Free SC-300 sample questions

Correct answers: Mail.Send (Delegated); User.ReadBasic.All (Delegated)

This delegated permission allows the application to send mail as the signed-in user, which directly meets one of the stated requirements.

This delegated permission allows the application to read the basic profile of all users in the organization, which is a least-privilege way to fulfill the requirement of reading user profiles. 'User.Read' would only allow reading the signed-in user's profile, and 'User.Read.All' is more permissive than necessary if only basic profile information is needed.

Correct answer: True

This statement is true. Dynamic group membership is evaluated continuously. If a user no longer meets the criteria of the dynamic membership rule, they are automatically removed from the group. The access review process audits existing membership but does not override the fundamental logic of the dynamic group itself. The removal by the rule takes precedence.

Correct answer: There is no special parameter; you run the exact same command.

When installing additional Pass-through Authentication agents for high availability, you run the same registration command (`Register-AzureADConnectAuthenticationAgent`) on each new server. The service automatically detects that it's being registered for an existing tenant and adds the new agent to the default agent group, enabling load balancing and failover. No special parameters are needed to join an existing group.

Correct answer: Deploy Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD) for 'CodeVault'. Configure Google Workspace as a SAML/WS-Fed identity provider in Microsoft Entra External Identities to allow federation.

This solution correctly addresses all requirements. Microsoft Entra Application Proxy with KCD is the designated solution for publishing on-premises Kerberos-based applications securely while enabling the enforcement of Conditional Access policies. For the acquired users, setting up Google Workspace as a federated identity provider allows them to use their existing credentials (fulfilling requirement 3) and minimizes administrative overhead since user accounts don't need to be manually created or managed in the Litware tenant (fulfilling requirement 4).

Correct answers: Microsoft Entra ID Protection; Self-Service Password Reset (SSPR)

Microsoft Entra ID Protection is the service that detects and calculates user risk levels based on various signals, including 'unfamiliar sign-in properties'. It is where you create the user risk policy.

For the 'secure password change' remediation to be available, SSPR must be enabled and configured for the targeted users. The user risk policy in ID Protection relies on SSPR to facilitate the password reset process.

Correct answer: The organization has run out of available Microsoft 365 E5 licenses.

While other issues can occur, the most frequent cause for a license assignment to fail for a new user being added to a licensed group is the exhaustion of available licenses in the tenant. Microsoft Entra cannot assign a license that it doesn't have. An administrator would need to purchase more licenses or free up existing ones for the assignment to succeed.

Correct answer: Include 'Any location'. Exclude a named location that contains Canada and the United States.

The standard best practice for creating a location-based block policy is to target 'Any location' in the 'Include' condition and then add the approved locations (in this case, a named location containing Canada and the US) to the 'Exclude' condition. This ensures that all traffic is evaluated, and only the explicitly excluded locations are allowed. Trying to include all countries except two is impractical and prone to error.

Correct answer: Enable the system-assigned managed identity for the Function App and grant that identity 'Get' and 'List' permissions for secrets in the Key Vault's access policies.

Using a system-assigned managed identity is the most secure and recommended approach. It creates an identity for the Azure Function App directly in Microsoft Entra ID without any credentials being stored in the application's code or configuration. You then grant this identity access to the Key Vault. The Function App can acquire an access token from the managed identity endpoint to authenticate to the Key Vault securely.

Correct answer: A Microsoft Entra Terms of Use (ToU) policy linked to a Conditional Access policy that targets all guest users.

Microsoft Entra Terms of Use (ToU) is designed for this exact scenario. You can upload the NDA document as a PDF, create a ToU policy, and then enforce it using a Conditional Access policy. The Conditional Access policy would be configured to target 'All guest and external users' and have the ToU as a grant control, ensuring they must accept it before being granted access.

Correct answer: Identity Secure Score

Identity Secure Score is a feature within Microsoft Entra ID that provides a numerical score representing the organization's identity security posture. It also offers a list of prioritized improvement actions, detailing the security impact and user impact of each recommendation, which directly matches the consultant's requirements.