McAfee Secure

Microsoft SC-300 Bundle

Exam Code: SC-300

Exam Name Microsoft Identity and Access Administrator

Certification Provider: Microsoft

Corresponding Certification: Microsoft Certified: Identity and Access Administrator Associate

Microsoft SC-300 Bundle $44.99
SC-300 Sample 1 SC-300 Sample 2 SC-300 Sample 3 SC-300 Sample 4 SC-300 Sample 5 SC-300 Sample 6 SC-300 Sample 7 SC-300 Sample 8 SC-300 Sample 9 SC-300 Sample 10

100% Microsoft SC-300 Guaranteed Success With Testking Training Materials

Get Real SC-300 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    SC-300 Questions & Answers

    490 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual SC-300 exam while allowing you to hone and measure every aspect of your test-taking ability.

  • SC-300 Video Course

    SC-300 Training Course

    43 Video Lectures

    SC-300 Video Course is developed by Microsoft Professionals to help you pass the SC-300 exam.

    Description

    This course will improve your knowledge and skills required to pass Microsoft Identity and Access Administrator exam.
  • Study Guide

    SC-300 Study Guide

    599 PDF Pages

    Developed by industry experts, this 599-page guide spells out in painstaking detail all of the information you need to ace SC-300 exam.

Microsoft Identity and Access Administrator (SC-300) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    490 Questions

    $124.99
  • SC-300 Video Course

    Training Course

    43 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    599 PDF Pages

    $29.99

Microsoft SC-300 Practice Test 20

Question 190

An identity engineer has two independent tasks. Task 1: A finance SaaS app must be available only after phishing-resistant authentication, while ordinary apps retain existing authentication requirements. Task 2: A company wants to prevent unmanaged browsers from downloading sensitive files while allowing browser viewing. Which TWO configuration changes jointly meet both tasks?

  1. Use authentication context on the protected resource and target a corresponding Conditional Access policy with the required controls
  2. Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control
  3. Create a policy from a Microsoft-provided template, review each inclusion/exclusion/grant control, and pilot it in report-only mode
  4. Set the Conditional Access grant control operator to Require all selected controls for the scoped policy
  5. Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route

Explanation

Correct Answers

B:

Correct for task 1. Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control. This directly addresses the first requirement: A finance SaaS app must be available only after phishing-resistant authentication, while ordinary apps retain existing authentication requirements. Verify it by checking: A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected.

E:

Correct for task 2. Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route. This addresses the independent second requirement: A company wants to prevent unmanaged browsers from downloading sensitive files while allowing browser viewing. Verify it by checking: An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control.

Incorrect Answers

A:

The sensitive library was never tagged with the authentication context used by the policy. To satisfy task 1, use: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control. For task 2, use: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route.

C:

The template was enabled without checking who or what it includes and excludes. To satisfy task 1, use: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control. For task 2, use: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route.

D:

Grant controls use Require one of the selected controls instead of Require all. To satisfy task 1, use: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control. For task 2, use: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route.

Question 191

The owner wants independent acceptance evidence after the team chose: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control. It was meant to solve: A finance SaaS app must be available only after phishing-resistant authentication, while ordinary apps retain existing authentication requirements. Which result demonstrates success?

  1. The selected foreign sign-in triggers the configured control while approved emergency access remains possible
  2. A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected
  3. Supported sign-ins show evaluated Report-only results in the sign-in details while the pilot policy itself never blocks the sign-in
  4. Employee and guest pilot accounts receive their respective intended grants or blocks on the target app

Explanation

Correct Answer

B:

Correct acceptance check. A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if building a named-location-based Conditional Access policy with the intended user/app assignments succeeds, this does not prove the required identity-control outcome. The decisive check is: A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected.

C:

Even if setting the proposed Conditional Access policy to Report-only succeeds, this does not prove the required identity-control outcome. The decisive check is: A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected.

D:

Even if scoping Conditional Access user succeeds, this does not prove the required identity-control outcome. The decisive check is: A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected.

Question 192

The deployment owner asks why this identity requirement failed: A finance SaaS app must be available only after phishing-resistant authentication, while ordinary apps retain existing authentication requirements. The test shows: Users of unrelated apps suddenly encounter finance-only strong authentication requirements. Which fault is the best diagnosis?

  1. The protected action was not associated with its intended authentication context
  2. The client-app condition wasn't set to include the targeted legacy authentication traffic
  3. The sensitive library was never tagged with the authentication context used by the policy
  4. The policy targets All cloud apps instead of the identified finance application

Explanation

Correct Answer

D:

Correct diagnosis. The policy targets All cloud apps instead of the identified finance application. This fault explains the observed failure: Users of unrelated apps suddenly encounter finance-only strong authentication requirements. The intended configuration would instead be: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control.

Incorrect Answers

A:

The protected action was not associated with its intended authentication context. The reported symptom instead has this cause: The policy targets All cloud apps instead of the identified finance application. The corrective action is: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control.

B:

The client-app condition wasn't set to include the targeted legacy authentication traffic. The reported symptom instead has this cause: The policy targets All cloud apps instead of the identified finance application. The corrective action is: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control.

C:

The sensitive library was never tagged with the authentication context used by the policy. The reported symptom instead has this cause: The policy targets All cloud apps instead of the identified finance application. The corrective action is: Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control.

Question 193

Select the most appropriate first configuration decision for this scenario: A company plans to block legacy authentication to Exchange Online without blocking modern protocol clients.

  1. Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing
  2. Set the proposed Conditional Access policy to Report-only, run representative actual sign-ins, and inspect report-only results plus What If predictions before separately enabling enforcement
  3. Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control
  4. Build a named-location-based Conditional Access policy with the intended user/app assignments and emergency account exclusion

Explanation

Correct Answer

A:

Correct implementation. Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing. It meets the stated requirement: A company plans to block legacy authentication to Exchange Online without blocking modern protocol clients. Acceptance evidence is: A legacy-protocol sign-in is blocked and a modern supported client remains permitted.

Incorrect Answers

B:

The policy was switched On instead of kept Report-only, making the pilot a live enforcement path. That condition is not the problem here: The client-app condition wasn't set to include the targeted legacy authentication traffic. The targeted implementation is: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

C:

The policy targets All cloud apps instead of the identified finance application. That condition is not the problem here: The client-app condition wasn't set to include the targeted legacy authentication traffic. The targeted implementation is: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

D:

An emergency account was included by the all-users assignment without a specific exclusion. That condition is not the problem here: The client-app condition wasn't set to include the targeted legacy authentication traffic. The targeted implementation is: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

Question 194

An operational review checks whether the change “Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing” meets this need: A company plans to block legacy authentication to Exchange Online without blocking modern protocol clients. Which finding supports acceptance?

  1. A legacy-protocol sign-in is blocked and a modern supported client remains permitted
  2. A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected
  3. A pilot sign-in meeting both controls succeeds while a test meeting only one is denied
  4. An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control

Explanation

Correct Answer

A:

Correct acceptance check. A legacy-protocol sign-in is blocked and a modern supported client remains permitted. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

B:

Even if creating a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control succeeds, this does not prove the required identity-control outcome. The decisive check is: A legacy-protocol sign-in is blocked and a modern supported client remains permitted.

C:

Even if setting the Conditional Access grant control operator to Require all selected controls for the scoped policy succeeds, this does not prove the required identity-control outcome. The decisive check is: A legacy-protocol sign-in is blocked and a modern supported client remains permitted.

D:

Even if using Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy succeeds, this does not prove the required identity-control outcome. The decisive check is: A legacy-protocol sign-in is blocked and a modern supported client remains permitted.

Question 195

The deployment was intended to satisfy: A company plans to block legacy authentication to Exchange Online without blocking modern protocol clients. During testing, this happened: Legacy basic-auth attempts continue to authenticate despite the new policy. Which configuration defect best explains the failure?

  1. The client-app condition wasn't set to include the targeted legacy authentication traffic
  2. The policy was switched On instead of kept Report-only, making the pilot a live enforcement path
  3. The sensitive library was never tagged with the authentication context used by the policy
  4. The policy targets All cloud apps instead of the identified finance application

Explanation

Correct Answer

A:

Correct diagnosis. The client-app condition wasn't set to include the targeted legacy authentication traffic. This fault explains the observed failure: Legacy basic-auth attempts continue to authenticate despite the new policy. The intended configuration would instead be: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

Incorrect Answers

B:

The policy was switched On instead of kept Report-only, making the pilot a live enforcement path. The reported symptom instead has this cause: The client-app condition wasn't set to include the targeted legacy authentication traffic. The corrective action is: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

C:

The sensitive library was never tagged with the authentication context used by the policy. The reported symptom instead has this cause: The client-app condition wasn't set to include the targeted legacy authentication traffic. The corrective action is: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

D:

The policy targets All cloud apps instead of the identified finance application. The reported symptom instead has this cause: The client-app condition wasn't set to include the targeted legacy authentication traffic. The corrective action is: Create the appropriate Conditional Access legacy-client policy with scoped app/user assignments and test in report-only mode before enforcing.

Question 196

The security architect is given this constraint: Admins should gain access to a sensitive Azure portal only from devices marked compliant by endpoint management. Which technical approach meets it without relying on unrelated controls?

  1. Configure protected actions that require the appropriate Conditional Access authentication context for supported directory operations
  2. Set the proposed Conditional Access policy to Report-only, run representative actual sign-ins, and inspect report-only results plus What If predictions before separately enabling enforcement
  3. Set the Conditional Access grant control operator to Require all selected controls for the scoped policy
  4. Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users

Explanation

Correct Answer

D:

Correct implementation. Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users. It meets the stated requirement: Admins should gain access to a sensitive Azure portal only from devices marked compliant by endpoint management. Acceptance evidence is: A compliant managed device succeeds while a noncompliant test device is denied at the intended app.

Incorrect Answers

A:

The protected action was not associated with its intended authentication context. That condition is not the problem here: The Conditional Access policy checks MFA instead of the device-compliance grant requirement. The targeted implementation is: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

B:

The policy was switched On instead of kept Report-only, making the pilot a live enforcement path. That condition is not the problem here: The Conditional Access policy checks MFA instead of the device-compliance grant requirement. The targeted implementation is: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

C:

Grant controls use Require one of the selected controls instead of Require all. That condition is not the problem here: The Conditional Access policy checks MFA instead of the device-compliance grant requirement. The targeted implementation is: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

Question 197

After a deployment under this requirement — Admins should gain access to a sensitive Azure portal only from devices marked compliant by endpoint management — administrators claim the following solution is in place: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users. Which pilot finding supports that claim?

  1. Access to the marked sensitive resource triggers the stronger context policy while ordinary files do not
  2. A qualifying sensitive operation invokes the required context; routine unrelated admin actions follow their existing policies
  3. A compliant managed device succeeds while a noncompliant test device is denied at the intended app
  4. A finance-app sign-in with an approved strong credential succeeds and SMS-only sign-in is denied, while an unrelated app is unaffected

Explanation

Correct Answer

C:

Correct acceptance check. A compliant managed device succeeds while a noncompliant test device is denied at the intended app. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if using authentication context on the protected resource succeeds, this does not prove the required identity-control outcome. The decisive check is: A compliant managed device succeeds while a noncompliant test device is denied at the intended app.

B:

Even if configuring protected actions that require the appropriate Conditional Access authentication context for supported directory operations succeeds, this does not prove the required identity-control outcome. The decisive check is: A compliant managed device succeeds while a noncompliant test device is denied at the intended app.

D:

Even if creating a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control succeeds, this does not prove the required identity-control outcome. The decisive check is: A compliant managed device succeeds while a noncompliant test device is denied at the intended app.

Question 198

An engineer troubleshoots an identity solution for: Admins should gain access to a sensitive Azure portal only from devices marked compliant by endpoint management. The pilot result is: An unmanaged noncompliant device with MFA alone gains entry to the restricted portal. What is the most likely relevant fault?

  1. The app or client is not in the enforcement-capable session path, or an app-enforced control was configured for an unsupported resource
  2. The template was enabled without checking who or what it includes and excludes
  3. The Conditional Access policy checks MFA instead of the device-compliance grant requirement
  4. The reviewer tests What If with a different cloud app or user context than the failed sign-in

Explanation

Correct Answer

C:

Correct diagnosis. The Conditional Access policy checks MFA instead of the device-compliance grant requirement. This fault explains the observed failure: An unmanaged noncompliant device with MFA alone gains entry to the restricted portal. The intended configuration would instead be: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

Incorrect Answers

A:

The app or client is not in the enforcement-capable session path, or an app-enforced control was configured for an unsupported resource. The reported symptom instead has this cause: The Conditional Access policy checks MFA instead of the device-compliance grant requirement. The corrective action is: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

B:

The template was enabled without checking who or what it includes and excludes. The reported symptom instead has this cause: The Conditional Access policy checks MFA instead of the device-compliance grant requirement. The corrective action is: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

D:

The reviewer tests What If with a different cloud app or user context than the failed sign-in. The reported symptom instead has this cause: The Conditional Access policy checks MFA instead of the device-compliance grant requirement. The corrective action is: Configure a Conditional Access grant control requiring device compliance for the scoped portal/application and users.

Question 199

Which implementation fits the following specific identity problem? A company wants to prevent unmanaged browsers from downloading sensitive files while allowing browser viewing.

  1. Create a scoped Conditional Access policy for the finance application with a phishing-resistant authentication strength grant control
  2. Use authentication context on the protected resource and target a corresponding Conditional Access policy with the required controls
  3. Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route
  4. Build a named-location-based Conditional Access policy with the intended user/app assignments and emergency account exclusion

Explanation

Correct Answer

C:

Correct implementation. Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route. It meets the stated requirement: A company wants to prevent unmanaged browsers from downloading sensitive files while allowing browser viewing. Acceptance evidence is: An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control.

Incorrect Answers

A:

The policy targets All cloud apps instead of the identified finance application. That condition is not the problem here: The app or client is not in the enforcement-capable session path, or an app-enforced control was configured for an unsupported resource. The targeted implementation is: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route.

B:

The sensitive library was never tagged with the authentication context used by the policy. That condition is not the problem here: The app or client is not in the enforcement-capable session path, or an app-enforced control was configured for an unsupported resource. The targeted implementation is: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route.

D:

An emergency account was included by the all-users assignment without a specific exclusion. That condition is not the problem here: The app or client is not in the enforcement-capable session path, or an app-enforced control was configured for an unsupported resource. The targeted implementation is: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route.

Question 200

The team implemented the following change: Use Conditional Access app-enforced restrictions for supported SharePoint Online/Exchange Online experiences or a compatible Defender for Cloud Apps Conditional Access App Control session policy, testing the actual unmanaged-browser route. The acceptance requirement was: A company wants to prevent unmanaged browsers from downloading sensitive files while allowing browser viewing. Which observed outcome most directly proves the change works?

  1. A qualifying user-disable event triggers a supported CAE resource denial within its documented latency, without claiming real-time enforcement for every client, guest or policy change
  2. An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control
  3. Access to the marked sensitive resource triggers the stronger context policy while ordinary files do not
  4. A legacy-protocol sign-in is blocked and a modern supported client remains permitted

Explanation

Correct Answer

B:

Correct acceptance check. An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control. This tests the intended access or synchronization boundary instead of merely checking that a setting exists.

Incorrect Answers

A:

Even if validating supported CAE-aware clients succeeds, this does not prove the required identity-control outcome. The decisive check is: An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control.

C:

Even if using authentication context on the protected resource succeeds, this does not prove the required identity-control outcome. The decisive check is: An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control.

D:

Even if creating the appropriate Conditional Access legacy-client policy with scoped app/user assignments succeeds, this does not prove the required identity-control outcome. The decisive check is: An unmanaged pilot browser can view an allowed supported document but the scoped download is blocked by the actual app-enforced or monitored session control.