SC-300 Implement Authentication and Access Management Practice Test 2 — 15 Questions

Question 1

Your organization wants to prevent users from using legacy authentication protocols, such as POP3 and IMAP4, to access Microsoft 365 services. You need to implement a solution that blocks these protocols while allowing modern authentication. What is the most effective way to achieve this using Conditional Access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy, select All Cloud Apps, and under Client Apps, select only Legacy Authentication clients with a Block grant.. Enforcing modern authentication through Conditional Access is critical because legacy protocols lack the capability to handle multi-factor authentication challenges. By explicitly blocking these protocols, organizations mitigate risk against automated attacks. This configuration aligns with Zero Trust principles by verifying every access attempt using modern standards. It ensures that the environment remains secure against credential harvesting and unauthorized access through older, less secure interfaces.

Answer

Disable the POP3 and IMAP4 services at the tenant level within the Microsoft 365 Admin Center for every individual user mailbox.

Answer

Enable Security Defaults in the Microsoft Entra admin center to automatically manage all authentication and security settings for the tenant.

Answer

Update the default Authentication Policy in Exchange Online to set the AllowBasicAuth setting to false for all available mail protocols.

Question 2

An organization is implementing Entra ID Protection to enhance their security posture. You need to configure policies that automatically respond to detected identity risks. Which TWO policies should you implement to meet this requirement?

Accepted Answer

User risk policy. Identity Protection allows organizations to automate the detection and remediation of identity-based risks. User risk policies focus on the long-term behavior of an account, while sign-in risk policies evaluate the probability that a specific authentication request is unauthorized. Implementing both ensures that compromised accounts are forced to change passwords and suspicious logins are challenged with MFA, providing layered security for the tenant.

Answer

MFA registration policy

Answer

App protection policy

Answer

Device compliance policy

Question 3

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Entra Conditional Access policy. Based on this configuration, what is the effect of the policy?

Accepted Answer

Access is blocked for all users except those located within the US_Named_Location.. Understanding the logic of 'Include' and 'Exclude' in Conditional Access is vital for preventing accidental lockouts and ensuring correct policy application. This policy uses a 'Block' control, which is the most restrictive action available. By including 'All' and excluding a specific location, the policy creates a geofence that prevents any access attempt originating from outside the defined trusted geographic boundary.

Answer

Access is granted only to users within the US_Named_Location if they pass MFA.

Answer

Access is blocked for all users regardless of their current geographic location.

Answer

Access is granted to all users as long as they are not in the US_Named_Location.

Question 4

You are configuring Self-Service Password Reset (SSPR) for your organization. You need to ensure that users are prompted to verify their contact information periodically to maintain the accuracy of recovery data. Which setting should you configure?

Accepted Answer

Number of days before users are asked to re-confirm their authentication information.. Data accuracy in SSPR is essential for the reliability of the password recovery process. If recovery information like phone numbers or email addresses becomes outdated, users will be unable to reset their passwords, leading to increased help desk calls. Microsoft Entra ID provides a built-in mechanism to periodically force users to confirm their registered security info, ensuring the system remains functional.

Answer

The registration policy in Microsoft Entra ID Protection for MFA enrollment.

Answer

The password expiration policy within the Microsoft 365 Admin Center settings.

Answer

The 'Notify users on password resets' toggle in the SSPR notification settings.

Question 5

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication is a cornerstone of modern identity security, as it prevents attackers from using stolen credentials or intercepting MFA codes. These methods rely on cryptographic keys bound to the hardware or the device, making it impossible for a user to accidentally provide their credentials to a malicious site. Implementing these methods significantly reduces the risk of account takeovers for high-profile users.

Answer

Microsoft Authenticator push notifications

Answer

SMS-based authentication codes

Question 6

A user is unable to sign in because they have lost their primary MFA device and do not have a backup method registered. You need to provide them with a short-term, high-assurance method to bypass MFA and register a new device. What should you generate for the user?

Accepted Answer

A Temporary Access Pass (TAP).. The Temporary Access Pass (TAP) is a time-limited passcode that acts as a strong authentication factor. It is specifically designed to facilitate the onboarding of new users or to assist users who have lost their authentication methods. TAPs allow users to satisfy MFA requirements during the sign-in process, enabling them to reach the security info page and update their permanent credentials.

Answer

A new App Password.

Answer

An SSPR recovery code.

Answer

A bypass code from the MFA Server.

Question 7

You are implementing Microsoft Entra Password Protection for your on-premises Active Directory domain. You want to ensure that users cannot use passwords that contain the name of your company or the local sports team. Which feature should you configure?

Accepted Answer

The custom banned password list.. Microsoft Entra Password Protection helps prevent users from choosing weak or easily guessable passwords. While Microsoft maintains a global list of banned passwords based on common patterns, organizations often have specific terms that are high-risk within their local context. The custom banned password list allows administrators to augment the global list with these organization-specific terms, significantly strengthening the password policy.

Answer

A Fine-Grained Password Policy (FGPP).

Answer

The Microsoft Entra Smart Lockout policy.

Answer

Active Directory Password Complexity requirements.

Question 8

Refer to the exhibit. This Conditional Access policy uses a specific Authentication Strength. If the ID shown corresponds to the 'Phishing-resistant MFA' built-in strength, which authentication method will NOT satisfy the policy?

Accepted Answer

Microsoft Authenticator push notification with number matching.. Authentication Strengths allow administrators to define exactly which combinations of authentication methods are acceptable for accessing specific resources. The 'Phishing-resistant MFA' strength is the most restrictive built-in option, requiring methods that cryptographically bind the user's identity to the device and the service. Understanding which methods meet this high bar is essential for securing sensitive administrative or financial applications.

Answer

Windows Hello for Business.

Answer

FIDO2 security key.

Answer

Microsoft Entra Certificate-based authentication (Multi-factor).

Question 9

You are configuring Conditional Access session controls to manage how users interact with Microsoft 365 services. Which TWO actions can you perform using session controls?

Accepted Answer

Enforce app-enforced restrictions for SharePoint Online and Exchange Online.. Session controls in Conditional Access allow administrators to go beyond simple 'Allow' or 'Block' decisions by influencing the user's experience after they have authenticated. These controls are vital for protecting data in unmanaged environments or ensuring that sessions are not left open indefinitely. They provide a more granular level of security that adapts to the context of the user's connection.

Answer

Require the user to be on a compliant device to access the application.

Answer

Block access based on the user's geographic location.

Answer

Automatically reset the user's password if risk is detected.

Question 10

Your organization has a group of contractors who use personal devices to access corporate resources. You want to ensure that if their sign-in is flagged as medium or high risk, they are forced to perform MFA, but if the user risk is high, they are blocked entirely. Where should you configure these specific risk-based responses?

Accepted Answer

Conditional Access policies using the Sign-in risk and User risk conditions.. Microsoft Entra ID Protection provides two distinct types of risk policies: Sign-in risk and User risk. Sign-in risk evaluates the specific login attempt, while User risk evaluates the overall health of the identity. Using Conditional Access to integrate these risks allows for dynamic, context-aware security policies that can escalate requirements or block access based on real-time threat intelligence provided by Microsoft.

Answer

The Security Defaults setting in the Microsoft Entra properties menu.

Answer

The Microsoft Entra ID Protection dashboard under 'Notify'.

Answer

The Microsoft Defender for Cloud Apps 'Activity Policy' section.

Question 11

You need to ensure that all global administrators in your tenant are using the most secure authentication methods available. Which TWO methods are recommended by Microsoft as the most secure for administrative accounts?

Accepted Answer

FIDO2 security keys. Administrative accounts are high-value targets for attackers, and securing them is a top priority for any identity administrator. Standard MFA methods like SMS or voice are no longer considered sufficient for privileged accounts. Microsoft strongly recommends moving toward passwordless and phishing-resistant methods to ensure that administrative credentials cannot be easily stolen through social engineering or sophisticated technical attacks.

Answer

SMS text messages with verification codes

Answer

Email-based verification codes

Answer

App passwords for legacy applications

Question 12

Your organization is adopting Global Secure Access (Entra Internet Access) to protect web traffic. You want to apply a Conditional Access policy that requires MFA specifically when users attempt to access a specific set of high-risk external websites. How should you configure this in the Conditional Access policy?

Accepted Answer

Select the 'Internet Access' traffic profile in the Target Resources section.. Global Secure Access extends Microsoft Entra's identity-centric security to internet traffic. By routing traffic through the Global Secure Access service, administrators can treat web traffic similarly to cloud applications. This allows for the application of Conditional Access policies based on destination, enabling fine-grained control over how users access the open internet and protecting the organization from malicious or unapproved websites.

Answer

Add the external website URLs to the 'Cloud Apps' list as custom applications.

Answer

Configure a 'Named Location' for each high-risk website IP address.

Answer

Use a 'Microsoft 365' traffic profile and filter by URL category.

Question 13

You are managing the authentication methods for a tenant. You want to ensure that users are only able to register for MFA using methods that are approved by the IT department. Which TWO steps are necessary to restrict user registration of MFA methods?

Accepted Answer

Enable only the desired methods in the 'Authentication methods' policy.. Controlling which authentication methods are available for registration is a key part of maintaining a secure environment. If users are allowed to register weak methods like SMS, it undermines the security of the tenant. By configuring the Authentication Methods policy, administrators can explicitly enable or disable specific factors, ensuring that only approved, high-security methods are used across the organization.

Answer

Delete the unapproved methods from each user's individual 'Security info' page.

Answer

Modify the 'Security Defaults' to exclude specific authentication factors.

Answer

Create a 'Device Compliance' policy that blocks devices without the Authenticator app.

Question 14

You need to protect your on-premises Active Directory accounts from password spray attacks by using Microsoft Entra Smart Lockout. You have already installed the Microsoft Entra Password Protection proxy and agent. What is the next critical step to ensure the lockout thresholds are synchronized effectively?

Accepted Answer

Configure the lockout threshold in Microsoft Entra to be lower than the AD threshold.. Smart Lockout works by tracking failed sign-in attempts at the Entra ID level and locking out potential attackers before they reach the on-premises Active Directory. To be effective, the lockout threshold in Entra ID must be set to a lower value than the on-premises Active Directory lockout threshold. This ensures that the cloud service intercepts the attack before the local account is locked, avoiding user disruption.

Answer

Enable 'Enforce' mode in the Microsoft Entra Password Protection settings.

Answer

Restart the Microsoft Entra Password Protection Proxy service on all servers.

Answer

Increase the 'Lockout duration' in the on-premises Default Domain Policy.

Question 15

An administrator wants to ensure that users are not prompted for MFA when they are working from the corporate headquarters. What should be configured in Microsoft Entra ID to define the corporate network's public IP ranges as a trusted location?

Accepted Answer

Named Locations with the 'Mark as trusted location' checkbox selected.. Named Locations allow administrators to define specific IP ranges or geographic regions that the organization recognizes. By marking a Named Location as a 'trusted location', it can be used in Conditional Access policies to skip MFA requirements or allow access that would otherwise be restricted. This improves user experience for employees on the internal network while maintaining security for external connections.

Answer

A 'Trusted IPs' list in the legacy MFA service settings portal.

Answer

The 'Workplace Join' setting for all corporate-owned Windows devices.

Answer

An Azure Virtual Network Gateway with a Site-to-Site VPN connection.