SC-300 Free Exam Study Guide! (Updated 480 Questions) [Q174-Q197]

SC-300 Free Exam Study Guide! (Updated 480 Questions)

SC-300 Dumps for Microsoft Certified: Identity and Access Administrator Associate Certified Exam Questions and Answer

NEW QUESTION # 174
You have a Microsoft Exchange organization that uses an SMTP' address space of contoso.com.
Several users use their contoso.com email address for self-service sign up to Azure Active Directory (Azure AD).
You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.
You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.
Which PowerShell cmdlet should you run?

A. Set-MsolDomain
B. Update-MsolfederatedDomain
C. Set-MsolCompanySettings
D. Set-MsolDomainFederationSettings

Answer: B

Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-self-service-signup

NEW QUESTION # 175
You need to configure the assignment of Azure AD licenses to the Litware users. The solution must meet the licensing requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 176
You have an Azure subscription that contains the following virtual machine Name: VM1 Azure region: East US System-assigned managed identity: Disabled You create the managed identities shown in the following table.

You perform the following actions:
* Assign Managed1 to VM1.
* Create a resource group named RG1 in the West US region.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Yes
NO
No
This question tests understanding of Azure Managed Identities - both system-assigned and user-assigned - and their regional restrictions and role assignment capabilities.
Let's break it down carefully based on official Microsoft documentation and SC-300 study material:
* VM1 Region: East US
* System-assigned Managed Identity: Disabled (so we can only use user-assigned identities)
* Managed Identities available:
* Managed1 - East US
* Managed2 - East US
* Managed3 - West US
# Step 1: Understanding the setup
# Step 2: Regional assignment rule According to Microsoft documentation:
"A user-assigned managed identity can be used only by resources in the same Azure region as the managed identity." That means:
* A VM in East US can use user-assigned managed identities that are also located in East US only.
* A VM in East US cannot use a user-assigned managed identity created in West US.
Therefore:
* # Managed2 (East US) # can be assigned to VM1 (East US).
* # Managed3 (West US) # cannot be assigned to VM1 (East US).
# Step 3: Role assignment capability The question also includes:
"You can assign VM1 the Owner role for RG1."
Per Azure RBAC design and SC-300 guidelines:
* Azure roles (such as Owner, Contributor, Reader) can only be assigned to Azure AD security principals, which include users, groups, service principals, and managed identities - but not to Azure resources themselves (like a VM directly).
* Therefore, you cannot assign a role to VM1 as an object; you can only assign roles to VM1's managed identity (if it had one enabled).
Since VM1's system-assigned identity is disabled and the user-assigned identity (Managed1) already attached cannot represent the VM itself for new role assignments, VM1 cannot directly hold the Owner role for RG1.

NEW QUESTION # 177
SIMULATION
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:[email protected]
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
You need to assign a Windows 10/11 Enterprise E3 license to the sg-Retail group.
To complete this task, sign in to the appropriate admin center.

Answer:

Explanation:

NEW QUESTION # 178
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You implement entitlement management to provide resource access to users at a company named Fabrikam, Inc. Fabrikam uses a domain named fabrikam.com.
Fabrikam users must be removed automatically from the tenant when access is no longer required.
You need to configure the following settings:
- Block external user from signing in to this directory: No
- Remove external user: Yes
- Number of days before removing external user from this directory: 90
What should you configure on the Identity Governance blade?

A. Entitlement management settings
B. Access packages
C. Access reviews
D. Terms of use

Answer: A

Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management- external-users#manage-the-lifecycle-of-external-users

NEW QUESTION # 179
As the Azure Administrator for your organization, you need to create several security groups and populate those groups based on specific profile attributes of your users. As users join your organization, they should be automatically added to the correct group. What should you configure for this?

A. Dynamic Groups
B. Microsoft 365 Groups
C. Power Groups
D. Smart Groups

Answer: A

NEW QUESTION # 180
You have an Azure AD tenant that contains the users shown in the following table.

You have the locations shown in the following table.

The tenant contains a named location that Das the following configurations:
* Name: location1
* Mark as trusted location: Enabled
* IPv4 range: 10.10.0.0/16
MFA has a trusted iPad dress range of 193.17.17.0/24.
You have a Conditional Access policy that has the following settings:
* Name: CAPolicy1
* Assignments
o Users or workload identities: Group 1
o Cloud apps or actions: All cloud apps
* Conditions
* Locations All trusted locations
* Access controls
o Gant
* Grant access: Require multi-factor authentication
Session: 0 controls selected
* Enable policy: On
For each of the following statements select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 181
You have a Microsoft 365 tenant.
The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain. The domain contains the servers shown in the following table.

The domain controllers are prevented from communicating to the internet.
You implement Azure AD Password Protection on Server1 and Server2.
You deploy a new server named Server4 that runs Windows Server 2019.
You need to ensure that Azure AD Password Protection will continue to work if a single server fails.
What should you implement on Server4?

A. the Azure AD Password Protection proxy service
B. Azure AD Connect
C. Azure AD Application Proxy
D. Password Change Notification Service (PCNS)

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on- premisesdeploy

NEW QUESTION # 182
You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com. The subscription contains a group named Group1 and a virtual machine named VM1.
You need to meet the following requirements:
* Enable a system-assigned managed identity for VM1.
* AddVM1 to Group1.
How should you complete the PowerShell script? To answer, drag the appropriate cmdlets to the correct targets. Each cmdlet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 183
You have a Microsoft Entra tenant that contains an administrative unit named AU1. AU1 is configured for assigned membership.
The tenant contains the users shown in the following table.

For AU1, you update the following configurations:
. Membership type: Dynamic User
* Dynamic membership rule: (user.department -eq "hr")
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Answer:

Explanation:

Reference:
Microsoft Entra ID documentation: "Dynamic membership rules for groups and administrative units" (Microsoft Learn:https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership) Microsoft Entra ID documentation: "Manage administrative units" (Microsoft Learn:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units) Microsoft Identity and Access Administrator (SC-300) exam study guide, which covers dynamic membership rules and administrative units in Microsoft Entra ID.

NEW QUESTION # 184
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant that has an Azure Active Directory Premium Plan 2 license. The tenant contains the users shown in the following table.

You have the Device Settings shown in the following exhibit.

User1 has the devices shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: No
Maximum number of devices: This setting enables you to select the maximum number of Azure AD joined or Azure AD registered devices that a user can have in Azure AD.
Box 2: Yes
You must be assigned one of the following roles to view or manage device settings in the Azure portal:
* Global Administrator
* Cloud Device Administrator
* Global Reader
* Directory Reader
Box 3: No
Additional local administrators on Azure AD joined devices (Device is Registered not Joined) Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

NEW QUESTION # 185
You have a Microsoft 365 tenant.
You configure a conditional access policy as shown in the Conditional Access policy exhibit. (Click the Conditional Access policy tab.)

You view the User administrator role settings as shown in the Role setting details exhibit. (Click the Role setting details tab.)

You view the User administrator role assignments as shown in the Role assignments exhibit. (Click the Role assignments lab.)

For each of the following statement, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Yes
Yes
No

NEW QUESTION # 186
You have an Azure Ad tenant that contains the users show in the following table.

You create a dynamic user group and configure the following rule syntax.

Which users will be added to the group?

A. User1 only
B. User1 and User2 only
C. User1, User2, and User3
D. User2 only
E. User3 only
F. User1 and User3 only

Answer: D

Explanation:
Dynamic Azure AD groups use membership rules written against user attributes (for example, user.
department, user.jobTitle, user.country, user.usageLocation). The SC-300 materials show operators such as - eq, -contains, -startsWith, and logical -and/-or to build precise targeting. In this scenario, the provided rule syntax evaluates users in the Sales department whose jobTitle contains "Sales" (for example, "SalesRep").
From the data: User1 has job title Associate (does not contain "Sales"); User2 has job title SalesRep (contains
"Sales"); User3 has job title Manager (does not contain "Sales"). Because department for all three is Sales, the discriminating condition is the job title match. Therefore, only User2 satisfies the rule and will be added to the dynamic group. The SC-300 guide emphasizes validating rules with the "Preview membership results" tool to confirm which users are included before enforcing at scale.

NEW QUESTION # 187
You have an Azure AD tenant contains the users shown in the following table.

In Azure AD Privileged Identity Management (PIM), you configure the Global Administrator role as shown in the following exhibit.

User 1 is eligible for the Global Administrator role.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 188
Your on-premises network contains an Active Directory domain that uses Azure AD Connect to sync with an Azure AD tenant. You need to configure Azure AD Connect to meet the following requirements:
* User sign-ins to Azure AD must be authenticated by an Active Directory domain controller.
* Active Directory domain users must be able to use Azure AD self-service password reset (SSPR).
What should you use for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 189
You have a Microsoft 365 E5 subscription.
You need to create a dynamic user group that will include all the users that do NOT have a department defined in their user profile.
How should you complete the membership rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 190
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.
An administrator deletes User1.
You need to identity the following:
* How many days after the account of User1 is deleted can you restore the account?
* Which is the least privileged role that can be used to restore User1?
What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 191
Hotspot Question
You have an Azure subscription named Sub1.
You plan to deploy Microsoft Entra Permissions Management.
You need to ensure that Permission Management can onboard Sub1. The solution must follow the principle of least privilege.
How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 192
You have a Microsoft 365 tenant.
You need to identify users who have leaked credentials. The solution must meet the following requirements.
* Identity sign-Ins by users who ate suspected of having leaked credentials.
* Rag the sign-ins as a high risk event.
* Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

NEW QUESTION # 193
You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

For which users can you configure the Job title property and the Usage location property in Azure AD? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 194
You have an Azure subscription that contains the resources shown in the following table.

For which resources can you create an access review?

A. Group1 only
B. Group1, App1, Contributor, and Role1
C. Hotel and Contributor only
D. Group1, Role1, and Contributor only

Answer: B

Explanation:
Access reviews require an Azure AD Premium P2 license.
Access reviews for Group1 and App1 can be configured in Azure AD Access Reviews.
Access reviews for the Contributor role and Role1 would need to be configured in Privileged Identity Management (PIM). PIM is included in Azure AD Premium P2.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start- security-review?toc=/azure/active-directory/governance/toc.json
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview According to the Microsoft Identity and Access Administrator (SC-300) official study guide and Microsoft Learn training module "Manage Access Reviews", Azure AD Access Reviews allow administrators to periodically evaluate user access to critical resources across Azure AD and Azure.
The exam objectives explicitly list access review capabilities that apply to the following resource types:
Groups (Microsoft 365 or security groups) - Access reviews can be used to ensure that group memberships are up to date. In this case, Group1 is eligible since it has an Assigned membership type, which means access reviews can target its members.
Enterprise applications (App1) - Access reviews can assess users who have access to enterprise applications registered in Azure AD, ensuring that only the right users retain application access.
Azure AD roles (Role1) - Access reviews can be created for privileged directory roles (like Global Administrator or custom roles such as Role1) to validate continued need for elevated permissions.
Azure subscription roles (Contributor) - Access reviews can also be applied to Azure resources and management groups when integrated with Azure AD Privileged Identity Management (PIM). This ensures least-privilege access by reviewing roles like "Contributor." Therefore, based on Microsoft documentation:
"Access reviews can be configured for Azure AD groups, enterprise applications, Azure AD roles, and Azure resource roles to ensure that access rights remain appropriate." This means all four - Group1, App1, Contributor, and Role1 - are supported targets for access reviews.

NEW QUESTION # 195
You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server.
You enable Microsoft Entra login for the virtual machines.
Users report that they cannot sign in to the virtual machines by using their Microsoft Entra credentials.
You need to ensure that the users can sign in to the virtual machines.
What should you do first?

A. Ensure that the virtual machines can accesshttps://enterpriseregistration.windows.net.
B. From the Microsoft Entra admin center, delete the device registrations of the virtual machines.
C. Revoke the primary refresh token.
D. Enable SSH client support for OpenSSH.

Answer: A

Explanation:
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation on "Enable Microsoft Entra login for Windows Server and Windows virtual machines in Azure", successful sign-in to Azure VMs using Microsoft Entra (formerly Azure AD) credentials requires network connectivity to specific Microsoft identity endpoints. One of the most critical endpoints is
https://enterpriseregistration.windows.net, which is used during the device registration and Microsoft Entra Join process.
When you enable Microsoft Entra login for Azure VMs, each VM must register itself as a device in the directory to allow authentication using Entra credentials. If the VM cannot reach the enterprise registration service, the registration fails, meaning the VM will not appear as a valid device in Entra ID. Consequently, users attempting to log in with their Entra credentials will encounter sign-in errors because the system cannot validate their device trust and user token against the identity service.
Microsoft documentation explicitly states:
"To enable Microsoft Entra sign-in to Windows VMs in Azure, the VM must be able to communicate with Microsoft Entra endpoints, including https://enterpriseregistration.windows.net, to complete device registration." Options B, C, and D are unrelated to initial configuration issues. Revoking refresh tokens or deleting device registrations would not resolve connectivity or registration failures. SSH support (option D) is applicable to Linux VMs, not Windows.

NEW QUESTION # 196
You have an Azure subscription.
You need to create two custom roles named Role1 and Role2. The solution must meet the following requirements:
* Users that are assigned Role1 can create or delete instances of Azure Container Apps.
* Users that are assigned Role2 can enforce adaptive network hardening rules.
Which resource provider permissions are required for each role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.