[Q162-Q186] Best Quality SC-300 Exam Questions Microsoft Test To Gain Brilliante Result! – IT Certification Exam Questions & Answers

Rate this post

Best Quality SC-300 Exam Questions Microsoft Test To Gain Brilliante Result!

Preparations of SC-300 Exam 2025 Microsoft Certified: Identity and Access Administrator Associate Unlimited 346 Questions

Exam SC-300: Microsoft Identity and Access Administrator

The Microsoft Identity and Access Administrator designs, implements, and operates an organization’s identity and access management systems by using Azure Active Directory (Azure AD). They manage tasks such as providing secure authentication and authorization access to enterprise applications. The administrator provides seamless experiences and self-service management capabilities for all users. Adaptive access and governance are core elements to the role. This role is also responsible for troubleshooting, monitoring, and reporting for the identity and access environment.

The Identity and Access Administrator may be a single individual or a member of a larger team. This role collaborates with many other roles in the organization to drive strategic identity projects to modernize identity solutions, to implement hybrid identity solutions, and to implement identity governance.

Part of the requirements for: Microsoft Certified: Identity and Access Administrator Associate

Download exam skills outline

QUESTION 162
A user named User1 attempts to sign in to the tenant by entering the following incorrect passwords:
Pa55w0rd12
Pa55w0rd12
Pa55w0rd12
Pa55w.rd12
Pa55w.rd123
Pa55w.rd123
Pa55w.rd123
Pa55word12
Pa55word12
Pa55word12
Pa55w.rd12
You need to identify how many sign-in attempts were tracked for User1, and how User1 can unlock her account before the 300-second lockout duration expires.
What should identify? To answer, select the appropriate
NOTE: Each correct selection is worth one point.

QUESTION 163
You have an Azure Active Directory (Azure AD) tenant that contains the following group:
* Name: Group1
* Members: User1, User2
* Owner: User3
On January 15, 2021, you create an access review as shown in the exhibit. (Click the Exhibit tab.)

Users answer the Review1 question as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 164
Case Study 1 – Contoso, Ltd
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in London and Seattle.
Contoso has a partnership with a company named Fabrikam, Inc. Fabrikam has an Azure Active Directory (Azure AD) tenant named fabrikam.com.
Existing Environment. Existing Environment
The on-premises network of Contoso contains an Active Directory domain named contoso.com.
The domain contains an organizational unit (OU) named Contoso_Resources. The Contoso_Resources OU contains all users and computers.
The contoso.com Active Directory domain contains the users shown in the following table.

Existing Environment. Microsoft 365/Azure Environment
Contoso has an Azure AD tenant named contoso.com that has the following associated licenses:
* Microsoft Office 365 Enterprise E5
* Enterprise Mobility + Security
* Windows 10 Enterprise E3
* Project Plan 3
Azure AD Connect is configured between Azure AD and Active Directory Domain Services (AD DS). Only the Contoso_Resources OU is synced.
Helpdesk administrators routinely use the Microsoft 365 admin center to manage user settings.
User administrators currently use the Microsoft 365 admin center to manually assign licenses. All users have all licenses assigned besides the following exceptions:
* The users in the London office have the Microsoft 365 Phone System license unassigned.
* The users in the Seattle office have the Yammer Enterprise license unassigned.
Security defaults are disabled for contoso.com.
Contoso uses Azure AD Privileged Identity Management (PIM) to protect administrative roles.
Existing Environment. Problem Statements
Contoso identifies the following issues:
* Currently, all the helpdesk administrators can manage user licenses throughout the entire Microsoft 365 tenant.
* The user administrators report that it is tedious to manually configure the different license requirements for each Contoso office.
* The helpdesk administrators spend too much time provisioning internal and guest access to the required Microsoft 365 services and apps.
* Currently, the helpdesk administrators can perform tasks by using the User administrator role without justification or approval.
* When the Logs node is selected in Azure AD, an error message appears stating that Log Analytics integration is not enabled.
Requirements. Planned Changes
Contoso plans to implement the following changes:
* Implement self-service password reset (SSPR).
* Analyze Azure audit activity logs by using Azure Monitor.
* Simplify license allocation for new users added to the tenant.
* Collaborate with the users at Fabrikam on a joint marketing campaign.
* Configure the User administrator role to require justification and approval to activate.
* Implement a custom line-of-business Azure web app named App1. App1 will be accessible from the internet and authenticated by using Azure AD accounts.
* For new users in the marketing department, implement an automated approval workflow to provide access to a Microsoft SharePoint Online site, group, and app.
Contoso plans to acquire a company named Adatum Corporation. One hundred new ADatum users will be created in an Active Directory OU named Adatum. The users will be located in London and Seattle.
Requirement. Technical Requirements
Contoso identifies the following technical requirements:
* All users must be synced from AD DS to the contoso.com Azure AD tenant.
* App1 must have a redirect URI pointed to https://contoso.com/auth- response.
* License allocation for new users must be assigned automatically based on the location of the user.
* Fabrikam users must have access to the marketing department’s SharePoint site for a maximum of 90 days.
* Administrative actions performed in Azure AD must be audited. Audit logs must be retained for one year.
* The helpdesk administrators must be able to manage licenses for only the users in their respective office.
* Users must be forced to change their password if there is a probability that the users’ identity was compromised.
Question
You need to resolve the issue of the sales department users.
What should you configure for the Azure AD tenant?

the Device settings

the Access reviews settings

the User settings

Security defaults

QUESTION 165
You have an Azure AD tenant that contains multiple storage accounts.
You plan to deploy multiple Azure App Service apps that will require access to the storage accounts.
You need to recommend an identity solution to provide the apps with access to the storage accounts. The solution must minimize administrative effort.
Which type of identity should you recommend, and what should you recommend using to control access to the storage accounts? To answer, select the appropriate options in the answer area.

QUESTION 166
Hotspot Question
Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant.
The tenant contains the groups shown in the following table.

The tenant contains the users shown in the following table.

You create an access review as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 167
You need to locate licenses to the
A Datum users. The solution must need the technical requirements.
Which type of object should you create?

A Dynamo User security group

An OU

A distribution group

An administrative unit

QUESTION 168
You need to sync the ADatum users. The solution must meet the technical requirements.
What should you do?

From the Microsoft Azure Active Directory Connect wizard, select Customize synchronization options.

From PowerShell, run Set-ADSyncScheduler.

From PowerShell, run Start-ADSyncSyncCycle.

From the Microsoft Azure Active Directory Connect wizard, select Change user sign-in.

QUESTION 169
You have a Microsoft 365 tenant.
You configure a conditional access policy as shown in the Conditional Access policy exhibit. (Click the Conditional Access policy tab.)

You view the User administrator role settings as shown in the Role setting details exhibit. (Click the Role setting details tab.)

You view the User administrator role assignments as shown in the Role assignments exhibit. (Click the Role assignments lab.)

For each of the following statement, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 170
You implement the planned changes for SSPR.
What occurs when User3 attempts to use SSPR? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 171
You implement the planned changes for SSPR.
What occurs when User3 attempts to use SSPR? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 172
You need to meet the technical requirements for license management by the helpdesk administrators.
What should you create first, and which tool should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 173
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft Teams team named Team1. The subscription contains five security groups named Group1, Group2, Group3, Group4, and Group5.
You need to implement access packages for Site1 and Team1. The solution must meet the following requirements:
– Members of Group3 must be able to request access to Site1 only.
– Members of Group1 must be able to request access to Site1 and Team1.
– Members of Group4 must be able to request access to Site1 and Team1.
– Only members of Group2 must be able to approve access package
requests from Group1 members.
– Only members of Groups must be able to approve access package
requests from Group3 and Group4 members.
What h the minimum number of access packages you should create?

QUESTION 174
You have a Microsoft 365 E5 subscription.
Users authorize third-party cloud apps to access their data.
You need to configure an alert that will be triggered when an app requires high permissions and is authorized by more than 20 users.
Which type of policy should you create in the Microsoft Defender for Cloud Apps portal?

anomaly detection policy

OAuth app policy

access policy

activity policy

QUESTION 175
You have an Azure subscription that contains the custom roles shown in the following table.

You need to create a custom Azure subscription role named Role3 by using the Azure portal. Role3 will use the baseline permissions of an existing role. Which roles can you clone to create Role3?

Role2 only

built-in Azure subscription roles only

built-in Azure subscription roles and Role2 only

built-in Azure subscription roles and built-in Azure AD roles only

Role1, Role2 built-in Azure subscription roles, and built-in Azure AD roles

QUESTION 176
You have an Azure AD tenant that contains a user named User1. User1 is assigned the User Administrator role.
You need to configure External collaboration settings for the tenant to meet the following requirements: |
*Guest users must be prevented from querying staff email addresses.
*Guest users must be able to access the tenant only if they are invited by User1.
Which three settings should you configure? To answer, select the appropriate settings in the answer area.

Explanation:
According to the Microsoft SC-300 Study Guide, Exam Ref SC-300, and Microsoft Entra External Collaboration (B2B) documentation, the configuration of External collaboration settings in Azure AD determines how guest users can access directory data and who can invite them into the tenant.
Let’s analyze each requirement in context:
“Guest users must be prevented from querying staff email addresses.”
To achieve this, Azure AD provides the setting Guest user access restrictions, which defines what a guest can see in the directory. The most restrictive setting ensures that guest users can only see their own profile details and no other users or groups.
# Therefore, select:
“Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).” This prevents guests from discovering internal directory data such as email addresses of staff members or group memberships.
“Guest users must be able to access the tenant only if they are invited by User1.” User1 has the User Administrator role. This role is included among the “specific admin roles” allowed to invite guest users when the setting is configured appropriately.
To meet the requirement that only User1 (or other admins) can invite guests, you must configure:
# “Only users assigned to specific admin roles can invite guest users.” This restricts invitation privileges to admin roles (such as Global Administrator, User Administrator, etc.) and prevents ordinary users or guests from inviting others.
“Guests should not be able to self-enroll.”
Azure AD B2B allows self-service sign-up through user flows (Identity Experience Framework). Enabling this feature would let external users sign up themselves – which violates the condition that guests must be invited by User1 only.
# Therefore, set Enable guest self-service sign-up via user flows = No.
Setting
Value
Guest user access restrictions
Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) Guest invite restrictions Only users assigned to specific admin roles can invite guest users Enable guest self-service sign-up via user flows No
# Microsoft Official Documentation Reference (SC-300 Content):
“To prevent guests from seeing other users in the directory, configure guest user access restrictions to ‘most restrictive.’ To control who can invite guests, use the setting that limits invitations to users with admin roles.
To disallow self-service guest access, disable user flows for external sign-up.”

QUESTION 177
You have a Microsoft 365 E5 subscription that contains a user named User1. User is eligible for the Application administrator role.
User1 needs to configure a new connector group for an application proxy.
What should you use to activate the role for User1?

the Microsoft Defender for Cloud Apps portal

the Microsoft 365 admin center

the Azure Active Directory admin center

the Microsoft 365 Defender portal

QUESTION 178
You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and User3.
You need to configure the users as shown in the following table.

Which portal should you use to configure each user? To answer, drag the appropriate portals to the correct users. Each portal may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

QUESTION 179
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
All users who run applications registered in Azure AD are subject to conditional access policies.
You need to prevent the users from using legacy authentication.
What should you include in the conditional access policies to filter out legacy authentication attempts?

a cloud apps or actions condition

a sign-in risk condition

a client apps condition

a user risk condition

QUESTION 180
Drag and Drop Question
You have an on-premises Microsoft Exchange organization that uses an SMTP address space of contoso.com.
You discover that users use their email address for self-service sign-up to Microsoft 365 services.
You need to gain global administrator privileges to the Azure Active Directory (Azure AD) tenant that contains the self-signed users.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

QUESTION 181
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.
You need to ensure that User1 can create new catalogs and add resources to the catalogs they own.
What should you do?

From the Roles and administrators blade, modify the Service support administrator role.

From the identity Governance blade, modify the Entitlement management settings.

From the Identity Governance blade, modify the roles and administrators for the General catalog

From the Roles and administrators blade, modify the Groups administrator role.

QUESTION 182
You have an Azure subscription that contains a user named User! and two resource groups named RG1 and RG2.
You need to ensure that User1 can perform the following tasks:
* View all resources.
* Restart virtual machines.
* Create virtual machines in RG1 only.
* Create storage accounts in RG1 only.
What is the minimum number of role-based access control (RBAC) role assignment* required?

QUESTION 183
Your company has two divisions named Contoso East and Contoso West. The Microsoft 365 identity architecture tor both divisions is shown in the following exhibit.

You need to assign users from the Contoso East division access to Microsoft SharePoint Online sites in the Contoso West tenant. The solution must not require additional Microsoft 3G5 licenses.
What should you do?

Configure the exiting Azure AD Connect server in Contoso Cast to sync the Contoso East Active Directory forest to the Contoso West tenant.

Configure Azure AD Application Proxy in the Contoso West tenant.

Deploy a second Azure AD Connect server to Contoso East and configure the server to sync the Contoso East Active Directory forest to the Contoso West tenant.

Invite the Contoso East users as guests in the Contoso West tenant.

QUESTION 184
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.
User1 has the devices shown in the following table.

On November 5, 2020, you create and enforce terms of use in contoso.com that has the following settings:
Name: Terms1
Display name: Contoso terms of use
Require users to expand the terms of use: On
Require users to consent on every device: On
Expire consents: On
Expire starting on: December 10, 2020
Frequency: Monthly
On November 15, 2020, User1 accepts Terms1 on Device3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 185
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the objects shown in the following table.

You install Microsoft Entra Connect. You configure the Domain and OU filtering settings as shown in the Domain and OU Filtering exhibit. (Click the Domain and OU Filtering tab.)

You configure the Filter users and devices settings as shown in the Filter Users and Devices exhibit. (Click the Filter Users and Devices tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 186
You need to modify the settings of the User administrator role to meet the technical requirements. Which two actions should you perform for the role? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Select Require justification on activation

Set all assignments to Active

Set all assignments to Eligible

Modify the Expire eligible assignments after setting.

Select Require ticket information on activation.

Why we need Microsoft SC-300 certified professional

Microsoft SC-300 exam is one of the most important Microsoft exams required to enhance your career. It is more important than ever that you pass this challenging exam and better yet why not do it right now. The best part is that there’s no need to worry about where to find the best resources to hire. Microsoft SC-300 Dumps are here to help you. We are your ultimate guide to learning. With our free updates you will be able to get the latest version of Microsoft SC-300 questions in no time. The certification is very valuable and it has a good impact on your future career. No hard work is required of you. If you are a fast learner, you can go through all the questions and answers in just 3 days. Online support is provided so you will never be alone. The Microsoft SC-300 exam is a very important exam. It is the first step in a series of steps to become a Microsoft Certified Professional. Microsoft SC-300 are your best chance to earn that big amount of money. You don’t have to spend time and effort going through the certification process. You can get all the help you need online from our experts. They are available 24/7 so you can ask them any question. You will be provided with the answers and suggestions that will help you pass the exam. You will be able to achieve your goal without going through the hard work. Outline the Microsoft SC-300 Exam topics below and start preparing.

Focus on SC-300 All-in-One Exam Guide For Quick Preparation: https://www.it-tests.com/SC-300.html