Free Microsoft SC-300 Practice Questions & Answers 2026 Part4

You have an Azure AD tenant.You need to ensure that only users from specific external domains can be invited as guests to the tenant.Which settings should you configure?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.All users who run applications registered in Azure AD are subject to conditional access policies.You need to prevent the users from using legacy authentication.What should you include in the conditional access policies to filter out legacy authentication attempts?

You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.A contractor uses the credentials of user1@outlook.com.You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as user1@outlook.com.What should you do?

You have an Azure subscription that contains a registered app named App1.You need to review the sign-in activity for App1. The solution must meet the following requirements:- Identify the number of failed sign-ins.- Identify the success rate of sign-ins.- Minimize administrative effort.What should you use?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.You plan to increase app security for the subscription.You need to identify which apps do NOT require user authentication.What should you do in the Microsoft 365 Defender portal?

You have an Azure AD tenant that contains the external user shown in the following exhibit.You update the email address of the user.You need to ensure that the user can authenticate by using the updated email address.What should you do for the user?

Reference Scenario: click here You have an Azure Active Directory (Azure AD) tenant named contoso.com. All users who run applications registered in Azure AD are subject to conditional access policies. You need to prevent the users from using legacy authentication. What should you include in the conditional access policies to filter out legacy authentication attempts?

You have an Azure AD tenant that contains the external user shown in the following exhibit.You update the email address of the user.You need to ensure that the user can authenticate by using the updated email address.What should you do for the user?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.Solution: You configure Azure AD Password Protection.Does this meet the goal?

You have an Azure Active Directory (Azure AD) tenant that contains the following objects:-A device named Device1-Users named User1, User2, User3, User4, and User5-Groups named Group1, Group2, Group3, Group4, and Group5The groups are configured as shown in the following table.To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant.Users sign in to computers that run Windows 10 and are joined to the domain.You plan to implement Azure AD Seamless Single Sign-On (Azure AD Seamless SSO).You need to configure the Windows 10 computers to support Azure AD Seamless SSO.What should you do?

You have an Azure Active Directory (Azure AD) tenant. You configure self-service password reset (SSPR) by using the following settings: - Require users to register when signing in: Yes - Number of methods required to reset: 1 What is a valid authentication method available to users?

Case StudyOverviewADatum Corporation is a consulting company in Montreal.ADatum recently acquired a Vancouver-based company named Litware, Inc.Existing Environment. ADatum EnvironmentThe on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.ADatum has a Microsoft 365 E5 subscription. The subscription contains a verified domain that syncs with the adatum.com AD DS domain by using Azure AD Connect.ADatum has an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant has Security defaults disabled.The tenant contains the users shown in the following table.The tenant contains the groups shown in the following table.Existing Environment. Litware EnvironmentLitware has an AD DS forest named litware.comExisting Environment. Problem StatementsADatum identifies the following issues:• Multiple users in the sales department have up to five devices. The sales department users report that sometimes they must contact the support department to join their devices to the Azure AD tenant because they have reached their device limit.• A recent security incident reveals that several users leaked their credentials, a suspicious browser was used for a sign-in, and resources were accessed from an anonymous IP address.• When you attempt to assign the Device Administrators role to IT_Group1, the group does NOT appear in the selection list.• Anyone in the organization can invite guest users, including other guests and non-administrators.• The helpdesk spends too much time resetting user passwords.• Users currently use only passwords for authentication.Requirements. Planned ChangesADatum plans to implement the following changes:• Configure self-service password reset (SSPR).• Configure multi-factor authentication (MFA) for all users.• Configure an access review for an access package named Package1.• Require admin approval for application access to organizational data.• Sync the AD DS users and groups of litware.com with the Azure AD tenant.• Ensure that only users that are assigned specific admin roles can invite guest users.• Increase the maximum number of devices that can be joined or registered to Azure AD to 10.Requirements. Technical RequirementsADatum identifies the following technical requirements:• Users assigned the User administrator role must be able to request permission to use the role when needed for up to one year.• Users must be prompted to register for MFA and provided with an option to bypass the registration for a grace period.• Users must provide one authentication method to reset their password by using SSPR. Available methods must include:- Email- Phone- Security questions- The Microsoft Authenticator app• Trust relationships must NOT be established between the adatum.com and litware.com AD DS domains.• The principle of least privilege must be used.You need to resolve the issue of IT_Group1.What should you do first?

You have an Azure AD tenant.You need to ensure that only users from specific external domains can be invited as guests to the tenant.Which settings should you configure?

You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server and have Login with Microsoft Entra ID enabled.

You have a Microsoft Entra tenant. You need to configure continuous access evaluation for app sign-ins and assign the configuration to users that are assigned the Application Administrator role. What should you configure?

You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.Which objects can you add as members to Group3?

You have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps.You have multiple third-party apps that access the resources in the subscription.You need to monitor the access of the third-party apps.What should you create?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Active Directory forest that syncs to an Azure AD tenant.You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.Solution: You configure conditional access policies.Does this meet the goal?

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.You have an administrative unit named Au1. Group1, User2, and User3 are members of Au1.User5 is assigned the User administrator role for Au1.For which users can User5 reset passwords?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.You implement entitlement management to provide resource access to users at a company named Fabrikam, Inc. Fabrikam uses a domain named fabrikam.com.Fabrikam users must be removed automatically from the tenant when access is no longer required.You need to configure the following settings:Block external user from signing in to this directory: NoRemove external user: YesNumber of days before removing external user from this directory: 90What should you configure on the Identity Governance blade?

You have an Azure Active Directory (Azure AD) tenant named contoso.com. You implement entitlement management to provide resource access to users at a company named Fabrikam, Inc. Fabrikam uses a domain named fabrikam.com. Fabrikam users must be removed automatically from the tenant when access is no longer required. You need to configure the following settings: - Block external user from signing in to this directory: No - Remove external user: Yes - Number of days before removing external user from this directory: 90 What should you configure on the Identity Governance blade?

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.What should you use?

You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.Several users use their contoso.com email address for self-service sign-up to Azure AD.You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.Which PowerShell cmdlet should you run?

Case StudyOverviewADatum Corporation is a consulting company in Montreal.ADatum recently acquired a Vancouver-based company named Litware, Inc.Existing Environment. ADatum EnvironmentThe on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.ADatum has a Microsoft 365 E5 subscription. The subscription contains a verified domain that syncs with the adatum.com AD DS domain by using Azure AD Connect.ADatum has an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant has Security defaults disabled.The tenant contains the users shown in the following table.The tenant contains the groups shown in the following table.Existing Environment. Litware EnvironmentLitware has an AD DS forest named litware.comExisting Environment. Problem StatementsADatum identifies the following issues:Multiple users in the sales department have up to five devices. The sales department users report that sometimes they must contact the support department to join their devices to the Azure AD tenant because they have reached their device limit.A recent security incident reveals that several users leaked their credentials, a suspicious browser was used for a sign-in, and resources were accessed from an anonymous IP address.When you attempt to assign the Device Administrators role to IT_Group1, the group does NOT appear in the selection list.Anyone in the organization can invite guest users, including other guests and non-administrators.The helpdesk spends too much time resetting user passwords.Users currently use only passwords for authentication.Requirements. Planned ChangesADatum plans to implement the following changes:Configure self-service password reset (SSPR).Configure multi-factor authentication (MFA) for all users.Configure an access review for an access package named Package1.Require admin approval for application access to organizational data.Sync the AD DS users and groups of litware.com with the Azure AD tenant.Ensure that only users that are assigned specific admin roles can invite guest users.Increase the maximum number of devices that can be joined or registered to Azure AD to 10.Requirements. Technical RequirementsADatum identifies the following technical requirements:Users assigned the User administrator role must be able to request permission to use the role when needed for up to one year.Users must be prompted to register for MFA and provided with an option to bypass the registration for a grace period.Users must provide one authentication method to reset their password by using SSPR. Available methods must include:- Email- Phone- Security questions- The Microsoft Authenticator appTrust relationships must NOT be established between the adatum.com and litware.com AD DS domains.The principle of least privilege must be used.You need to implement the planned changes for Package1.Which users can create and manage the access review?

You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.Several users use their contoso.com email address for self-service sign-up to Azure Active Directory (Azure AD).You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.Which PowerShell cmdlet should you run?