Microsoft Identity and Access Administrator (SC-300)

You need to configure the MFA settings for users who connect from the Boston office. The solution must meet the authentication requirements and the access requirements.

What should you include in the configuration?

You have a Microsoft Entra tenant.

You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by using a phishing-resistant multi-factor authentication (MFA) method.

Which three authentication methods should you include in the solution? Each correct answer presents a complete solution.

You have a Microsoft 365 E5 subscription.

You need to perform the following tasks:

• Identify the locations and IP addresses used by Azure AD users to sign in.
• Review the Azure AD security settings and identify improvement recommendations.
• Identify changes to Azure AD users or service principals.

What should you use for each task? To answer, drag the appropriate resources to the correct requirements. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

You have an Azure Active Directory (Azure AD) tenant that has Security defaults disabled. You are creating a conditional access policy as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft 365 subscription.

You have an Azure subscription that contains an Azure App Service web app named App1.

You have multiple devices that run Windows and are enrolled in Microsoft Intune.

You deploy the Global Secure Access client to the devices by using Intune.

You need to configure private access to App1.

What should you do next?

You have a Microsoft Entra tenant that contains the users shown in the following table.

The tenant contains the identities shown in the following table.

You have an attribute set named Custom 1 that contains the custom security attributes shown in the following table.

For each of the following statements. select Yes if the statement is true. Otherwise. select No.

You have an Azure Active Directory (Azure AD) tenant that contains a user named SecAdmin1. SecAdmin1 is assigned the Security administrator role. SecAdmin1 reports that she cannot reset passwords from the Azure AD Identity Protection portal.

You need to ensure that SecAdmin1 can manage passwords and invalidate sessions on behalf of non-administrative users. The solution must use the principle of least privilege.

Which role should you assign to SecAdmin1?

You have an Azure subscription named Sub1.

You plan to use Microsoft Entra Permissions Management to manage Sub1.

You need to ensure that Permissions Management can perform the following tasks:

• Identify unused permissions assigned to applications and managed identities.

• Provide users with recommendations about which permissions to remove.

• Remove unused permissions.

The solution must follow the principle of least privilege.

Which role should you assign to the service principal of Permissions Management, and what should you use to provide recommendations and remove unused permissions? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft Entra tenant that contains 1.000 users. The users are assigned Microsoft Entra Suite licenses.

Vou perform the following actions:

• Deploy Global Secure Access.

• create a Global secure Access security profile named Profilel.

• Create the following Conditional Access policies:

o Name: CApoIicy1

o Target resources: All internet resources with Global Secure Access

o Name: CApoIicy2

• use Global secure Access security profile: profile 1

To which Global secure Access traffic forwarding profiles is CAPoIicy1 linked, and to which profile does profilel apply? TO answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses.

You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit. (Click the Exhibit tab.)

You are evaluating the following passwords:

Which passwords will be blocked?

You have multiple on-premises devices that run either Windows or Linux.

You have a Microsoft 365 E5 subscription.

You configure Microsoft Entra Internet Access.

You need to ensure that all the on-premises devices access the internet by using Global Secure Access.

What should you do in the Microsoft Entra admin center?

You have a Microsoft 365 subscription.

You need to create a Conditional Access policy that will use a Global Secure Access security profile. The solution must ensure that users are prevented from accessing websites that include the word gambling in

the URL.

What should you do first?

You have a Microsoft 365 tenant.

All users have mobile phones and laptops.

The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.

You plan to implement multi-factor authentication (MFA).

Which MFA authentication method can the users use from the remote location?

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Microsoft 365 Username:admin@XXYyz112233.onmicrosoft.com

Microsoft 365 Password: =1122334455667788

If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:

Lab Instance: 99999999

You need to create a group named Audit. The solution must ensure that the members of Audit can activate the Security Reader role.

To complete this task, sign in to the appropriate admin center.

You have a Microsoft Entra tenant.

You need to implement smart lockout with a lockout threshold of 10 failed sign-ins.

What should you configure in the Microsoft Entra admin center?

You configure a new Microsoft 365 tenant to use a default domain name of contoso.com.

You need to ensure that you can control access to Microsoft 365 resources by using conditional access policies. What should you do first?

You have a Microsoft 365 subscription that is onboarded to Microsoft Entra Permissions Management.

You need to identify managed identities that are assigned permissions and remove any permissions that have been unused for 90 days. The solution must minimize administrative effort.

What should you do in the Entra Permissions Management portal?

You have a Microsoft Entra tenant that has a Microsoft Entra ID P2 license.

You create a Log Analytics workspace.

You need to ensure that you can view Microsoft Entra ID audit log information by using Azure Monitor.

What should you do first?

Your company has a Microsoft 365 tenant.

The company has a call center that contains 300 users. In the call center, the users share desktop computers and might use a different computer every day. The call center computers are NOT configured for biometric identification.

The users are prohibited from having a mobile phone in the call center.

You need to require multi-factor authentication (MFA) for the call center users when they access Microsoft 365 services. What should you include in the solution?

You have an Azure subscription named Sub1.

You plan to deploy Microsoft Entra Permissions Management.

You need to ensure that Permission Management can onboard Sub1. The solution must follow the principle of least privilege.

How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft Entra tenant.

You discover that a large number of new apps were added to the tenant.

You need to implement an approval process for new enterprise applications.

What should you do?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.

All users who run applications registered in Azure AD are subject to conditional access policies. You need to prevent the users from using legacy authentication.

What should you include in the conditional access policies to filter out legacy authentication attempts?

You have an Microsoft Entra tenant that contains the users shown in the following table.

The tenant contains the identities shown in the following table.

Which users can create custom security attributes, and to which identities can the attributes be assigned? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Sitel.

You need to be notified if a user downloads more than 50 files in one minute from Sitel.

Which type of policy should you create in Microsoft Defender for Cloud Apps?

You have an Azure Active Directory (Azure AD) tenant. You open the risk detections report.

Which risk detection type is classified as a user risk?

Your company has a Microsoft Entra tenant that contains a user named User1.
The company has two departments named marketing and finance.
You need to grant permissions to User1 to manage only the users in the marketing department.

What should you create first?

You have an Azure subscription that contains two virtual machines named VMI and VM2 and an Azure SQL managed instance named SQL1.

You need to ensure that VMI and VM2 can retrieve data from SQLI.

The solution must minimize administrative effort.

What should you create first?

You have a Microsoft 365 tenant.

All users have computers that run Windows 10. Most computers are company-owned and joined to Azure Active Directory (Azure AD). Some computers are user- owned and are only registered in Azure AD.

You need to prevent users who connect to Microsoft SharePoint Online on their user-owned computer from downloading or syncing files. Other users must NOT

be restricted.

Which policy type should you create?

You have a Microsoft Entra tenant.

You need to implement protected actions.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

You have a Microsoft Entra tenant named contoso.com that contains a group named Groupl. Groupl contains 50 users in your

company's IT department and 50 users in your company's accounts department.

You have a partner company that has a Microsoft Entra tenant named fabrikam.com.

You configure cross-tenant synchronization between contoso.com and fabrikam.com.

You need to sync the members of Groupl to fabrikam.com. The solution must meet the following requirements:

• Ensure that only the IT department users sync with fabrikam.com
• Minimize administrative effort.

What should you do in the Cross-tenant synchronization settings? To answer, select the appropriate options in the answer area.

You have an Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant.

The on-premises network contains a VPN server that authenticates to the on-premises Active Directory domain. The VPN server does NOT support Azure Multi- Factor Authentication (MFA).

You need to recommend a solution to provide Azure MFA for VPN connections. What should you include in the recommendation?

You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity.

You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort.

What should you do first?

You have a Microsoft 365 subscription.

You need to ensure that when users access the Microsoft 365 portal from Microsoft Edge and have their browser language set to Spanish, they are presented with a Spanish sign-in form.

What should you do in the Microsoft Entra admin center?

You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant is configured to sync with an on-premises Active Directory domain. The domain contains the servers shown in the following table.

The domain controllers are prevented from communicating to the internet. You implement Azure AD Password Protection on Server1 and Server2. You deploy a new server named Server4 that runs Windows Server 2019.

You need to ensure that Azure AD Password Protection will continue to work if a single server fails. What should you implement on Server4?

You have a Microsoft Entra tenant that contains the users shown in the following table.

The tenant has the authentication methods shown in the following table.

Which users will sign in to cloud apps by using number matching?

Your on-premises network contains an Active Directory domain that uses Microsoft Entra Connect sync to sync with a Microsoft Entra tenant.

You need to configure Microsoft Entra Connect sync to meet the following requirements:

• Microsoft Entra sign-ins must be authenticated by an Active Directory domain controller.
• Active Directory domain users must be able to use Microsoft Entra self-service password reset (SSPR).
• Minimize administrative effort.

What should you use for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 tenant. You purchase a cloud app named App1.

You need to enable real-time session-level monitoring of App1 by using Microsoft Cloud App Security.

In which order should you perform the actions? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Select and Place:

You have an Azure subscription that contains the resources shown in the following table.

You need to grant permissions to the resources by using attribute-based access control (ABAC).

To which resource can you grant permissions?

Your network contains an on-premises an Active Directory Domain Services (AD DS) domain. The domain syncs with a Microsoft 365 subscription by using Microsoft Entra Connect Sync.

You plan to create 300 new users. The details of the user accounts are saved in a Microsoft Excel spreadsheet.

You need to automate the creation of the users. The solution must meet the following requirements:

• The users must be able to access the resources in the Microsoft 365 subscription.
• The users must be able to access the resources on the on-premises network.
• Administrative effort must be minimized.

Which PowerShell cmdlets should you include in the solution?

You have a Microsoft 365 tenant.

All users have mobile phones and laptops.

The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.

You plan to implement multi-factor authentication (MFA).

Which MFA authentication method can the users use from the remote location?

You have a Microsoft Entra tenant that contains the users shown in the following table.

You add an enterprise application named App1 and configure the following Self-service settings:

• Allow users to request access to this application: Yes

• To which group should assigned users be added: Group1

• Require approval before granting access to this application: Yes

• Who is allowed to approve access to this application: User2

Which users can request access to App1?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.

You discover that users connect to unsanctioned third-party apps.

You need to automatically identify and block the use of unsanctioned apps that have a risk score of 5 or higher and generate more than 200 GB of daily traffic. The solution must minimize administrative effort.

What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not initiate. Solution: From the Azure portal, you configure the Notifications settings for multi-factor authentication (MFA). Does this meet the goal?

You work for a company named Contoso, Ltd. that has a Microsoft Entra tenant named contoso.com.

Contoso is working on a project with the following two partner companies:

• A company named

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not initiate.

Solution: From the Azure portal, you configure the Account lockout settings for multi-factor authentication (MFA). Does this meet the goal?

You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.

You plan to manage the lifecycles of the groups.

Which groups can be set to expire, and what is the shortest group lifetime you can set? To answer, select the appropriate options in the answer area.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not initiate.

Solution: From the Azure portal, you configure the Block/unblock users settings for multi-factor authentication (MFA). Does this meet the goal?

You have a Microsoft Entra tenant that contains two remote networks named RemoteNetwork1 and RemoteNetwork2 and the users shown in the following table.

You have the devices shown in the following table.

You have a Conditional Access policy that has the following settings:
o Name: CAPolicy1
o Assignments
- Users: Group1, Group2
- Target resources: All internet resources with Global Secure Access
o Access controls
- Grant: Require multifactor authentication
o Enable policy: On

Global Secure Access traffic forwarding is configured as shown in the following exhibit.

 

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 tenant.

You need to identify users who have leaked credentials. The solution must meet the following requirements:

Identify sign-ins by users who are suspected of having leaked credentials. Flag the sign-ins as a high-risk event.

Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.

What should you use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Entra tenant named contoso.com that contains a user named User1.

User1 has the devices shown in the following table:
 

On November 5, 2025, you create and enforce terms of use in contoso.com that has the following settings:

• Name: Terms1
• Display name: Contoso terms of use
• Require users to expand the terms of use: On
• Require users to consent on every device: On
• Expire consents: On
• Expire starting on: December 10, 2025
• Frequency: Monthly

On November 15, 2025, User1 accepts Terms1 on Device3.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

You plan to implement Azure AD Identity Protection.

Which users can configure the user risk policy, and which users can view the risky users report? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Entra tenant that contains the users shown in the following table.
 

Admin4 creates a Conditional Access policy named Policy1 by using the Require multifactor authentication for Azure management template.

Which users will be required to use multi-factor authentication (MFA) the next time they sign in?

You have an Azure Active Directory (Azure AD) tenant that contains an administrative unit named Department1. Department1 has the users shown in the Users exhibit. (Click the Users tab.)

Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)

Department1 has the user administrator assignments shown in the Assignments exhibit. (Click the Assignments tab.)

The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Entra tenant.

You need to use Microsoft Entra workbooks to monitor identity activity.

To what should you set Destination details in the Diagnostic settings?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant.

All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.

You need to block the users automatically when they report an MFA request that they did not initiate. Solution: From the Azure portal, you configure the Fraud alert settings for multi-factor authentication (MFA). Does this meet the goal?

You have a Microsoft Entra tenant that contains the users shown in the following table.

 

The tenant contains the Microsoft 365 groups shown in the following table.

 

You create an access review named Access1 that has the following settings:

• Select what to review: Teams + Groups
• Review scope: All Microsoft groups with guest users
• Scope: Guest users only
• Select reviewers: Users review their own access

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You need to meet the planned changes and technical requirements for App1. What should you implement?

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant. The tenant contains the users shown in the following table.

 

Sub1 contains a resource group named RG1.

The tenant contains the groups shown in the following table.

 

You deploy a virtual machine named VM1 to RG1. VM1 runs Windows Server and has Microsoft Entra login enabled.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You need to implement on-premises application and SharePoint Online restrictions to meet the authentication requirements and the access requirements. What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Entra tenant.

You need to ensure that users are prevented from consenting to high-privilege permission requests for enterprise applications. The solution must ensure that the users can consent to low-risk permission requests.

What should you modify first?

You need to configure app registration in Azure AD to meet the delegation requirements. What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Entra tenant that contains the identities shown in the following table.

You register an app named App1 in the tenant.

To which identities can you assign the Owner role for App1?

You have a Microsoft 365 tenant and an Active Directory domain named adatum.com. You deploy Azure AD Connect by using the Express Settings.

You need to configure self-service password reset (SSPR) to meet the following requirements:

When users reset their password, they must be prompted to respond to a mobile app notification or answer three predefined security questions. Passwords must be synced between the tenant and the domain regardless of where the password was reset.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have an on-premises server named Server1 that runs Windows Server.

You have a Microsoft Entra tenant that contains an app registration named App1. App1 has Microsoft Graph application permissions.

You need to configure the environment to support App1. The solution must meet the following requirements:

• App1 must be accessible only from the corporate network.
• The credentials for App1 must NOT be stored as plain text.
• Non-interactive scheduled tasks on Server1 must be able to authenticate to App1.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 tenant.

Sometimes, users use external, third-party applications that require limited access to the Microsoft 365 data of the respective user. The users register the applications in Azure Active Directory (Azure AD).

You need to receive an alert if a registered application gains read and write access to the users’ email. What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server.

You enable Microsoft Entra login for the virtual machines.

Users report that they cannot sign in to the virtual machines by using their Microsoft Entra credentials.

You need to ensure that the users can sign in to the virtual machines.

What should you do first?

You have a Microsoft 365 tenant.

The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain.

Users connect to the internet by using a hardware firewall at your company. The users authenticate to the firewall by using their Active Directory credentials. You plan to manage access to external applications by using Azure AD.

You need to use the firewall logs to create a list of unmanaged external applications and the users who access them. What should you use to gather the information?

You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a registered app named App1.

You have a partner organization that has a Microsoft Entra tenant. The tenant contains a registered app named App2.

You need to ensure that App1 can access App2.

Which two types of credentials can App1 use? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

You have an on-premises datacenter that contains the hosts shown in the following table.

You have an Azure Active Directory (Azure AD) tenant that syncs to the Active Directory forest. Multi-factor authentication (MFA) is enforced for Azure AD. You need to ensure that you can publish App1 to Azure AD users.

What should you configure on Server and Firewall1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have 2,500 users who are assigned Microsoft 365 E3 licenses. The licenses are assigned to individual users.

You assign Microsoft 365 E5 licenses to a group that includes all users.

You need to remove the Microsoft 365 E3 licenses from the users by using the least amount of administrative effort.

What should you use?

You have an Azure Active Directory (Azure AD) tenant that has the default App registrations settings. The tenant contains the users shown in the following table.

You purchase two cloud apps named App1 and App2. The global administrator registers App1 in Azure AD. You need to identify who can assign users to App1, and who can register App2 in Azure AD.

What should you identify? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains the groups shown in the following table.

Which groups can you manage by using Privileged Identity Management (PIM)?

You have a custom cloud app named App1 that is registered in Azure Active Directory (Azure AD). App1 is configured as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Entra tenant that contains 1,000 users. The users are assigned Microsoft Entra Suite licenses.

You are deploying Global Secure Access.

You need to ensure that connections to www.microsoft.com are bypassed by Global Secure Access.

Which profiles should you update?

You have an Azure Active Directory (Azure AD) tenant.

You create an enterprise application collection named HR Apps that has the following settings:

• Applications: App1, App2, App3 
• Owners: Admin1
• Users and groups: HRUsers

All three apps have the following Properties settings:

• Enabled for users to sign in: Yes 
• User assignment required: Yes Visible to users: Yes

Users report that when they go to the My Apps portal, they only see App1 and App2. You need to ensure that the users can also see App3.

What should you do from App3?

You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains three users named User1, User2 and User3.

You have the devices shown in the following table.

 

You deploy a virtual machine that has the following configurations:

• Name: VM1
• Resource group: RG1
• Operating system: Windows Server
• Login with Microsoft Entra ID: Enabled

You have the Azure role assignments shown in the following table.

 

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You have an Azure Active Directory (Azure AD) tenant. For the tenant, Users can register applications is set to No.

A user named Admin1 must deploy a new cloud app named App1.

You need to ensure that Admin1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which role should you assign to Admin1?

You have a Microsoft Entra tenant that contains the users shown in the following table.

The tenant contains the administrative units shown in the following table.

The tenant contains the groups shown in the following table.

You perform the following actions:

• Assign User1 the User Administrator role for AU2.
• Assign User3 the Groups Administrator role for AU1.
• Assign User5 the Authentication Administrator role for AU3.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 tenant that contains a group named Group1 as shown in the Group1 exhibit. (Click the Group1 tab.)

You create an enterprise application named App1 as shown in the App1 Properties exhibit. (Click the App1 Properties tab.)

You configure self-service for App1 as shown in the App1 Self-service exhibit. (Click the App1 Self-service tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Hot Area: