SC-300 Implement Authentication and Access Management Practice Test 3 — 15 Questions

Question 1

Your organization requires that all guest users accessing a specific SharePoint site must re-authenticate every 24 hours. Which feature should you configure to enforce this requirement?

Accepted Answer

Conditional Access sign-in frequency. Conditional Access session controls are the mechanism used to enforce sign-in frequency. By configuring a Conditional Access policy targeting guest users and applying a sign-in frequency control set to 24 hours, you ensure that session tokens are invalidated and re-authentication is mandated. This is critical for security posture, as it reduces the window of opportunity for attackers using stolen tokens to access sensitive corporate resources in a guest context.

Answer

Azure AD Identity Protection risk policies

Answer

Microsoft Purview Information Protection labels

Answer

Access Reviews

Question 2

You are configuring Entra ID PIM for a group of administrators. You need to ensure that when they activate a privileged role, they provide a justification and perform MFA. Which TWO settings should you configure?

Accepted Answer

Require Azure MFA on activation. Privileged Identity Management (PIM) settings allow administrators to enforce specific security requirements for role activations. By configuring the activation requirement for MFA, you ensure the identity is verified during the activation event. Requiring a justification provides an audit trail for why the privilege was elevated. These controls are foundational for the principle of least privilege, ensuring that high-level administrative access is not only transient but also properly documented and verified.

Answer

Require ticket number on activation

Answer

Require approval on activation

Answer

Enable persistent assignment

Question 3

Refer to the exhibit. A user with a 'High' risk level attempts to sign in. Based on the provided policy JSON, what is the expected outcome?

Accepted Answer

The user must perform MFA to access resources.. The policy evaluates the user risk condition. Since the risk is 'High', the policy triggers the grant control, requiring Multi-Factor Authentication. This demonstrates how Conditional Access policies can act as an automated security gate. By forcing MFA for risky users, the organization effectively blocks attackers using leaked credentials who lack access to the second factor, significantly reducing the impact of identity-based attacks in a hybrid or cloud-only environment.

Answer

The user is blocked from signing in.

Answer

The user must change their password.

Answer

The sign-in is denied because risk level is High.

Question 4

You need to prevent users from registering their devices for Azure AD Join if they are connecting from non-compliant locations. Which tool should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies are the primary tool for controlling device registration and access. By creating a policy that targets the 'Register or join devices' cloud app, you can apply location-based conditions to restrict device registration. This is a vital practice for managing the device lifecycle, ensuring that only devices originating from trusted networks or locations can be enrolled into the corporate environment, preventing unauthorized device sprawl.

Answer

Device compliance policies in Intune

Answer

Identity Protection risk policies

Answer

Azure AD Connect settings

Question 5

Your company uses B2B collaboration. You need to ensure that guest users can only access applications if they use their home directory credentials. Which feature should you implement?

Accepted Answer

Cross-tenant access settings. Cross-tenant access settings allow for fine-grained control over how B2B collaboration works. By configuring inbound trust settings, you can enforce that guest users utilize their own identity provider's authentication. This ensures that the home organization retains control over the credentials, simplifying lifecycle management and reducing the need for guests to manage separate sets of credentials, which enhances both user experience and administrative security.

Answer

Azure AD B2C user flows

Answer

Conditional Access policies

Answer

Multi-Factor Authentication

Question 6

Which THREE conditions can you use in a Conditional Access policy to restrict access to sensitive applications?

Accepted Answer

Device platform. Conditional Access provides several conditions to build granular security policies. Device platforms, locations, and client apps are standard conditions used to filter access. These are critical for enforcing Zero Trust principles, as they allow administrators to define 'where', 'how', and 'from what' users can connect, ensuring that access is granted only under verified and secure circumstances, minimizing the attack surface effectively.

Answer

User department

Answer

Password strength

Question 7

You need to reduce the attack surface by ensuring that only compliant devices can access Microsoft 365. What should you configure?

Accepted Answer

A Conditional Access policy requiring compliant devices. Enforcing device compliance via Conditional Access requires integrating Intune with Entra ID. By creating a policy that requires the device to be marked as compliant, the system checks the Intune compliance status before granting access. This ensures that only devices meeting organizational security standards, such as having disk encryption enabled and antivirus running, are allowed to access corporate data, protecting against threats from insecure or unmanaged endpoints.

Answer

A device compliance policy in Intune

Answer

An Azure AD Identity Protection policy

Answer

An authentication strength policy

Question 8

Refer to the exhibit. A user reports they cannot access an app. The error code 50072 appears. What is the most likely cause?

Accepted Answer

The user is not registered for MFA.. Error code 50072 specifically indicates that the user is required to enroll in MFA but has not yet completed the setup. This often happens when a new Conditional Access policy is enforced that mandates MFA, catching users off-guard. Identifying this error is essential for helpdesk support to quickly guide users through the registration process, ensuring they can gain access to applications without unnecessary downtime while maintaining security compliance.

Answer

The user's account is locked.

Answer

The user's password has expired.

Answer

The user is on an unauthorized network.

Question 9

You need to ensure that administrative accounts are protected by requiring hardware-based MFA. Which feature supports this?

Accepted Answer

Conditional Access Authentication Strength. Authentication Strength policies in Conditional Access allow administrators to define which specific MFA methods are acceptable for access. By selecting 'FIDO2 security keys' or other hardware-based options, you can mandate that administrative accounts use the highest level of protection available. This is crucial for securing high-privilege identities, as hardware-based factors are resistant to phishing and man-in-the-middle attacks, providing a superior security posture compared to SMS or app-based push notifications.

Answer

Identity Protection risk-based policy

Answer

Azure AD PIM role settings

Answer

Intune app protection policies

Question 10

What is the recommended approach for managing emergency access accounts to ensure they are not locked out?

Accepted Answer

Exclude them from Conditional Access policies.. Emergency access accounts, or 'break-glass' accounts, must be excluded from Conditional Access policies that enforce MFA or device compliance. Since these accounts are designed for critical recovery when standard authentication flows fail (like an MFA provider outage), they must bypass these controls. This ensures that administrators can always regain access to the directory, preventing a catastrophic lockout scenario while keeping the accounts highly protected by long, complex passwords and monitoring.

Answer

Include them in all Conditional Access policies.

Answer

Apply a special MFA policy for them.

Answer

Store their passwords in a shared Excel file.

Question 11

Which entity should you use to apply a Conditional Access policy to all cloud apps except for a specific legacy application?

Accepted Answer

Under the Assignments blade, use the Exclude option.. Conditional Access policies allow for granular control over application targeting. By selecting 'All cloud apps' as the target and then using the 'Exclude' option to specify the legacy application, you create an efficient policy set. This is a common pattern for migrating to modern security standards, allowing you to enforce MFA and other controls across the board while providing necessary exceptions for applications that do not support modern authentication.

Answer

Create a separate policy for every app.

Answer

Use an Entra ID group to filter apps.

Answer

Configure the app as an enterprise application.

Question 12

You are auditing sign-in logs to identify failed authentication attempts. Which TWO fields provide the most relevant information for troubleshooting conditional access failures?

Accepted Answer

Conditional Access status. Troubleshooting Conditional Access requires looking at the 'Conditional Access' status and the 'Result' code. These fields tell you if a policy was applied and why it resulted in a failure. This data is critical for admins to understand if a user was blocked by a misconfigured policy or if they simply failed to meet a requirement, such as MFA, allowing for precise, data-driven remediation of authentication issues.

Answer

Authentication requirement

Answer

User department

Answer

Application ID

Question 13

You have a hybrid environment. You need to ensure that only devices that are Hybrid Azure AD joined can access sensitive data. What should you configure?

Accepted Answer

Conditional Access grant control. Requiring Hybrid Azure AD join is a standard compliance requirement for organizations transitioning to cloud-based management while maintaining on-premises AD. By configuring a Conditional Access policy with a device-state requirement of 'Require hybrid Azure AD joined device', you ensure that only managed machines can access the target resources. This creates a bridge for security, ensuring that device-level controls apply to machines regardless of whether they were originally provisioned on-premises.

Answer

Intune device enrollment

Answer

Azure AD Connect Health

Answer

Identity Protection user risk

Question 14

Refer to the exhibit. What is the impact of this command on the user experience?

Accepted Answer

Session tokens expire after one hour.. The command creates a token lifetime policy that limits the single-factor session to one hour. This effectively forces re-authentication after one hour of idle or active time for non-MFA sessions. This is a legacy method of controlling token life; in modern implementations, this is superseded by Conditional Access sign-in frequency controls, which offer more flexibility and better alignment with modern security practices like continuous access evaluation.

Answer

Users must MFA every hour.

Answer

Users are blocked after one hour.

Answer

The policy forces MFA for every sign-in.

Question 15

You want to ensure that access to a specific application is only permitted from managed devices. Which condition should you configure in the Conditional Access policy?

Accepted Answer

Device state. Configuring a 'device state' condition is the standard method for enforcing device management requirements. By selecting 'Require device to be marked as compliant' or 'Require hybrid Azure AD joined device', you ensure that only devices under your control can access the app. This is a core Zero Trust control that prevents data leakage by ensuring that corporate data only touches devices that are verified, patched, and managed by IT.

Answer

Client apps

Answer

Location

Answer

User risk