SC-300 Implement Authentication and Access Management — Timed 20 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to ensure that guest users can only access specific applications and cannot browse the directory for other users. What should you configure?

Accepted Answer

Set Guest user access to 'Guest users have limited access to properties and memberships of directory objects'.. Restricting guest access in Entra ID is crucial for preventing information leakage regarding your internal directory structure. By configuring the External Collaboration Settings, you limit the visibility of guest users to only the objects they are assigned to, effectively hiding internal employee lists and organizational structures. This principle of least privilege ensures that external identities operate strictly within their defined scopes, minimizing the attack surface against social engineering or reconnaissance attempts.

Answer

Enable 'Restrict access to Microsoft Entra administration portal' for all guest accounts.

Answer

Create a Conditional Access policy that blocks guests from accessing the Microsoft Graph API.

Answer

Disable the 'Invite guests' setting in the External Collaboration settings menu.

Question 2

You are configuring Password Protection in Microsoft Entra ID. Which TWO actions must you take to ensure the custom banned password list is enforced effectively?

Accepted Answer

Enable 'Password protection' in the Entra admin center and add terms to the custom banned password list.. Implementing custom banned password lists is a proactive measure to prevent users from selecting weak, predictable, or leaked passwords. By combining the global banned list with organization-specific terms, you significantly increase the entropy of passwords across your tenant. Ensuring that the feature is enabled in the Microsoft Entra admin center and that agents are correctly deployed is essential for both cloud-only and hybrid environments to maintain consistent credential security policy enforcement.

Answer

Configure a Conditional Access policy to enforce password changes every 90 days.

Answer

Enable 'Self-service password reset' for all users in the tenant.

Answer

Set the Password Protection mode to 'Audit' mode permanently.

Question 3

Refer to the exhibit. You are reviewing a custom permission policy intended to allow an application to manage user profile photos. Why is this policy considered a security risk?

Accepted Answer

The permission level allows the application to modify sensitive user attributes beyond just photos.. The explanation incorrectly describes Microsoft Graph permissions as having a 'wildcard resource scope'. In Microsoft Graph, 'User.ReadWrite.All' is an application permission that grants the app the ability to read and write all user profiles in the directory. The security risk is that it is an 'All' permission, which is overly broad, rather than a resource-based wildcard issue.

Answer

The policy version is outdated and causes compatibility issues with modern Microsoft Graph endpoints.

Answer

The Action field lacks the required 'application:' prefix for service principals.

Answer

The Resource '*' is mandatory for all User permission scopes.

Question 4

You need to implement Authentication Strengths in Conditional Access to ensure that users access highly sensitive applications using only phishing-resistant MFA. Which method should you select?

Accepted Answer

FIDO2 Security Key. Authentication Strengths allow administrators to define exactly which MFA methods are acceptable for specific access scenarios. By mandating phishing-resistant methods like FIDO2 security keys or Windows Hello for Business, you mitigate the risk of credential theft via man-in-the-middle or phishing attacks. This is a critical control for securing high-value cloud resources against sophisticated threat actors who can bypass traditional SMS or push-based MFA methods through real-time proxying.

Answer

SMS-based authentication

Answer

Microsoft Authenticator push notification

Answer

Voice call authentication

Question 5

A user reports being unable to sign in to a SaaS application. You check the Microsoft Entra sign-in logs and see a 'Conditional Access policy failure' status. What is the first step you should take to troubleshoot?

Accepted Answer

Examine the 'Conditional Access' tab in the sign-in log entry for the specific failure.. Analyzing the sign-in logs is the primary mechanism for auditing access failures. By identifying which specific policy triggered the block, you can determine if the failure was due to device compliance, location, or MFA requirements. This systematic approach saves time by narrowing down the issue from a general authentication failure to a specific policy enforcement point, allowing for targeted remediation or policy adjustments to resolve the user's access impediment.

Answer

Reset the user's password.

Answer

Ask the user to clear their browser cache.

Answer

Disable all Conditional Access policies for the tenant.

Question 6

You are implementing Privileged Identity Management (PIM). Which TWO outcomes are achieved when you assign a user to an 'Eligible' role rather than a 'Permanent' role?

Accepted Answer

The user must request activation for the role, which can require multi-factor authentication.. PIM 'Eligible' assignments significantly reduce the risk of standing access. By requiring the user to perform an activation step, you add a layer of accountability, often including MFA and justification requirements. Permanent assignments are a major security risk because they provide persistent high-level access that can be abused if the account is compromised. Limiting standing access ensures that privileges are only active when they are absolutely necessary for the task at hand.

Answer

The user retains the permissions indefinitely without needing to take any further action.

Answer

The user is automatically notified via email whenever an administrative change occurs.

Answer

The user can bypass Conditional Access policies when activating the role.

Question 7

Your company requires all users to access Microsoft 365 from company-managed devices. How should you configure Conditional Access to enforce this?

Accepted Answer

Create a policy requiring 'Require device to be marked as compliant'.. Enforcing device compliance is a foundational element of a Zero Trust architecture. By creating a Conditional Access policy that requires devices to be marked as compliant with Intune or be Microsoft Entra hybrid joined, you ensure that only devices meeting your security baseline can access sensitive data. This prevents users from accessing corporate resources from personal, unmanaged devices that may lack adequate security controls, encryption, or antivirus protections.

Answer

Create a policy requiring 'Require approved client app'.

Answer

Configure an App Protection Policy in the Microsoft Entra portal.

Answer

Set the user session frequency to 1 hour.

Question 8

An organization wants to restrict administrative access to a specific geographic location. Which configuration is most effective?

Accepted Answer

Create a Conditional Access policy with a Named Location and block access from 'Any location' except the trusted network.. Conditional Access is the correct tool for location-based access control. By defining 'Named Locations' based on IP ranges and then creating a policy that blocks access from all locations except those defined, you ensure that administrative portals are unreachable from outside the corporate network. This creates a powerful perimeter-based defense that prevents attackers from attempting to access administrative interfaces from known-bad or foreign regions.

Answer

Use the 'Country-based' location filter in the administrative portal settings.

Answer

Create a new security group for administrators and add an IP restriction to the group.

Answer

Configure 'Restrict access to Microsoft Entra administration portal' to 'No'.

Question 9

You are auditing sign-in logs and see many 'Interrupted' sign-ins. What does this typically indicate?

Accepted Answer

The user is being prompted to complete a required action like MFA registration.. An 'Interrupted' sign-in status in Entra ID occurs when the authentication process is paused because the user is required to complete an additional action, such as MFA registration, password reset, or terms of use acceptance. It is not an error, but a state where the identity provider is waiting for the user to fulfill a policy mandate before granting access to the requested application, which is crucial for compliant identity management.

Answer

The user entered an incorrect password multiple times.

Answer

The user's device is not compliant with company policy.

Answer

The service principal has an expired client secret.

Question 10

You need to ensure that your tenant is protected against common credential-based attacks. Which THREE features should you enable or configure?

Accepted Answer

Smart Lockout. A multi-layered defense is required to protect identities. Smart Lockout prevents brute-force attacks by tracking failed attempts, Security Defaults (or Conditional Access) provides baseline protection including MFA, and Password Protection prevents users from creating weak credentials. Together, these controls address the most common vectors for credential compromise, significantly hardening the identity perimeter against automated and manual attacks that target weak or re-used passwords across the enterprise.

Answer

Public Preview features for all users.

Answer

SMS as the only MFA method.

Question 11

Refer to the exhibit. What is the most likely cause of this sign-in failure for the web application?

Accepted Answer

The redirect URI is missing from the App Registration configuration.. Error 50011 is a classic configuration mismatch between the application's authentication request and the registered settings in Entra ID. The application is sending a redirect URI that is not present in the 'Redirect URIs' list of the App Registration. This is a common deployment issue that occurs when the developer updates the application URL or callback path but fails to synchronize those changes in the Microsoft Entra identity configuration.

Answer

The user does not have sufficient permissions to access the application.

Answer

The client secret has expired.

Answer

The user is using an unsupported browser.

Question 12

You are managing access to a sensitive application. You want to ensure that if a user's risk level changes to 'High', they are immediately prompted for a password change. How do you implement this?

Accepted Answer

Configure a user risk policy in Entra ID Protection to require a password change.. Using Entra ID Protection in conjunction with Conditional Access policies allows for real-time, risk-based access remediation. By configuring a policy that requires a password change upon a 'High' risk event, you automate the response to potential compromises. This reduces the dwell time of an attacker by forcing an immediate credential reset, which invalidates the existing session and prevents further unauthorized access without requiring manual administrative intervention for every detected high-risk event.

Answer

Configure a sign-in risk policy.

Answer

Manually reset the user's password in the admin center.

Answer

Create a Conditional Access policy that blocks the user's IP.

Question 13

You need to provide temporary access to an external contractor. What is the most secure way to manage this using Microsoft Entra ID?

Accepted Answer

Use Microsoft Entra B2B collaboration and configure an access review.. Microsoft Entra B2B collaboration with access reviews is the recommended approach for managing external identities. It allows you to invite guests while maintaining governance through automated reviews, ensuring that external access is revoked once the contractor's engagement ends. This minimizes the risk of 'guest creep', where contractors retain access long after they have completed their projects, which is a major security risk in modern, highly connected organizational environments.

Answer

Create a local user account in the tenant.

Answer

Create a shared mailbox for the contractor.

Answer

Share your own administrative credentials with the contractor.

Question 14

Which MFA method is considered the most secure because it provides a hardware-bound cryptographic proof?

Accepted Answer

FIDO2 Security Key. FIDO2 security keys offer the highest level of security for MFA. Because the private key never leaves the hardware device, it is impossible to phish, intercept, or replicate via software. This provides a level of assurance that cannot be matched by software-based MFA, such as TOTP or push notifications, making it the ideal choice for highly sensitive accounts or environments where the threat of sophisticated phishing is high.

Answer

Authenticator App (TOTP)

Answer

Windows Hello for Business

Answer

OATH hardware tokens

Question 15

What is the primary benefit of enabling 'Security Defaults' in a new Microsoft Entra tenant?

Accepted Answer

It enforces mandatory MFA for all users and blocks legacy authentication.. Security Defaults offer an automated, baseline security posture by enforcing MFA for all users, blocking legacy authentication protocols, and protecting administrative portals. This is invaluable for organizations that may not have the capacity to manage complex Conditional Access policies immediately. It ensures that basic, essential protections are applied instantly, closing the most common security gaps that lead to successful account compromise in newly provisioned cloud environments.

Answer

It allows granular exclusion of specific users from MFA requirements.

Answer

It provides advanced threat protection for cloud-based virtual machines.

Answer

It automatically upgrades the tenant to a Premium P2 license.

Question 16

Your organization wants to prevent users from using legacy authentication protocols, such as POP3 and IMAP4, to access Microsoft 365 services. You need to implement a solution that blocks these protocols while allowing modern authentication. What is the most effective way to achieve this using Conditional Access?

Accepted Answer

Create a Conditional Access policy, select All Cloud Apps, and under Client Apps, select only Legacy Authentication clients with a Block grant.. Enforcing modern authentication through Conditional Access is critical because legacy protocols lack the capability to handle multi-factor authentication challenges. By explicitly blocking these protocols, organizations mitigate risk against automated attacks. This configuration aligns with Zero Trust principles by verifying every access attempt using modern standards. It ensures that the environment remains secure against credential harvesting and unauthorized access through older, less secure interfaces.

Answer

Disable the POP3 and IMAP4 services at the tenant level within the Microsoft 365 Admin Center for every individual user mailbox.

Answer

Enable Security Defaults in the Microsoft Entra admin center to automatically manage all authentication and security settings for the tenant.

Answer

Update the default Authentication Policy in Exchange Online to set the AllowBasicAuth setting to false for all available mail protocols.

Question 17

An organization is implementing Entra ID Protection to enhance their security posture. You need to configure policies that automatically respond to detected identity risks. Which TWO policies should you implement to meet this requirement?

Accepted Answer

User risk policy. Identity Protection allows organizations to automate the detection and remediation of identity-based risks. User risk policies focus on the long-term behavior of an account, while sign-in risk policies evaluate the probability that a specific authentication request is unauthorized. Implementing both ensures that compromised accounts are forced to change passwords and suspicious logins are challenged with MFA, providing layered security for the tenant.

Answer

MFA registration policy

Answer

App protection policy

Answer

Device compliance policy

Question 18

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Entra Conditional Access policy. Based on this configuration, what is the effect of the policy?

Accepted Answer

Access is blocked for all users except those located within the US_Named_Location.. Understanding the logic of 'Include' and 'Exclude' in Conditional Access is vital for preventing accidental lockouts and ensuring correct policy application. This policy uses a 'Block' control, which is the most restrictive action available. By including 'All' and excluding a specific location, the policy creates a geofence that prevents any access attempt originating from outside the defined trusted geographic boundary.

Answer

Access is granted only to users within the US_Named_Location if they pass MFA.

Answer

Access is blocked for all users regardless of their current geographic location.

Answer

Access is granted to all users as long as they are not in the US_Named_Location.

Question 19

You are configuring Self-Service Password Reset (SSPR) for your organization. You need to ensure that users are prompted to verify their contact information periodically to maintain the accuracy of recovery data. Which setting should you configure?

Accepted Answer

Number of days before users are asked to re-confirm their authentication information.. Data accuracy in SSPR is essential for the reliability of the password recovery process. If recovery information like phone numbers or email addresses becomes outdated, users will be unable to reset their passwords, leading to increased help desk calls. Microsoft Entra ID provides a built-in mechanism to periodically force users to confirm their registered security info, ensuring the system remains functional.

Answer

The registration policy in Microsoft Entra ID Protection for MFA enrollment.

Answer

The password expiration policy within the Microsoft 365 Admin Center settings.

Answer

The 'Notify users on password resets' toggle in the SSPR notification settings.

Question 20

You need to implement a high-security authentication strategy for your executive team. The strategy must support phishing-resistant authentication. Which THREE authentication methods meet this requirement?

Accepted Answer

FIDO2 security keys. Phishing-resistant authentication is a cornerstone of modern identity security, as it prevents attackers from using stolen credentials or intercepting MFA codes. These methods rely on cryptographic keys bound to the hardware or the device, making it impossible for a user to accidentally provide their credentials to a malicious site. Implementing these methods significantly reduces the risk of account takeovers for high-profile users.

Answer

Microsoft Authenticator push notifications

Answer

SMS-based authentication codes