Free Preparation Discussions
MENU
Microsoft SC-300 Exam Questions
Free Microsoft SC-300 Exam Actual Questions
Note: Premium Questions for SC-300 were last updated On Oct. 25, 2026 (see below)
SIMULATION
Task 6
You need to implement additional security checks before the members of the Sg-Executive can access any company apps. The members must meet one of the following conditions:
* Connect by using a device that is marked as compliant by Microsoft Intune.
* Connect by using client apps that are protected by app protection policies.
To implement additional security checks for the Sg-Executive group members before they canaccess any company apps, you can use Conditional Access policies in Microsoft Entr
a. Here's a step-by-step guide:
Sign in to the Microsoft Entra admin center:
Ensure you have the role of Global Administrator or Security Administrator.
Navigate to Conditional Access:
Go to Security > Conditional Access.
Create a new policy:
Select + New policy.
Name the policy appropriately, such as ''Sg-Executive Security Checks''.
Assign the policy to the Sg-Executive group:
Under Assignments, select Users and groups.
Choose Select users and groups and then Groups.
Search for and select the Sg-Executive group.
Define the application control conditions:
Under Cloud apps or actions, select All cloud apps to apply the policy to any company app.
Set the device compliance requirement:
Under Conditions > Device state, configure the policy to include devices marked as compliant by Microsoft Intune.
Set the app protection policy requirement:
Under Conditions > Client apps, configure the policy to include client apps that are protected by app protection policies.
Configure the access controls:
Under Access controls > Grant, select Grant access.
Choose Require device to be marked as compliant and Require approved client app.
Ensure that the option Require one of the selected controls is enabled.
Enable the policy:
Set Enable policy to On.
Review and save the policy:
Review all settings to ensure they meet the requirements.
Click Create to save and implement the policy.
By following these steps, you will ensure that the Sg-Executive group members can only access company apps if they meet one of the specified conditions, either by using a compliant device or a protected client app. This enhances the security posture of your organization by enforcing stricter access controls for executive-level users.
You have an Azure subscription that contains a user named User1. The subscription is onboarded to Microsoft Entra Permissions Management. You need to provide User! with access to Permissions Management. The solution must meet the following requirements:
* Follow the principle of least privilege.
* Minimize administrative effort.
What should you do first?
When onboarding to Microsoft Entra Permissions Management (a CIEM solution), before a user can perform any functions inside Permissions Management, that user must be granted an appropriate Permissions Management role in the Entra tenant. The principle of least privilege dictates that you grant only the minimal role necessary (for example, a Permissions Management Approver, Viewer, or Controller). The SC-300 study materials and Microsoft's documentation emphasize that administrative access must begin by assigning roles within Entra ID.
Creating a security group (option A) is a useful organizational practice but doesn't itself grant the user permissions inside Permissions Management. Creating a role/policy template (option B) is about defining permission scopes and is not a first step to allow a user access. Creating a request in My Requests (option D) presupposes that User1 already has some entitlement to make requests (i.e. some role), which they don't yet.
Therefore, the first action is to assign a Permissions Management role to User1 from the Entra admin center, thus giving them appropriate access while adhering to least privilege.
You have the Azure resources show in the following table.
To Which identities can you assign the Contributor role for RG1?
Azure RBAC roles on a scope (subscription, resource group, resource) can be assigned to Azure AD security principals: users, groups, and service principals (which includes enterprise applications and managed identities). The SC-300 content states: ''RBAC roles can be assigned to users, groups, and applications (service principals), including system-assigned managed identities created for Azure resources.'' In the table, User1 (user), Group1 (security group), VM1 (a VM with system-assigned managed identity), and App1 (an enterprise application service principal) are all valid principals. Therefore, all four can be assigned the Contributor role at the RG1 scope. This enables least-privilege delegation to workloads (VM1/App1) and to people (User1/Group1) without granting broader directory roles.
You have a Microsoft 365 subscription that contains a user named User1.
You need to ensure that User1 can create access reviews for Azure AD roles. The solution must use the principal of least privilege.
Which role should you assign to User1?
The question asks which role allows a user to create access reviews for Azure AD roles using the principle of least privilege.
Privileged Role Administrator can manage all role assignments and access reviews, but it has more privileges than needed.
Identity Governance Administrator manages entitlement management and access packages, not Azure AD roles directly.
User Administrator can manage users but not access reviews for roles.
User Access Administrator is the correct least-privilege role, as it allows management of access reviews related to Azure AD roles and role-assignable groups.
From Microsoft Documentation (SC-300 Exam Guide):
''The User Access Administrator role allows management of access reviews and permissions for Azure AD roles and resources using the least-privileged approach.''
You have 2,500 users who are assigned Microsoft 365 E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft 365 E5 licenses to a group that includes all users. You need to remove the Microsoft 365 E3 licenses from the users by using the least amount of administrative effort What should you use?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
James Flores
1 month agoCrystal Flores
2 months agoCarol Perez
2 months agoOlivia Gonzalez
3 months agoAngela Howard
3 months agoWilliam Scott
4 months agoJessica Rogers
4 months agoBetty Stewart
5 months agoKimberly Robinson
5 months agoRebecca Jones
6 months agoNancy Miller
6 months agoLisa Parker
6 months agoChristopher Evans
6 months agoMichelle Nguyen
6 months agoMelissa Robinson
6 months agoRonald Lewis
6 months agoCorrina
7 months agoMabel
7 months agoTommy
7 months agoAlberto
8 months agoVerda
8 months agoHobert
8 months agoClarinda
8 months agoTiffiny
9 months agoShanda
9 months agoLuann
9 months agoFrederica
9 months agoEvangelina
10 months agoTheola
10 months agoLilli
10 months agoVilma
10 months agoValentin
11 months agoJin
11 months agoBonita
11 months agoBuck
11 months agoDick
12 months agoMarshall
12 months agoMarjory
1 year agoEric
1 year agoFausto
1 year agoErinn
1 year agoBrent
1 year agoTerrilyn
1 year agoArgelia
1 year agoOdelia
1 year agoEliz
1 year agoStephaine
1 year agoTarra
1 year agoCarlton
2 years agoArminda
2 years agoElli
2 years agoMari
2 years agoSusy
2 years agoSharen
2 years agoMona
2 years agoAn
2 years agoAntione
2 years agoLilli
2 years agoGertude
2 years agoAllene
2 years agoMattie
2 years agoJacqueline
2 years agoEden
2 years agoJuan
2 years agoCherilyn
2 years agoMatthew
2 years agoEladia
2 years agoShaunna
2 years agoHyman
2 years agoFanny
2 years agoArtie
2 years agoRoyce
2 years agoIesha
2 years agoLorriane
2 years ago