you configure?

64. HOTSPOT

You have an Azure subscription.

You need to create two custom roles named Role1 and Role2.

The solution must meet the following requirements:

• Users that are assigned Role1 can create or delete instances of Azure Container Apps.

• Users that are assigned Role2 can enforce adaptive network hardening rules.

Which resource provider permissions are required for each role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

65. HOTSPOT

You have a Microsoft 365 tenant.

You configure a conditional access policy as shown in the Conditional Access policy exhibit. (Click the Conditional Access policy tab.)





You view the User administrator role settings as shown in the Role setting details exhibit. (Click the Role setting details tab.)





You view the User administrator role assignments as shown in the Role assignments exhibit. (Click the Role assignments lab.)





For each of the following statement, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

66. Task 3

You need to add the Linkedln application as a resource to the Sales and Marketing access package.

The solution must NOT remove any other resources from the access package.

67. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result these questions will not appear in the review screen.

You have a Microsoft 365 E5 subscription.

You create a user named User1.

You need to ensure that User1 can update the status of identity Secure Score improvement actions.

Solution: You assign the User Administrator role to User1.

Does this meet the goal?

68. You have an Azure AD tenant that contains the users shown in The following table.





You enable self-service password reset (SSPR) for all the users and configure SSPR to require security questions as the only authentication method.

Which users must use security questions when resetting their password?

69. You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not Initiate.

Solution: From the Azure portal, you configure the Account lockout settings for multi-factor authentication (MFA).

Does this meet the goal?

70. You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.

You plan to increase app security for the subscription.

You need to identify which apps do NOT require user authentication.

What should you do in the Microsoft 365 Defender portal?

71. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

You have 100 IT administrators who are organized into 10 departments.

You create the access review shown in the exhibit. (Click the Exhibit tab.)





You discover that all access review requests are received by Megan Bowen.

You need to ensure that the manager of each department receives the access reviews of their respective department.

Solution: You create a separate access review for each role.

Does this meet the goal?

72. You have an Azure Active Directory (Azure AD) tenant that contains the following objects:

✑ A device named Device1

✑ Users named User1, User2, User3, User4, and User5

✑ Groups named Group1, Group2, Group3, Group4, and Group5

The groups are configured as shown in the following table.





To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

73. HOTSPOT

You have an Azure AD tenant that contains the users shown in the following table.





In Azure AD Identity Protection, you configure a user risk policy that has the following settings:

• Assignments: o Users: Group1

o User risk: Low and above

• Controls:

o Access: Block access

• Enforce policy: On

In Azure AD Identity Protection, you configure a sign-in risk policy that has the following settings:

• Assignments: o Users: Group2

o Sign-in risk: Low and above

• Controls:

o Access: Require multi-factor authentication

• Enforce policy. On the following settings: ng settings:

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

74. You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not Initiate.

Solution: From the Azure portal, you configure the Block/unblock users settings for multi-factor authentication (MFA).

Does this meet the goal?

75. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.

Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not initiate.

Solution: From the Azure portal, you configure the Notifications settings for multi-factor authentication (MFA).

Does this meet the goal?

76. You have an Azure Active Directory (Azure AD) tenant.

You configure self-service password reset (SSPR) by using the following settings:

• Require users to register when signing in: Yes

• Number of methods required to reset: 1

What is a valid authentication method available to users?

77. You have an Azure AD tenant that contains a user named User1

User1 needs to manage license assignments and reset user passwords.

Which role should you assign to User1?

78. You need to modify the settings of the User administrator role to meet the technical requirements.

Which two actions should you perform for the role? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

79. You need to locate licenses to the A. Datum users. The solution must need the technical requirements.

Which type of object should you create?

80. HOTSPOT

You need to configure the assignment of Azure AD licenses to the Litware users. The solution must meet the licensing requirements.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

81. You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant contains the groups shown in the following table.





In Azure AD. you add a new enterprise application named Appl.

Which groups can you assign to App1?

82. HOTSPOT

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD and contains the users shown in the following table.





In Azure AD Connect. Domain/OU Filtering is configured as shown in the following exhibit.





Azure AD Connect is configured as shown in the following exhibit.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.