最新的Microsoft Identity and Access Administrator - SC-300免費考試真題
You have an Azure subscription.
You need to use Microsoft Entra Permissions Management to automatically monitor permissions and create and implement right-size roles. The solution must follow the principle of least privilege.
Which role should you assign to the service principal of Permissions Management?
You need to use Microsoft Entra Permissions Management to automatically monitor permissions and create and implement right-size roles. The solution must follow the principle of least privilege.
Which role should you assign to the service principal of Permissions Management?
正確答案: C
說明：（僅 Fast2test 成員可見）
You have an Azure AD tenant that contains two users named User1 and User2. You plan to perform the following actions:
* Create a group named Group 1.
* Add User1 and User 2 to Group1.
* Assign Azure AD roles to Group1.
You need to create Group1.
Which two settings can you use? Each correct answer presents a complete solution NOTE: Each correct selection is worth one point
* Create a group named Group 1.
* Add User1 and User 2 to Group1.
* Assign Azure AD roles to Group1.
You need to create Group1.
Which two settings can you use? Each correct answer presents a complete solution NOTE: Each correct selection is worth one point
正確答案: C
說明：（僅 Fast2test 成員可見）
You have an on-premises server named Server! that runs Windows Server.
You have a Microsoft Entra tenant that contains an app registration named App1. App1 has Microsoft Graph application permissions.
You need to configure the environment to support App1. The solution must meet the following requirements:
* App1 must be accessible only from the corporate network.
* The credentials for App1 must NOT be stored as plain text.
* Non-interactive scheduled tasks on Server 1 must be able to authenticate to App1.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have a Microsoft Entra tenant that contains an app registration named App1. App1 has Microsoft Graph application permissions.
You need to configure the environment to support App1. The solution must meet the following requirements:
* App1 must be accessible only from the corporate network.
* The credentials for App1 must NOT be stored as plain text.
* Non-interactive scheduled tasks on Server 1 must be able to authenticate to App1.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn documentation ("Implement app registration and authentication with Microsoft Entra ID") , when configuring app registrations and securing non-interactive service applications (like scheduled tasks), two key elements must be addressed - secure authentication and conditional access enforcement.
To ensure App1 is accessible only from the corporate network, you must configure a Conditional Access policy in Microsoft Entra ID. Conditional Access policies allow you to restrict access to applications based on conditions such as:
* User or workload identity
* Location (e.g., trusted IP ranges or corporate networks)
* Device compliance and sign-in risk
As Microsoft documentation states:
"Conditional Access policies can restrict access to specific applications based on location, risk, or device status. Use named locations to allow access only from your trusted network." Therefore, a Conditional Access policy is required to meet the first requirement.
For non-interactive scheduled tasks running on an on-premises server (Server1) that need to authenticate to App1 using application permissions, credentials must be securely stored. Storing plain-text secrets (like passwords or client secrets) violates security best practices.
Microsoft recommends using certificates for application authentication because certificates are securely stored and provide higher security than secrets.
From the SC-300 material and Microsoft Learn:
"When registering applications that use non-interactive authentication, use a certificate-based credential instead of a client secret. Certificates are more secure and meet compliance requirements for secure app authentication." This approach also ensures that Server1's scheduled tasks can authenticate silently using the private key of the certificate.
You have an Azure AD tenant that contains the users shown in the following table.
You have the Azure AD Identity Protection policies shown in the following table.
You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have the Azure AD Identity Protection policies shown in the following table.
You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正確答案:
Explanation:
User1 can sign in by using multi-factor authentication (MFA): No
User2 can sign in by using multi-factor authentication (MFA): No
User3 can sign in from an anonymous IP address: No
This scenario is based on Azure AD Identity Protection and its two core conditional access mechanisms:
* User risk policy - evaluates the probability that a user ' s identity might be compromised.
* Sign-in risk policy - evaluates the probability that a sign-in attempt might not be performed by the legitimate user.
Let's analyze step-by-step based on the tables provided:
* Risk level: Low
* User risk policy: Applies to Low and above (so Low, Medium, and High users).
* Control: Block access.
* Action performed: Confirm user compromised. Confirming a user as compromised keeps or increases their risk level until the user is remediated (i.e., password reset). Because the policy blocks access for any user risk "Low and above," User1's sign-in is blocked, and MFA will not be prompted - access is denied.
# User1 MFA sign-in: No
* Initial risk level: Medium
* Actions performed:
* Confirm sign-in safe # clears that sign-in's risk.
* Confirm user compromised # elevates user risk back to "High."
* Policies applied:
* User risk policy (Low and above): Blocks access.
* Sign-in risk policy: Applies only to High sign-ins (not relevant here).
Since User2's user risk is set to High after confirming compromised, the User risk policy blocks access for
"Low and above."
Therefore, MFA is not allowed (the session is denied outright).
# User2 MFA sign-in: No
* User risk: High
* Action performed: Dismiss user risk # resets the user risk to "No risk."
* Sign-in policy: High sign-in risk # block access. If User3 signs in from an anonymous IP, Azure AD Identity Protection detects this as a High sign-in risk (per Microsoft documentation). Since the sign-in risk policy blocks all high sign-ins, access will be blocked.
# User3 anonymous IP sign-in: No
You have an Azure Active Directory (Azure AD) tenant that contains cloud-based enterprise apps.
You need to group related apps into categories in the My Apps portal.
What should you create?
You need to group related apps into categories in the My Apps portal.
What should you create?
正確答案: B
說明：（僅 Fast2test 成員可見）
You need to sync the ADatum users. The solution must meet the technical requirements.
What should you do?
What should you do?
正確答案: A
說明：（僅 Fast2test 成員可見）
You have an Azure subscription that containes a registered app named App1.
You need to review the sign-in activity for App1. The solution must meet the following requirements:
* Identify the number of failed sign-ins.
* Identify the success rate of sign-ins.
* Minimize administrative effort.
What should you use?
You need to review the sign-in activity for App1. The solution must meet the following requirements:
* Identify the number of failed sign-ins.
* Identify the success rate of sign-ins.
* Minimize administrative effort.
What should you use?
正確答案: A
You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM).
You need to identify users that are eligible for the Cloud Application Administrator role.
Which blade in the Privileged Identity Management settings should you use?
You need to identify users that are eligible for the Cloud Application Administrator role.
Which blade in the Privileged Identity Management settings should you use?
正確答案: C
說明：（僅 Fast2test 成員可見）
You need to locate licenses to the A. Datum users. The solution must need the technical requirements.
Which type of object should you create?
Which type of object should you create?
正確答案: C
說明：（僅 Fast2test 成員可見）
You have a Microsoft Entra tenant.
You need to implement smart lockout with a lockout threshold of 10 failed sign-ins. What should you configure in the Microsoft Entra admin center?
You need to implement smart lockout with a lockout threshold of 10 failed sign-ins. What should you configure in the Microsoft Entra admin center?
正確答案: C
說明：（僅 Fast2test 成員可見）