QUESTION NO: 1
You have a Microsoft Entra tenant that contains the identities shown in the following table.
Name
Description
User1
User account
Group1
Security group
Group2
Microsoft 365 group
SP1
Service principal
You register an app named App1 in the tenant.
To which identities can you assign the Owner role for App1?
You have a Microsoft Entra tenant that contains the identities shown in the following table.
Name
Description
User1
User account
Group1
Security group
Group2
Microsoft 365 group
SP1
Service principal
You register an app named App1 in the tenant.
To which identities can you assign the Owner role for App1?
Correct Answer: F
Vote an answer
QUESTION NO: 2
You have a Microsoft 365 tenant.
All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.
Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.
You need to block the users automatically when they report an MFA request that they did not Initiate.
Solution: From the Azure portal, you configure the Fraud alert settings for multi-factor authentication (MFA).
Does this meet the goal?
You have a Microsoft 365 tenant.
All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) when accessing Microsoft 365 services.
Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request.
You need to block the users automatically when they report an MFA request that they did not Initiate.
Solution: From the Azure portal, you configure the Fraud alert settings for multi-factor authentication (MFA).
Does this meet the goal?
Correct Answer: B
Vote an answer
Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).
QUESTION NO: 3
Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.
All the users work remotely.
Azure AD Connect is configured in Azure AD as shown in the following exhibit.
Connectivity from the on-premises domain to the internet is lost.
Which users can sign in to Azure AD?
Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.
All the users work remotely.
Azure AD Connect is configured in Azure AD as shown in the following exhibit.
Connectivity from the on-premises domain to the internet is lost.
Which users can sign in to Azure AD?
Correct Answer: C
Vote an answer
Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).
QUESTION NO: 4
You have an Azure AD tenant
You open the risk detections report.
Which risk detection type is classified as a user risk?
You have an Azure AD tenant
You open the risk detections report.
Which risk detection type is classified as a user risk?
Correct Answer: C
Vote an answer
Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).
QUESTION NO: 5
Task 3
You need to add the Linkedln application as a resource to the Sales and Marketing access package.
The solution must NOT remove any other resources from the access package.
Task 3
You need to add the Linkedln application as a resource to the Sales and Marketing access package.
The solution must NOT remove any other resources from the access package.
Correct Answer:
See the Explanation for the complete step by step solution.
Explanation:
To add the LinkedIn application as a resource to the Sales and Marketing access package without removing any other resources, you can follow these steps:
Sign in to the Microsoft Entra admin center:
Ensure you have the role of Global Administrator or Identity Governance Administrator.
Navigate to Entitlement Management:
Go to Identity governance > Entitlement management > Access packages1.
Select the Sales and Marketing access package:
Find and select the Sales and Marketing access package to modify it.
Add a new resource:
Within the access package details, select Resources.
Click on + Add resource.
Search for and select the LinkedIn application from the list of available resources.
Configure the resource role:
Assign the appropriate role for the LinkedIn application that users in the Sales and Marketing access package will have.
Review and update the access package:
Ensure that the LinkedIn application has been added as a resource.
Confirm that no other resources have been removed from the access package.
Save the changes:
After reviewing, save the changes to the access package.
Communicate the update:
Notify the relevant users about the addition of the LinkedIn application to their access package.
By following these steps, you will successfully add the LinkedIn application to the Sales and Marketing access package without affecting the other resources.
Explanation:
To add the LinkedIn application as a resource to the Sales and Marketing access package without removing any other resources, you can follow these steps:
Sign in to the Microsoft Entra admin center:
Ensure you have the role of Global Administrator or Identity Governance Administrator.
Navigate to Entitlement Management:
Go to Identity governance > Entitlement management > Access packages1.
Select the Sales and Marketing access package:
Find and select the Sales and Marketing access package to modify it.
Add a new resource:
Within the access package details, select Resources.
Click on + Add resource.
Search for and select the LinkedIn application from the list of available resources.
Configure the resource role:
Assign the appropriate role for the LinkedIn application that users in the Sales and Marketing access package will have.
Review and update the access package:
Ensure that the LinkedIn application has been added as a resource.
Confirm that no other resources have been removed from the access package.
Save the changes:
After reviewing, save the changes to the access package.
Communicate the update:
Notify the relevant users about the addition of the LinkedIn application to their access package.
By following these steps, you will successfully add the LinkedIn application to the Sales and Marketing access package without affecting the other resources.
QUESTION NO: 6
You have an Azure subscription.
Azure AD logs are sent to a Log Analytics workspace.
You need to query the logs and graphically display the number of sign-ins per user.
How should you complete the query? To answer, select the appropriate options in the answer area.
You have an Azure subscription.
Azure AD logs are sent to a Log Analytics workspace.
You need to query the logs and graphically display the number of sign-ins per user.
How should you complete the query? To answer, select the appropriate options in the answer area.
Correct Answer:
Explanation:
Box 1 =
SigninLogs
| where ResultType == 0
| summarize login_count = count() by identity
| render piechart
This query retrieves the sign-in logs, filters the successful sign-ins,summarizesthe count of sign-ins per user, and renders the result as a pie chart.
Box 2 = Render
In Microsoft Entra ID (Azure AD), the SigninLogs table in Azure Monitor Logs (Log Analytics workspace) contains data about user sign-ins. When you want to query and graphically display the number of sign-ins per user, you use Kusto Query Language (KQL) - the same language that powers Log Analytics, Azure Monitor, and Microsoft Sentinel.
The correct syntax must first aggregate the data and then visualize it:
* where ResultType == 0 filters for successful sign-ins (since 0 indicates success).
* summarize login_count = count() by Identity aggregates (counts) all sign-in events per user ( Identity field). The summarize operator in KQL is specifically used to group and aggregate data.
* render columnchart graphically displays the summarized results as a column chart. The render operator is used to visualize query output in supported formats such as timechart , piechart , or columnchart .
Therefore, the correct operators to fill in are:
* First blank: summarize
* Second blank: render
According to the Microsoft SC-300 Study Guide and Microsoft Learn module "Query and visualize sign-in logs with Kusto Query Language" , the recommended method to display sign-in frequency per user is:
"Use the summarize operator to aggregate sign-in counts by user, followed by render to visualize results."
# Final Query Answer:
SigninLogs
| where ResultType == 0
| summarize login_count = count() by Identity
| render columnchart
QUESTION NO: 7
Task 2
You need to implement a process to review guest users who have access to the Salesforce app.
The review must meet the following requirements:
* The reviews must occur monthly.
* The manager of each guest user must review the access.
* If the reviews are NOT completed within five days, access must be removed.
* If the guest user does not have a manager, Megan Bowen must review the access.
Task 2
You need to implement a process to review guest users who have access to the Salesforce app.
The review must meet the following requirements:
* The reviews must occur monthly.
* The manager of each guest user must review the access.
* If the reviews are NOT completed within five days, access must be removed.
* If the guest user does not have a manager, Megan Bowen must review the access.
Correct Answer:
See the Explanation for the complete step by step solution.
Explanation:
To implement a process for reviewing guest users' access to the Salesforce app with the specified requirements, you can use Microsoft Entra's Identity Governance access reviews feature. Here's a step-by- step guide:
Assign the appropriate role:
Ensure you have one of the following roles: Global Administrator, User Administrator, or Identity Governance Administrator1.
Navigate to Identity Governance:
Sign in to the Microsoft Entra admin center.
Go toIdentity governance > Access reviews1.
Create a new access review:
Select New access review.
Choose the Salesforce app to review guest user access1.
Configure the review settings:
Set the frequency of the review to monthly.
Define thedurationof the review period to5 days1.
Determine the reviewers:
Assign the manager of each guest user as the reviewer.
If a guest user does not have a manager, assignMegan Bowenas the reviewer1.
Automate the removal process:
Configure settings toautomatically remove accessif the review is not completed within the specified time frame1.
Monitor and enforce compliance:
Regularly check the access review results to ensure compliance with the review policy1.
Communicate the process:
Inform all stakeholders about the new review process and provide guidance on how to complete the reviews.
By following these steps, you can ensure that guest users' access to the Salesforce app is reviewed monthly, with managers being responsible for the review, and access is removed if the review is not completed in time.
Explanation:
To implement a process for reviewing guest users' access to the Salesforce app with the specified requirements, you can use Microsoft Entra's Identity Governance access reviews feature. Here's a step-by- step guide:
Assign the appropriate role:
Ensure you have one of the following roles: Global Administrator, User Administrator, or Identity Governance Administrator1.
Navigate to Identity Governance:
Sign in to the Microsoft Entra admin center.
Go toIdentity governance > Access reviews1.
Create a new access review:
Select New access review.
Choose the Salesforce app to review guest user access1.
Configure the review settings:
Set the frequency of the review to monthly.
Define thedurationof the review period to5 days1.
Determine the reviewers:
Assign the manager of each guest user as the reviewer.
If a guest user does not have a manager, assignMegan Bowenas the reviewer1.
Automate the removal process:
Configure settings toautomatically remove accessif the review is not completed within the specified time frame1.
Monitor and enforce compliance:
Regularly check the access review results to ensure compliance with the review policy1.
Communicate the process:
Inform all stakeholders about the new review process and provide guidance on how to complete the reviews.
By following these steps, you can ensure that guest users' access to the Salesforce app is reviewed monthly, with managers being responsible for the review, and access is removed if the review is not completed in time.
QUESTION NO: 8
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.
You need to enable Microsoft Defender for Cloud Apps session control for Site1.
Which type of policy should you create first?
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.
You need to enable Microsoft Defender for Cloud Apps session control for Site1.
Which type of policy should you create first?
Correct Answer: C
Vote an answer
QUESTION NO: 9
You have an Azure Active Directory (Azure AD) tenant that has the default App registrations settings. The tenant contains the users shown in the following table.
You purchase two cloud apps named App1 and App2. The global administrator registers App1 in Azure AD.
You need to identify who can assign users to App1, and who can register App2 in Azure AD.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE:Each correct selection is worth one point.
You have an Azure Active Directory (Azure AD) tenant that has the default App registrations settings. The tenant contains the users shown in the following table.
You purchase two cloud apps named App1 and App2. The global administrator registers App1 in Azure AD.
You need to identify who can assign users to App1, and who can register App2 in Azure AD.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE:Each correct selection is worth one point.
Correct Answer:
Explanation:
* Can assign users to App1: Admin1 and Admin3 only
* Can register App2 in Azure AD: Admin1, Admin2, and Admin3 only
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn module "Manage enterprise applications and app registrations" , role-based access control (RBAC) in Azure Active Directory defines what administrative actions each role can perform for applications.
1# # Assigning users to an enterprise application (App1):
The ability to assign users to enterprise apps (service principals) in Azure AD is granted to two specific roles:
* Application Administrator
* Cloud Application Administrator
These roles allow administrators to add and remove users or groups from the Users and Groups section of an enterprise app, manage application properties, and control assignments.
The Application Developer role is designed only to create and manage own app registrations , not to assign users to enterprise apps.
The User role has no administrative privileges related to app assignments.
# Therefore, only Admin1 (Application Administrator) and Admin3 (Cloud Application Administrator) can assign users to App1.
2# # Registering applications in Azure AD (App2):
By default, the App registrations setting in Azure AD allows all users to register applications. However, if the question specifies that the default settings apply (which means users can register applications ), then both admins and developers can register apps.
Microsoft documentation clarifies:
"By default, all users can register app registrations in Azure AD. Roles such as Application Developer, Application Administrator, and Cloud Application Administrator also have this capability regardless of tenant-wide settings." Therefore, the following users can register new apps:
* Admin1 (Application Administrator)
* Admin2 (Application Developer)
* Admin3 (Cloud Application Administrator)
# Correct answer for registration: Admin1, Admin2, and Admin3 only
# Final Correct Answers:
* Can assign users to App1: Admin1 and Admin3 only
* Can register App2 in Azure AD: Admin1, Admin2, and Admin3 only