SC-300 Practice Exam 2 — 20 Questions

Question 1

You are auditing sign-in logs and see many 'Interrupted' sign-ins. What does this typically indicate?

Accepted Answer

The user is being prompted to complete a required action like MFA registration.. An 'Interrupted' sign-in status in Entra ID occurs when the authentication process is paused because the user is required to complete an additional action, such as MFA registration, password reset, or terms of use acceptance. It is not an error, but a state where the identity provider is waiting for the user to fulfill a policy mandate before granting access to the requested application, which is crucial for compliant identity management.

Answer

The user entered an incorrect password multiple times.

Answer

The user's device is not compliant with company policy.

Answer

The service principal has an expired client secret.

Question 2

You are configuring Conditional Access session controls to manage how users interact with Microsoft 365 services. Which TWO actions can you perform using session controls?

Accepted Answer

Enforce app-enforced restrictions for SharePoint Online and Exchange Online.. Session controls in Conditional Access allow administrators to go beyond simple 'Allow' or 'Block' decisions by influencing the user's experience after they have authenticated. These controls are vital for protecting data in unmanaged environments or ensuring that sessions are not left open indefinitely. They provide a more granular level of security that adapts to the context of the user's connection.

Answer

Require the user to be on a compliant device to access the application.

Answer

Block access based on the user's geographic location.

Answer

Automatically reset the user's password if risk is detected.

Question 3

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

Accepted Answer

Create a Conditional Access policy with a Named Location and block access from 'Any location' except the trusted network.. Conditional Access is the correct tool for location-based access control. By defining 'Named Locations' based on IP ranges and then creating a policy that blocks access from all locations except those defined, you ensure that administrative portals are unreachable from outside the corporate network. This creates a powerful perimeter-based defense that prevents attackers from attempting to access administrative interfaces from known-bad or foreign regions.

Answer

Use the 'Country-based' location filter in the administrative portal settings.

Answer

Create a new security group for administrators and add an IP restriction to the group.

Answer

Configure 'Restrict access to Microsoft Entra administration portal' to 'No'.

Question 4

Which MFA method is considered the most secure because it provides a hardware-bound cryptographic proof?

Accepted Answer

FIDO2 Security Key. FIDO2 security keys offer the highest level of security for MFA. Because the private key never leaves the hardware device, it is impossible to phish, intercept, or replicate via software. This provides a level of assurance that cannot be matched by software-based MFA, such as TOTP or push notifications, making it the ideal choice for highly sensitive accounts or environments where the threat of sophisticated phishing is high.

Answer

Authenticator App (TOTP)

Answer

Windows Hello for Business

Answer

OATH hardware tokens

Question 5

You are configuring Self-Service Password Reset (SSPR) for your organization. You need to ensure that users are prompted to verify their contact information periodically to maintain the accuracy of recovery data. Which setting should you configure?

Accepted Answer

Number of days before users are asked to re-confirm their authentication information.. Data accuracy in SSPR is essential for the reliability of the password recovery process. If recovery information like phone numbers or email addresses becomes outdated, users will be unable to reset their passwords, leading to increased help desk calls. Microsoft Entra ID provides a built-in mechanism to periodically force users to confirm their registered security info, ensuring the system remains functional.

Answer

The registration policy in Microsoft Entra ID Protection for MFA enrollment.

Answer

The password expiration policy within the Microsoft 365 Admin Center settings.

Answer

The 'Notify users on password resets' toggle in the SSPR notification settings.

Question 6

You are configuring Entra ID PIM for a group of administrators. You need to ensure that when they activate a privileged role, they provide a justification and perform MFA. Which TWO settings should you configure?

Accepted Answer

Require Azure MFA on activation. Privileged Identity Management (PIM) settings allow administrators to enforce specific security requirements for role activations. By configuring the activation requirement for MFA, you ensure the identity is verified during the activation event. Requiring a justification provides an audit trail for why the privilege was elevated. These controls are foundational for the principle of least privilege, ensuring that high-level administrative access is not only transient but also properly documented and verified.

Answer

Require ticket number on activation

Answer

Require approval on activation

Answer

Enable persistent assignment

Question 7

Your company uses B2B collaboration. You need to ensure that guest users can only access applications if they use their home directory credentials. Which feature should you implement?

Accepted Answer

Cross-tenant access settings. Cross-tenant access settings allow for fine-grained control over how B2B collaboration works. By configuring inbound trust settings, you can enforce that guest users utilize their own identity provider's authentication. This ensures that the home organization retains control over the credentials, simplifying lifecycle management and reducing the need for guests to manage separate sets of credentials, which enhances both user experience and administrative security.

Answer

Azure AD B2C user flows

Answer

Conditional Access policies

Answer

Multi-Factor Authentication

Question 8

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication is a cornerstone of modern identity security, as it prevents attackers from using stolen credentials or intercepting MFA codes. These methods rely on cryptographic keys bound to the hardware or the device, making it impossible for a user to accidentally provide their credentials to a malicious site. Implementing these methods significantly reduces the risk of account takeovers for high-profile users.

Answer

Microsoft Authenticator push notifications

Answer

SMS-based authentication codes

Question 9

You need to ensure that all global administrators in your tenant are using the most secure authentication methods available. Which TWO methods are recommended by Microsoft as the most secure for administrative accounts?

Accepted Answer

FIDO2 security keys. Administrative accounts are high-value targets for attackers, and securing them is a top priority for any identity administrator. Standard MFA methods like SMS or voice are no longer considered sufficient for privileged accounts. Microsoft strongly recommends moving toward passwordless and phishing-resistant methods to ensure that administrative credentials cannot be easily stolen through social engineering or sophisticated technical attacks.

Answer

SMS text messages with verification codes

Answer

Email-based verification codes

Answer

App passwords for legacy applications

Question 10

Your organization is adopting Global Secure Access (Entra Internet Access) to protect web traffic. You want to apply a Conditional Access policy that requires MFA specifically when users attempt to access a specific set of high-risk external websites. How should you configure this in the Conditional Access policy?

Accepted Answer

Select the 'Internet Access' traffic profile in the Target Resources section.. Global Secure Access extends Microsoft Entra's identity-centric security to internet traffic. By routing traffic through the Global Secure Access service, administrators can treat web traffic similarly to cloud applications. This allows for the application of Conditional Access policies based on destination, enabling fine-grained control over how users access the open internet and protecting the organization from malicious or unapproved websites.

Answer

Add the external website URLs to the 'Cloud Apps' list as custom applications.

Answer

Configure a 'Named Location' for each high-risk website IP address.

Answer

Use a 'Microsoft 365' traffic profile and filter by URL category.

Question 11

What is the recommended approach for managing emergency access accounts to ensure they are not locked out?

Accepted Answer

Exclude them from Conditional Access policies.. Emergency access accounts, or 'break-glass' accounts, must be excluded from Conditional Access policies that enforce MFA or device compliance. Since these accounts are designed for critical recovery when standard authentication flows fail (like an MFA provider outage), they must bypass these controls. This ensures that administrators can always regain access to the directory, preventing a catastrophic lockout scenario while keeping the accounts highly protected by long, complex passwords and monitoring.

Answer

Include them in all Conditional Access policies.

Answer

Apply a special MFA policy for them.

Answer

Store their passwords in a shared Excel file.

Question 12

A company wants to implement a passwordless strategy for its administrative accounts. The administrators work from shared workstations that do not have built-in biometric hardware. Which authentication method should you recommend to provide the highest level of security?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the most secure passwordless method for shared workstations because they are hardware-backed and phishing-resistant. Unlike Windows Hello for Business, which is tied to a specific device's TPM, FIDO2 keys are portable, making them ideal for administrators moving between different shared machines that lack biometric hardware.

Answer

Windows Hello for Business

Answer

Microsoft Authenticator (Phone Sign-in)

Answer

SMS-based authentication

Question 13

An administrator wants to prevent brute-force attacks on user passwords by locking out accounts after several failed attempts. They want to ensure that legitimate users are not locked out by attackers from different geographical locations. Which feature should they configure?

Answer

Active Directory Group Policy

Answer

Microsoft Entra Smart Lockout

Answer

Conditional Access Block Policy

Answer

Tenant Restrictions

Question 14

A developer is choosing between using a Managed Identity and a Service Principal with a client secret for a new application. Which TWO benefits are unique to using Managed Identities? (Choose two)

Accepted Answer

Managed identities do not require the developer to manage or rotate secrets.. Managed identities provide specific security and operational advantages that service principals with secrets lack. They eliminate the need for developers to handle sensitive credentials and automate the lifecycle management of the identity. Understanding these differences is crucial for implementing secure workload identities according to Microsoft best practices.

Answer

Managed identities can be used to access resources outside of Azure via SAML.

Answer

Managed identities support the use of client certificates for authentication.

Answer

Managed identities allow for the assignment of Application permissions to Microsoft Graph.

Question 15

You need to ensure that administrative accounts are protected by requiring hardware-based MFA. Which feature supports this?

Accepted Answer

Conditional Access Authentication Strength. Authentication Strength policies in Conditional Access allow administrators to define which specific MFA methods are acceptable for access. By selecting 'FIDO2 security keys' or other hardware-based options, you can mandate that administrative accounts use the highest level of protection available. This is crucial for securing high-privilege identities, as hardware-based factors are resistant to phishing and man-in-the-middle attacks, providing a superior security posture compared to SMS or app-based push notifications.

Answer

Identity Protection risk-based policy

Answer

Azure AD PIM role settings

Answer

Intune app protection policies

Question 16

Refer to the exhibit. A user reports they cannot access an app. The error code 50072 appears. What is the most likely cause?

Accepted Answer

The user is not registered for MFA.. Error code 50072 indicates that the user is required to enroll for MFA, but has not yet completed the registration process. This occurs when a Conditional Access policy requires MFA, but the user has not yet set up their authentication methods.

Answer

The user's account is locked.

Answer

The user's password has expired.

Answer

The user is on an unauthorized network.

Question 17

Your company frequently collaborates with a partner organization. You want to allow the partner's users to access your resources using their own corporate credentials, but you want to enforce your own MFA requirements when they access sensitive data. Which feature should you use?

Accepted Answer

Cross-tenant access settings. Cross-tenant access settings allow you to manage how you collaborate with other Microsoft Entra organizations. Within these settings, you can configure trust settings that allow you to either trust the MFA performed by the home tenant or, as required here, ignore their MFA and enforce your own tenant's Conditional Access MFA requirements.

Answer

B2C User Flows

Answer

Application Proxy

Answer

Direct Routing

Question 18

Which of the following scenarios is the primary use case for utilizing an Azure AD Service Principal over a Managed Identity?

Accepted Answer

When the application runs on-premises and needs to access Azure APIs.. Managed identities are limited to Azure-hosted resources. When your application runs on-premises, in another cloud, or on a local machine, you cannot use a managed identity. In these cases, you must register an application in Azure AD and use a service principal with either a certificate or a client secret to establish the required trust and authentication.

Answer

When the application runs on an Azure Virtual Machine.

Answer

When the application requires access to multiple Azure subscriptions.

Answer

When you need to provide administrative access to the entire tenant.

Question 19

You need to implement Authentication Strengths in Microsoft Entra ID to enforce phishing-resistant MFA for your IT administrators. Which TWO authentication methods are considered phishing-resistant by the built-in 'Phishing-resistant MFA' strength?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication methods rely on cryptographic hardware and the FIDO2 standard or certificate-based authentication to ensure that the authentication process cannot be intercepted or spoofed. The 'Phishing-resistant MFA' built-in strength specifically includes FIDO2 security keys and Windows Hello for Business, as both methods utilize device-bound keys and local gestures.

Answer

Microsoft Authenticator (Push)

Answer

Email OTP

Answer

Password + SMS

Question 20

Your organization has several financial applications that contain sensitive data. You need to ensure that users are prompted for multi-factor authentication only when they attempt to access these specific applications from outside the corporate network. Which feature should you implement to meet this requirement with the least amount of administrative effort?

Accepted Answer

Conditional Access policies. Conditional Access policies allow for granular control based on signals such as the specific application being accessed and the user's network location. By creating a policy that targets the financial applications and excludes the corporate network (Named Locations), you can enforce MFA only for external access, which is the most efficient way to meet the requirement.

Answer

Security Defaults

Answer

Microsoft Entra ID Protection

Answer

Authentication Methods Policy