View Full Microsoft SC-300 Exam Dumps and Practice Test Dumps.

 

Question 221

Which Microsoft Entra feature allows administrators to define additional information about a user that can be used for organization-specific security and access scenarios?

1. Custom security attributes
2. Access Reviews
3. Named locations
4. Application Proxy

Correct Answer: 1

Explanation

Custom security attributes allow organizations to define additional attributes for Microsoft Entra users and other supported directory objects. These attributes can store organization-specific information that is not included in the standard directory properties. They can be useful in scenarios involving authorization, classification, and access management. Access Reviews are used to evaluate existing permissions, named locations identify network or geographic locations for Conditional Access, and Application Proxy provides access to on-premises web applications. Custom security attributes are therefore the appropriate feature for storing organization-specific security information.

Question 222

An organization wants to prevent all users except members of a specific group from accessing an enterprise application. Which configuration should be used?

1. Authentication strength
2. Assignment required
3. Smart Lockout
4. Access review

Correct Answer: 2

Explanation

The Assignment required setting for an enterprise application can restrict access so that only users or groups explicitly assigned to the application can sign in. Administrators can assign the application to a specific security group, allowing members of that group to access it while preventing unassigned users from accessing it. Authentication strength controls how users authenticate, Smart Lockout protects accounts from repeated failed sign-ins, and Access Reviews periodically evaluate existing access. Assignment required is therefore the appropriate configuration for restricting application access to an approved group.

Question 223

Which Microsoft Entra capability can require users to complete MFA when their account is detected as having elevated user risk?

1. Microsoft Entra ID Protection with Conditional Access
2. Group-based licensing
3. Application provisioning
4. My Apps

Correct Answer: 1

Explanation

Microsoft Entra ID Protection can identify elevated user risk based on detected identity threats, while Conditional Access can use that risk as a condition for applying security controls. An organization can configure a policy that requires users with elevated risk to complete MFA or perform another supported remediation action. This combination allows the organization to respond automatically to potentially compromised accounts. Group-based licensing manages licenses, application provisioning manages application accounts, and My Apps provides application access. ID Protection combined with Conditional Access is therefore the appropriate solution.

Question 224

Which Microsoft Entra feature can automatically assign users to a group based on a rule such as user.department equals “Finance”?

1. Access package
2. Dynamic group
3. Administrative unit
4. Security Defaults

Correct Answer: 2

Explanation

Dynamic groups use membership rules based on user or device attributes. A rule can evaluate properties such as department, job title, location, or other supported attributes. When the relevant information changes, Microsoft Entra automatically reevaluates the rule and updates group membership. This can simplify application assignment, licensing, and access management. An access package governs resource access, an administrative unit provides an administrative boundary, and Security Defaults provide baseline security settings. Dynamic groups are therefore the correct feature for automatically assigning users according to attribute-based membership rules.

Question 225

Which Microsoft Entra capability provides a way to publish an on-premises web application for external access while using Microsoft Entra authentication?

1. Application Proxy
2. Access Reviews
3. Lifecycle Workflows
4. Group-based licensing

Correct Answer: 1

Explanation

Microsoft Entra Application Proxy allows organizations to publish supported on-premises web applications for remote users while integrating access with Microsoft Entra ID. An Application Proxy connector communicates from inside the organization’s network with the cloud service, allowing users to access the published application without directly exposing the internal application through inbound firewall connections. Access Reviews govern existing permissions, Lifecycle Workflows automate identity lifecycle tasks, and group-based licensing manages licenses. Application Proxy is therefore the appropriate Microsoft Entra capability for publishing supported internal web applications.

Question 226

A company wants to allow users to access a sensitive application only when they are using a device marked as compliant. Which Conditional Access grant control should be configured?

1. Require device to be marked as compliant
2. Require password reset
3. Require access review
4. Require application assignment

Correct Answer: 1

Explanation

Conditional Access can require a device to be marked as compliant before allowing access to a protected application. Compliance information can be supplied by supported device-management services, allowing organizations to enforce requirements such as security configuration or device health before granting access. This is particularly useful for sensitive corporate applications and data. Password reset is not a standard Conditional Access grant control for this purpose, access reviews evaluate existing permissions, and application assignment controls which users can access an enterprise application. Requiring device compliance is therefore the correct choice.

Question 227

Which Microsoft Entra feature can be used to periodically confirm that external guests should retain access to an application?

1. Conditional Access
2. Access Reviews
3. Application provisioning
4. Password Protection

Correct Answer: 2

Explanation

Access Reviews can be configured to periodically evaluate whether external guest users should continue to have access to applications and other supported resources. Reviewers can examine each guest’s access and approve or deny continued access according to current business requirements. This is especially valuable because external users may retain access after a project or partnership ends. Conditional Access controls sign-in requirements, application provisioning manages application accounts, and Password Protection controls password selection. Access Reviews are therefore the appropriate feature for periodically validating continued guest access.

Question 228

Which authentication method provides phishing-resistant passwordless authentication by using public-key cryptography?

1. SMS authentication
2. Password authentication
3. FIDO2 security key
4. Security questions

Correct Answer: 3

Explanation

FIDO2 security keys provide strong passwordless authentication based on public-key cryptography. During registration, the authenticator creates a cryptographic credential associated with the user’s account. During sign-in, the user proves possession of the registered authenticator rather than submitting a password. This makes FIDO2 resistant to many common phishing techniques and makes it particularly useful for privileged accounts and sensitive environments. SMS, traditional passwords, and security questions do not provide the same level of phishing resistance. FIDO2 is therefore the correct authentication method.

Question 229

Which Microsoft Entra capability can be used to manage access for a user who belongs to multiple departments without manually changing application assignments?

1. Dynamic groups
2. Smart Lockout
3. Temporary Access Pass
4. Audit logs

Correct Answer: 1

Explanation

Dynamic groups can automatically manage membership according to defined user attributes and rules. Organizations can create multiple groups based on attributes such as department, job role, location, or other supported properties and assign applications to those groups. When user attributes change, Microsoft Entra can update group membership automatically, reducing manual application-assignment work. Smart Lockout protects accounts from repeated failed authentication attempts, Temporary Access Pass provides temporary authentication, and audit logs record directory activity. Dynamic groups are therefore the appropriate solution for automated attribute-based application access.

Question 230

Which Microsoft Entra feature allows administrators to review the permissions requested by an application before allowing organizational users to consent?

1. App registration and API permissions
2. Access Reviews
3. Lifecycle Workflows
4. Named locations

Correct Answer: 1

Explanation

App registrations provide the configuration area where administrators and developers can define and review an application’s API permissions. Permissions may include delegated or application access to Microsoft Graph and other APIs. Reviewing requested permissions is important because excessive permissions can provide an application with more access than necessary. Depending on the permissions requested, user or administrator consent may be required. Access Reviews evaluate existing user access, Lifecycle Workflows automate identity processes, and named locations support Conditional Access. App registration and API permissions are therefore the appropriate area for reviewing application permission requirements.

Question 231

An organization wants administrators to activate privileged roles for no longer than two hours at a time. Which feature should be configured?

1. Privileged Identity Management
2. Access Reviews
3. Application Proxy
4. Group-based licensing

Correct Answer: 1

Explanation

Privileged Identity Management allows organizations to control the maximum duration for privileged role activation. An administrator can configure eligible users to activate a role only for a limited period, such as two hours, reducing the amount of time elevated permissions remain available. Additional activation requirements can include MFA, approval, and justification. Access Reviews evaluate existing assignments, Application Proxy provides access to on-premises applications, and group-based licensing manages licenses. PIM is therefore the appropriate feature for enforcing a maximum activation duration for privileged administrative roles.

Question 232

Which Microsoft Entra capability can automatically remove a user’s access to an application when the user is no longer assigned to the application?

1. Application provisioning
2. Named locations
3. Authentication strength
4. Security Defaults

Correct Answer: 1

Explanation

Application provisioning can automate account lifecycle operations in supported applications. When access to an application is removed, provisioning can send the appropriate update to the target application so that the user’s account can be disabled or removed, depending on the application’s capabilities and configuration. This helps organizations keep application access aligned with Microsoft Entra assignments and reduces manual deprovisioning work. Named locations support location-based access policies, authentication strength controls authentication requirements, and Security Defaults provide baseline protections. Application provisioning is therefore the appropriate capability.

Question 233

Which Microsoft Entra feature can help administrators identify whether a sign-in attempt was considered risky and why?

1. Microsoft Entra ID Protection
2. Group-based licensing
3. Access package catalog
4. My Apps

Correct Answer: 1

Explanation

Microsoft Entra ID Protection provides risk detection and investigation capabilities for user and sign-in activity. Administrators can review detected risk information and associated signals to understand why Microsoft considered an authentication event potentially suspicious. This information can then support remediation or Conditional Access decisions. Group-based licensing manages licenses, access package catalogs organize resources for entitlement management, and My Apps provides users with access to assigned applications. Microsoft Entra ID Protection is therefore the appropriate service for investigating risky sign-in detections and their associated risk information.

Question 234

A company wants to ensure that users can access a project application only after accepting an organizational agreement. Which Microsoft Entra capability should be used?

1. Terms of Use with Conditional Access
2. Smart Lockout
3. Dynamic groups
4. Password protection

Correct Answer: 1

Explanation

Microsoft Entra Terms of Use can be integrated with Conditional Access to require users to accept defined organizational terms before accessing selected applications or resources. Administrators can create the terms and then use a Conditional Access policy to target appropriate users and applications. This can support acceptable-use requirements, compliance obligations, or other organizational agreements. Smart Lockout protects accounts against repeated failed authentication attempts, dynamic groups automate membership, and Password Protection controls password selection. Terms of Use combined with Conditional Access is therefore the correct solution.

Question 235

Which Microsoft Entra feature can provide an identity for an Azure workload without requiring developers to manage a client secret?

1. Managed identity
2. Access Review
3. Enterprise application assignment
4. Dynamic group

Correct Answer: 1

Explanation

Managed identities provide Azure resources with identities that are managed by Microsoft Entra ID. Applications running on supported Azure resources can use these identities to authenticate to supported services without storing client secrets or passwords in application code. This reduces the need for manual secret management and can improve security by eliminating credentials that developers would otherwise need to protect and rotate. Access Reviews evaluate permissions, enterprise application assignment controls user access to applications, and dynamic groups manage group membership. Managed identity is therefore the appropriate solution for this scenario.

Question 236

Which Microsoft Entra feature allows an administrator to assign a role only to users within a particular administrative unit?

1. Scoped directory role assignment
2. Group-based licensing
3. Access package catalog
4. Authentication registration

Correct Answer: 1

Explanation

Scoped directory role assignments allow supported Microsoft Entra administrative roles to be limited to a specific administrative unit. This enables delegated administration while preventing the administrator from automatically receiving management permissions across the entire tenant. For example, an administrator responsible for a particular regional unit can manage users within that unit without receiving unrestricted directory-wide access. Group-based licensing manages licenses, access package catalogs organize governed resources, and authentication registration helps users register authentication methods. Scoped directory role assignment is therefore the correct capability for this requirement.

Question 237

Which Microsoft Entra capability can help enforce stronger authentication when a user accesses a resource classified as highly sensitive?

1. Authentication strength
2. Access Reviews
3. Lifecycle Workflows
4. Application provisioning

Correct Answer: 1

Explanation

Authentication strength is a Conditional Access capability that allows administrators to specify the authentication methods users must satisfy for selected access scenarios. Organizations can apply stronger authentication requirements to highly sensitive resources and can require methods with greater resistance to phishing. This provides more precise control than simply requiring generic MFA. Access Reviews evaluate whether users should retain access, Lifecycle Workflows automate identity lifecycle tasks, and application provisioning manages application accounts. Authentication strength is therefore the appropriate capability for enforcing stronger authentication for sensitive resources.

Question 238

An organization wants to automatically assign Microsoft 365 licenses to everyone in a specific department. Which combination should be used?

1. Dynamic group and group-based licensing
2. Access Review and PIM
3. Application Proxy and SSPR
4. Named location and Conditional Access

Correct Answer: 1

Explanation

A dynamic group can automatically include users based on an attribute such as department. Group-based licensing can then assign the required Microsoft 365 licenses to members of that group. This combination allows licensing to follow organizational changes automatically. When a user’s department attribute changes, dynamic group membership can be reevaluated, which can also affect the user’s license assignment. Access Reviews and PIM are governance tools, Application Proxy and SSPR address application access and password recovery, and named locations and Conditional Access manage access policies. The dynamic group and group-based licensing combination is therefore appropriate.

Question 239

Which Microsoft Entra feature can help an organization automatically revoke access when a user no longer meets the conditions for an access package assignment?

1. Entitlement Management
2. Smart Lockout
3. Authentication Methods
4. Audit logs

Correct Answer: 1

Explanation

Microsoft Entra Entitlement Management governs access through access packages and their associated policies. Administrators can define expiration, approval, review, and other conditions that determine how long users should retain access. When the conditions for an assignment are no longer satisfied, supported governance processes can remove the user’s access to the resources included in the package. Smart Lockout protects authentication, Authentication Methods manages available sign-in methods, and audit logs record directory activity. Entitlement Management is therefore the appropriate feature for governed access lifecycle management.

Question 240

Which Microsoft Entra capability can help an organization maintain emergency administrator access if Conditional Access policies accidentally block normal administrators?

1. Break-glass account
2. Dynamic group
3. Access package
4. Application provisioning

Correct Answer: 1

Explanation

A break-glass account is an emergency access account maintained to prevent administrators from being completely locked out of Microsoft Entra ID. Organizations typically secure these accounts carefully, monitor their use, and configure them so that they remain available for genuine emergency situations. They can provide a recovery path if a Conditional Access policy, authentication configuration, or other administrative change accidentally prevents normal administrators from signing in. Dynamic groups manage membership, access packages govern resource access, and application provisioning manages application accounts. A break-glass account is therefore the appropriate emergency access mechanism.