20:00

PDF|

Guide for SC-300: Microsoft Identity and Access Administrator

Quiz SC-300: Microsoft Identity and Access Administrator

Free Test
/ 10

Quiz

1/10
YouhaveaMicrosoft365E5subscriptionandanAzuresubscription.YouplantoanalyzeMicrosoft
Entrasign-inlogsbyusingAzureMonitor.YouneedtoconfigurediagnosticsettingsforMicrosoftEntr
a.Whichdestinationshouldyouconfigureforthesign-inlogs?
Select the answer
1 correct answer
A.
anAzureStorageaccount
B.
anAzureSQLdatabase
C.
anAzureeventhub
D.
aLogAnalyticsworkspace

Quiz

2/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
Youneedtomeettheauthenticationrequirementsforleakedcredentials.
Whatshouldyoudo?
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-5
A.EnablefederationwithPingFederateinAzureADConnect.
B.ConfigureAzureADPasswordProtection.
C.EnablepasswordhashsynchronizationinAzureADConnect.
D.ConfigureanauthenticationmethodpolicyinAzureAD.
Select the answer
1 correct answer
InSC-300,AzureADIdentityProtectionistheprescribedcontrolto“automaticallydetectand
remediateexternallyleakedcredentials.”Thatspecificuserrisk—Leakedcredentials—relieson
Microsoftcomparingknownbreachedusername/passwordpairswithwhatAzureADcanevaluate.
ThestudymaterialsexplainthatIdentityProtection“detectsleakedcredentialswhenMicrosoftfinds
amatchwiththeuser’scurrentcredentials,”andalsonotethatpasswordhashsynchronization(PHS)
canbeenabledevenifyoursign-inmethodisPass-throughAuthenticationorfederation.Acommon
examcall-outisthatwithoutPHS,AzureADhasnohashtocompare,sotheleaked-credentialsignal
isunavailable.EnablingPHS(youcankeepPTAastheactivesign-inmethod)allowsIdentity
Protectiontoraiseuserriskandenforcepolicyactionssuchasrequirepasswordchangeorblock
access.Bycontrast,AzureADPasswordProtectionaddressesbanned/weakpasswordsatchange
time,notbreached-credentialtelemetry;federationchoices(e.g.,PingFederate)don’tdeliverthe
leaked-credentialsignal;andauthenticationmethodpolicycontrolshowusersperformMFA(e.g.,
methods)ratherthanwhetherleakedcredentialsaredetected.Therefore,tomeettherequirement
to“automaticallydetectandremediateexternallyleakedcredentials,”theminimumcorrectstepis
toenablepasswordhashsynchronizationwhileretainingPTA—exactlyasrecommendedinSC-300
guidance.

Quiz

3/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-6
YouneedtoconfiguretheMFAsettingsforuserswhoconnectfromtheBostonoffice.Thesolution
mustmeettheauthenticationrequirementsandtheaccessrequirements.
Whatshouldyouconfigure?
A.namedlocationsthathaveaprivateIPaddressrange
B.namedlocationsthathaveapublicIPaddressrange
C.trustedIPsthathaveapublicIPaddressrange
D.trustedIPsthathaveaprivateIPaddressrange
Select the answer
1 correct answer
SC-300emphasizesusingConditionalAccesswithnamedlocationstoscopeMFA—especiallyto
excludetrustedcorporateegressIPs.Thematerialsstatethatadministratorscandefinenamed
locationsbypublicIPrangesand“markthemastrusted”forpolicyexceptions.Thisalignswiththe
requirement:enforceMFAforallusers,butexemptusersauthenticatingfromtheBostonoffice.
BecauseAzureADevaluatestheclient’spublicegressaddress,privateRFC1918rangesarenever
seenbyAzureADontheinternet,sodefiningprivateIPrangeswouldnotwork.Likewise,thelegacy
“TrustedIPs”settingbelongstotheoldper-userMFAservicesettings;SC-300guidanceprefers
ConditionalAccessnamedlocationsformodernMFAdeploymentsandforcombiningwithother
conditions(apps,platforms,userrisk,locations).ImplementingtheBostonofficeasanamed
locationusingitspublicegressIPrange(s),andmarkingittrusted,letsyouexcludethatlocationfrom
thetenant-wideMFApolicywhilestillmeetingthebroaderrequirementtoenforceMFAfor
everyoneelseandforon-premappspublishedviaAzureADApplicationProxy.Inshort:define
Boston’spublicIPasanamedlocationanduseitinyourConditionalAccesspolicyexclusiontosatisfy
theexemptionpreciselyandsecurely.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-7

Quiz

4/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
YouneedtocreatetheLWGroup1grouptomeetthemanagementrequirements.
Howshouldyoucompletethedynamicmembershiprule?Toanswer,dragtheappropriatevaluesto
thecorrecttargets.Eachvaluemaybeusedonce,morethanonce,ornotatall.Youmanyneedto
dragthesplitbarbetweenpanesorscrolltoviewcontent.


NOTE:Eachcorrectselectionisworthonepoint.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 2-77759857
Select the answer
1 correct answer
AccordingtotheMicrosoftIdentityandAccessAdministrator(SC-300)ExamRefandtheAzureAD
DynamicMembershipRulesdocumentation,whenyoucreateadynamicgroupinAzureActive
Directory(nowEntraID),youdefinerulesthatautomaticallyaddorremoveusersbasedontheir
attributes.
ThescenariorequiresagroupnamedLWGroup1thatcontainsallAzureADuseraccountsforLitware
butexcludesallguestaccounts.InAzureAD,internaluserscreatedwithinthetenantaredesignated
withtheattributeuser.userType="Member",whileexternalorguestaccountsfrompartner
organizationshaveuser.userType="Guest".
Toensureonlyinternal(Litware)usersareincluded,themembershiprulemust:
Ensuretheuserobjectexists—bychecking(user.objectId-nenull)whichconfirmsthattheruleonly
appliestovaliduserobjects.
Includeonlymembers,excludingguests—byfilteringwith(user.userType-eq"Member").
Hence,thedynamicrulethatsatisfiestheseconditionsis:
(user.objectId-nenull)and(user.userType-eq"Member")
ThisruleguaranteesthatLWGroup1dynamicallyincludesallinternalusersfromlitware.comand
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-8
excludesallexternalusersorguestaccounts(suchasFabrikamusers).
ThislogicalignspreciselywiththeMicrosoftLearnmodule“ManagegroupsinAzureActive
Directory”andSC-300studyguidesection“Implementandmanagedynamicmembershiprules”,
whichstates:
“Useuser.userTypetodistinguishbetweeninternalmembersandexternalguestswhenconfiguring
membershiprulesfordynamicgroups.”
✅CorrectAnswer:
(user.objectId-nenull)and(user.userType-eq"Member")

Quiz

5/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
Youneedtoimplementpasswordrestrictionstomeettheauthenticationrequirements.
YouinstalltheAzureADpasswordProtectionDCagentonDC1.
Whatshouldyoudonext?Toanswer,selecttheappropriateoptionsintheanswerarea.


NOTE:Eachcorrectselectionisworthonepoint.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 3-2959239104
Select the answer
1 correct answer
Server1
OnDC1
AzureADPasswordProtectionhastwocomponents:theDCagent(installedondomaincontrollers)
andtheproxyservice(installedononeormorememberservers).TheSC-300materialsand
MicrosoftIdentityGovernanceguidanceexplainthattheproxyserviceisrequiredwhendomain
controllersdonothavedirectinternetaccess.Theproxyretrievesthepasswordprotectionpolicyand
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-9
custombannedpasswordlistfromAzureADoveroutboundHTTPSandmakesitavailabletoDC
agents.Thedocumentationfurtherstatesthatyoushoulddeployatleastoneproxyperforestand
twoforhighavailability,andthatdomaincontrollersdonotneedinternetconnectivitywhenaproxy
isdeployed.Inthisscenario,DCsareexplicitlyblockedfrominternetaccess,sotheproxymustbe
placedonmemberservers.BothSERVER1(ApplicationProxyconnector)andSERVER2(AzureAD
Connect)aredomain-joinedmemberserverswithinternetconnectivityandareappropriate
locationsfortheAzureADPasswordProtectionProxyservice;selectingbothprovidesthe
recommendedredundancy.ThecustombannedpasswordlistisconfiguredinAzureADatthetenant
level(aspartofAzureADPasswordProtectionsettings),notonindividualservers.Onceconfigured,
thepolicyandlistaredownloadedbytheproxyandenforcedbytheDCagentduringpasswordsetor
changeoperations,satisfyingtherequirementtoimplementabannedpasswordlistforthe
litware.comforest.

Quiz

6/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
YouneedtoconfiguretheassignmentofAzureADlicensestotheLitwareusers.Thesolutionmust
meetthelicensingrequirements.
Whatshouldyoudo?Toanswer,selecttheappropriateoptionsintheanswerarea.


NOTE:Eachcorrectselectionisworthonepoint.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 4-3442525776
Select the answer
1 correct answer
Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 5-3859588804

IntheSC-300coverageofAzureADConnectandIdentityGovernance,Microsoftexplainsthatto
surfaceacustomon-premisesattributeinAzureADyoumustenableDirectoryextensionsinAzure
ADConnect.Theguidestatesthat“Directoryextensionsletsyousynchronizeadditionalattributes
fromon-premisesActiveDirectorytoAzureADsotheyareavailableintheclouddirectoryforapps
andpolicy.”Thisisthesupportedwaytobringacustomattribute(here,LWLicenses)fromthe
litware.comforestintoAzureADsoitcanbereferencedbycloudfeaturessuchasdynamicgroup
rules.DomainfilteringoroptionalfeaturesdonotexposeanewattributetoAzureAD;directory
extensionsdoes.
Forlicenseautomation,theSC-300materialsongroup-basedlicensinganddynamicgroups
emphasizethat“licensescanbeassignedtoAzureADgroups;groupmemberstheninheritthe
licenses,andwhenmembershipchanges,licensesareaddedorremovedautomatically.”They
furthernotethat“dynamicusergroupsevaluaterulesagainstuserattributestoaddorremoveusers
withoutmanualeffort,”andthat“nestedgroupsarenotsupportedforlicenseinheritance—only
directmembersreceivelicenses.”UsingthesyncedLWLicensesattributeinaDynamicUsergroup
rule(forexample,user.extensionAttribute…-eq"E5")ensuresusersareautomaticallyaddedtothe
correctgroupandthereforereceivethespecifiedlicenseswithoutadministrativeintervention,fully
meetingLitware’srequirementto“managetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.”

Quiz

7/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
Youneedtoidentifywhichrolestouseformanagingroleassignments.Thesolutionmustmeetthe
delegationrequirements.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-11
Whatshouldyoudo?Toanswer,selecttheappropriateoptionsintheanswerarea.


NOTE:Eachcorrectselectionisworthonepoint.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 6-2357991204
Select the answer
1 correct answer
[http://www.justcerts.com](http://www.justcerts.com)


Questions&AnswersPDF P-12

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 7-2913865059

AccordingtotheMicrosoftSC-300:IdentityandAccessAdministratorStudyGuideandMicrosoft
Learnmodules“ImplementandmanageAzureADroles”and“ImplementPrivilegedIdentity
Management(PIM)”,thereisacleardistinctionbetweenAzureADbuilt-inrolesandAzure(resource-
based)built-inroles.
AzureADbuilt-inrolesgoverndirectory-levelaccess—suchasmanagingusers,groups,enterprise
apps,orsecuritysettingsinAzureActiveDirectory(EntraID).
ThePrivilegedRoleAdministratorroleallowstheusertomanageroleassignmentsfordirectoryroles
inAzureAD,includingactivatingrolesthroughPIM.
TheGlobalAdministratoralsohasthiscapability,butthePrivilegedRoleAdministratoristheleast
privilegerolethatmeetsthedelegationrequirement—aligningwiththeprincipleofleastprivilege
statedinthescenario.
Asthedocumentationnotes:
“PrivilegedRoleAdministratormanagesroleassignmentsinAzureAD,includingtheabilityto
activateandassignrolesthroughAzureADPrivilegedIdentityManagement.”
Azurebuilt-inroles,ontheotherhand,areusedtocontrolaccessattheAzureresourcelevel—for
subscriptions,resourcegroups,andindividualresources.
TheroleresponsibleformanagingtheseassignmentsistheUserAccessAdministrator.
ThisrolecangrantorrevokeaccesstoAzureresourcesbymanagingroleassignmentswithinAzure
RBAC(Role-BasedAccessControl).
TheMicrosoftdocumentationstates:
“UserAccessAdministratorallowsmanagementofuseraccesstoAzureresources.Itcanassignroles
inAzureRBACforresources,subscriptions,andmanagementgroups.”
Therefore:
✅TomanageAzureADbuilt-inroleassignments→Privilegedroleadministrator
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-13
✅TomanageAzurebuilt-inroleassignments→Useraccessadministrator
Thisapproachsatisfiesthedelegationrequirementmentionedinthescenariobyassigningtheleast-
privilegedrolesnecessaryforeachtypeofrolemanagementtask.

Quiz

8/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
Youneedtoimplementon-premisesapplicationandSharePointOnlinerestrictionstomeetthe
authenticationrequirementsandtheaccessrequirements.
Whatshouldyoudo?Toanswer,selecttheappropriateoptionsintheanswerarea.


NOTE:Eachcorrectselectionisworthonepoint.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 8-1432072788
Select the answer
1 correct answer
[http://www.justcerts.com](http://www.justcerts.com)


Questions&AnswersPDF P-14

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 9-3296824920

SC-300materialsstressthattoenforcemoderncontrols(likeMFA)onon-premisesapps,youmust
frontthemwithAzureADsoConditionalAccesscanevaluatesign-ins.Thedocumentationstatesthat
AzureADApplicationProxy“providessecureremoteaccesstoon-premisesapplications”andthat
appspublishedthroughitcanhave“ConditionalAccesspolicies,includingmultifactor
authentication”appliedatsign-in.Inotherwords,oncethelegacyappispublishedbyApplication
Proxy,AzureADsitsinthepath,enablingyoutomeettherequirementtoenforceMFAwhen
accessingon-premisesapplicationsandtocombineitwithyourlocation-basedexemptions.
ForSharePointOnlinerestrictions,SC-300pointstoMicrosoftCloudAppSecurity(DefenderforCloud
Apps)forreal-timegovernance:youcancreatesessionpoliciesthat“controlandlimitactivitiesin
realtime”and,forSharePointOnlineandotherMicrosoft365apps,“monitorusersessionsandblock
download,cut,copy,andprint”whenconditions(devicestate,risk,orlocation)warrantit.Sincethe
scenarioalreadyhasanomalydetectionsenabled,configuringCloudAppSecuritypoliciesaligns
directlywiththerequirementtoplaceaccessrestrictionsonSharePointOnlinewithoutaltering
tenant-wideconsentsettings.Thus,publishon-premappswithApplicationProxytobringthem
underConditionalAccess(forMFA),anduseCloudAppSecuritypoliciestoenforceSharePoint
Onlinesessionanddownloadcontrols.

Quiz

9/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-15
Youneedtoconfigurethedetectionofmulti-stagedattackstomeetthemonitoringrequirements.
Whatshouldyoudo?
A.CustomizetheAzureSentinelrulelogic.
B.Createaworkbook.
C.AddAzureSentineldataconnectors.
D.AddanAzureSentinelplaybook.
Select the answer
1 correct answer
A.
AccordingtotheMicrosoftSC-300:IdentityandAccessAdministratorStudyGuideandtheMicrosoft
Learnmodule“MonitorandrespondtoAzureADeventswithAzureSentinel”,multi-stagedattacks
areadvancedthreatscenariosthatrequirecorrelationofmultipleevents—forexample,asuspicious
sign-infollowedbyabnormalOffice365activity.
Thescenariointhequestionstates:
“LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedattacksthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.”
AzureSentinel’sFusionruleisabuilt-in,machine-learning–drivencorrelationrulethatautomatically
detectsmulti-stageattacksbyanalyzinganomaliesacrossmultipledatasourcessuchasAzureAD
sign-inlogs,Office365activity,andsecurityalerts.
However,tofine-tunedetectionormeetspecificorganizationalmonitoringrequirements,
administratorscancustomizetherulelogicinSentinelanalytics.Thisallowsyoutodefinehow
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-16
differentsignalsandeventsarecorrelated,whatthresholdstriggeranalert,andhowSentinel
interpretscombinedanomalies.
Microsoftdocumentationstates:
“Fusionusescorrelationlogicinanalyticsrulestodetectcomplexmulti-stageattacks.Administrators
cancustomizerulelogictomeetspecificdetectionrequirementsandfine-tunealertsensitivity.”
Theotheroptionsdonotmeettherequirement:
B.
Createaworkbook→Usedforvisualizationandreporting,notdetection.
C.
Adddataconnectors→Usedtoingestdatasources;thisisalreadyconfigured.
D.
Addaplaybook→Usedforautomatedresponse,notfordetectionlogicconfiguration.
✅CorrectAnswer:A.CustomizetheAzureSentinelrulelogic

Quiz

10/10
Topic1,Litware,Inc
Overview
Litware,Inc.isapharmaceuticalcompanythathasasubsidiarynamedfabrikam,inc
LitwarehasofficesinBostonandSeattle,buthasemployeeslocatedacrosstheUnitedStates.
EmployeesconnectremotelytoeitherofficebyusingaVPNconnection.
IdentityEnvironment
ThenetworkcontainsanActiveDirectoryforestnamedlitware.comthatislinkedtoanAzureActive
Directory(AzureAD)tenantnamedlitware.com.AzureADConnectusespass-throughauthentication
andhaspasswordhashsynchronizationdisabled.
Litware.comcontainsausernamedUser1whooverseesallapplicationdevelopment.Litware
implementsAzureADApplicationProxy.
FabrikamhasanAzureADtenantnamedfabrikam.com.TheusersatFabrikamaccesstheresources
inlitware.combyusingguestaccountsinthelitware.comtenant.
CloudEnvironment
AlltheusersatLitwarehaveMicrosoft365EnterpriseE5licenses.Allthebuilt-inanomalydetection
policesinMicrosoftCloudAppSecurityareenabled.
LitwarehasanAzuresubscriptionassociatedtothelitware.comAzureADtenant.Thesubscription
containsanAzureSentinelinstancethatusestheAzureActiveDirectoryconnectorandtheOffice365
connector.AzureSentinelcurrentlycollectstheAzureADsign-inslogsandauditlogs.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
On-premisesEnvironment


Theon-premisesnetworkcontainstheseversshowninthefollowingtable.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 1-2216622609

BothLitwareofficesconnectdirectlytotheinternet.Bothofficesconnecttovirtualnetworksinthe
Azuresubscriptionbyusingasite-to-siteVPNconnection.Allon-premisesdomaincontrollersare
preventedfromaccessingtheinternet.
DelegationRequirements
Litwareidentifiesthefollowingdelegationrequirements:
*DelegatethemanagementofprivilegedrolesbyusingAzureADPrivilegedIdentityManagement
(PIM).
*Preventnonprivilegedusersfromregisteringapplicationsinthelitware.comAzureADtenant-
*UsecustomcatalogsandcustomprogramsforIdentityGovernance.
*EnsurethatUser1cancreateenterpriseapplicationsinAzureAD.Usetheprincipleofleast
privilege.
LicensingRequirements
LitwarerecentlyaddedacustomuserattributenamedLWLicensestothelitware.comActive
Directoryforest.LitwarewantstomanagetheassignmentofAzureADlicensesbymodifyingthe
valueoftheLWLicensesattribute.UserswhohavetheappropriatevalueforLWLicensesmustbe
addedautomaticallytoMicrosoft365groupthatheappropriatelicenseassigned.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
ManagementRequirement
LitwarewantstocreateagroupnamedLWGroup1willcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
AuthenticationRequirements
Litwareidentifiesthefollowingauthenticationrequirements:
•Implementmulti-factorauthentication(MFA)forallLitwareusers.
•ExemptusersfromusingMFAtoauthenticatetoAzureADfromtheBostonofficeofLitware.
•Implementabannedpasswordlistforthelitware.comforest.
•EnforceMFAwhenaccessingon-premisesapplications.
•Automaticallydetectandremediateexternallyleakedcredentials
AccessRequirements
LitwarewantstocreateagroupnamedLWGroup1thatwillcontainalltheAzureADuseraccountsfor
LitwarebutexcludealltheAzureADguestaccounts.
MonitoringRequirements
LitwarewantstousetheFusionruleinAzureSentineltodetectmulti-stagedthatincludea
combinationofsuspiciousAzureADsign-insfollowedbyanomalousMicrosoftOffice365activity.
YouneedtoconfigureappregistrationinAzureADtomeetthedelegationrequirements.
Whatshouldyoudo?Toanswer,selecttheappropriateoptionsintheanswerarea.


NOTE:Eachcorrectselectionisworthonepoint.

Certification Exam SC-300: Microsoft Identity and Access Administrator Microsoft Microsoft-SC-300 10-262485444

[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-17
Select the answer
1 correct answer
Looking for more questions?Buy now

SC-300: Microsoft Identity and Access Administrator Practice test unlocks all online simulator questions

Thank you for choosing the free version of the SC-300: Microsoft Identity and Access Administrator practice test! Further deepen your knowledge on Microsoft Simulator; by unlocking the full version of our SC-300: Microsoft Identity and Access Administrator Simulator you will be able to take tests with over 343 constantly updated questions and easily pass your exam. 98% of people pass the exam in the first attempt after preparing with our 343 questions.

BUY NOW

What to expect from our SC-300: Microsoft Identity and Access Administrator practice tests and how to prepare for any exam?

The SC-300: Microsoft Identity and Access Administrator Simulator Practice Tests are part of the Microsoft Database and are the best way to prepare for any SC-300: Microsoft Identity and Access Administrator exam. The SC-300: Microsoft Identity and Access Administrator practice tests consist of 343 questions and are written by experts to help you and prepare you to pass the exam on the first attempt. The SC-300: Microsoft Identity and Access Administrator database includes questions from previous and other exams, which means you will be able to practice simulating past and future questions. Preparation with SC-300: Microsoft Identity and Access Administrator Simulator will also give you an idea of the time it will take to complete each section of the SC-300: Microsoft Identity and Access Administrator practice test . It is important to note that the SC-300: Microsoft Identity and Access Administrator Simulator does not replace the classic SC-300: Microsoft Identity and Access Administrator study guides; however, the Simulator provides valuable insights into what to expect and how much work needs to be done to prepare for the SC-300: Microsoft Identity and Access Administrator exam.

BUY NOW

SC-300: Microsoft Identity and Access Administrator Practice test therefore represents an excellent tool to prepare for the actual exam together with our Microsoft practice test . Our SC-300: Microsoft Identity and Access Administrator Simulator will help you assess your level of preparation and understand your strengths and weaknesses. Below you can read all the quizzes you will find in our SC-300: Microsoft Identity and Access Administrator Simulator and how our unique SC-300: Microsoft Identity and Access Administrator Database made up of real questions:

Info quiz:

  • Quiz name:SC-300: Microsoft Identity and Access Administrator
  • Total number of questions:343
  • Number of questions for the test:50
  • Pass score:80%

You can prepare for the SC-300: Microsoft Identity and Access Administrator exams with our mobile app. It is very easy to use and even works offline in case of network failure, with all the functions you need to study and practice with our SC-300: Microsoft Identity and Access Administrator Simulator.

Use our Mobile App, available for both Android and iOS devices, with our SC-300: Microsoft Identity and Access Administrator Simulator . You can use it anywhere and always remember that our mobile app is free and available on all stores.

Our Mobile App contains all SC-300: Microsoft Identity and Access Administrator practice tests which consist of 343 questions and also provide study material to pass the final SC-300: Microsoft Identity and Access Administrator exam with guaranteed success. Our SC-300: Microsoft Identity and Access Administrator database contain hundreds of questions and Microsoft Tests related to SC-300: Microsoft Identity and Access Administrator Exam. This way you can practice anywhere you want, even offline without the internet.

BUY NOW