Microsoft Identity and Access Administrator: SC-300 Exam Premium File as PDF & Test Engine

You have an Azure Active Directory (Azure AD) tenant named conto.so.com that has Azure AD Identity Protection enabled. You need to Implement a sign-in risk remediation policy without blocking access.
What should you do first?

• A. implement multi-factor authentication (MFA) for all users.
• B. Enforce Azure AD Password Protection.
• C. Configure self-service password reset (SSPR) for all users.
• D. Configure access reviews in Azure AD.

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant. You need to ensure that user authentication always occurs by validating passwords against the AD DS domain. What should you configure, and what should you use? To answer, select the appropriate options in the answer area. NOTE: Each coned selection is worth one point.

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module "Implement and Manage Microsoft Entra Connect" , when organizations need authentication to always validate user passwords directly against the on-premises Active Directory Domain Services (AD DS) environment, the correct configuration is Pass-through Authentication (PTA).
Here's why:
* Pass-through Authentication (PTA) ensures that when a user attempts to sign in to Microsoft Entra ID (formerly Azure AD), their credentials are not validated in the cloud. Instead, the authentication request is securely passed to an on-premises authentication agent, which validates the credentials against the on- premises AD DS domain controller in real time.
* This configuration provides an immediate reflection of on-premises account states - if an account is disabled, locked, or the password is changed, those changes take effect instantly for cloud authentication as well.
To configure PTA, you must use Microsoft Entra Connect, which is the hybrid identity synchronization tool that links on-premises directories to Microsoft Entra ID. During Entra Connect setup, administrators can choose between Password Hash Synchronization, Pass-through Authentication, or Federation as the sign-in method.
Microsoft documentation explicitly states:
"Pass-through Authentication allows users to sign in to both on-premises and cloud-based applications using the same passwords. Authentication occurs against your on-premises Active Directory." Therefore, to meet the requirement that authentication always validates passwords against the on-premises AD DS domain:

You have an Azure AD tenant named contoso.com that contains a group named All Company and has the following Identity Governance settings:
* Block external users from signing in to this directory: Yes
* Remove external user Yes
* Number of days before removing external user from this directory: 30
On March 1, 2022, you create an access package named Package1 that has the following settings:
* Resource roles
o Name: All Company
o Type: Group and Team
o Role: Member
* Lifecycle
o Access package assignment expire: On date
o Assignment expiration date: April 1, 2022
On March 1, 2022, you assign Package1 to the guest users shown in the following table.

On March 2, 2022, you assign the Reports reader role to Guest1.
On April 1(2022, you invite a guest user named Guest3 to contoso.com.
On April 4, 2022, you add Guest3 to the All Company group.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:

In Azure AD Entitlement Management , the tenant-level lifecycle settings govern what happens to external users when their last access package assignment ends. The SC-300 materials explain that when "Block external users from signing in to this directory = Yes," a guest whose final assignment expires or is removed is immediately blocked from sign-in to the resource directory. With "Remove external user = Yes" and a configured period (here 30 days ), the guest account is deleted from the directory after that interval provided the user has no other active access package assignments . These lifecycle actions are tied to access package assignments , not to unrelated memberships or role grants that were not delivered via entitlement management.
Applying the timelines: Guest1 and Guest2 received Package1 on Mar 1 with an assignment expiration of Apr 1 . On Apr 1 , their last assignment ended, so they were blocked the same day, and then removed after
30 days -on or about May 1 . Therefore, on May 5 , neither Guest1 nor Guest2 remains in the directory .
The fact that Guest1 was granted a Reports reader role on Mar 2 does not prevent lifecycle removal because it is not an access package assignment . Guest3 , however, was invited on Apr 1 and added to the All Company group on Apr 4 outside of entitlement management; since there was no access package assignment to expire , the lifecycle removal policy does not apply , so Guest3 is still present on May 5 .

You have 2,500 users who are assigned Microsoft 365 E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Microsoft Entra admin center, you assign Microsoft 365 E5 licenses to a group that includes all users. You need to remove the Microsoft 365 E3 licenses from the users by using the least amount of administrative effort What should you use?

• A. the Licensing node in the Microsoft 365 admin center
• B. the Licenses blade in the Microsoft Entra admin center
• C. the Identity Governance blade in the Microsoft Entra admin center
• D. the Set-WindowsProductKey cmdlet

You have an Azure subscription that contains an Azure SQL database named db1.
You deploy an Azure App Service web app named App1 that provide product information to users that connect to App1 anonymously.
You need to provide App1 with Access to db1. The solution must meet the following requirements:
* Credentials must only be available to App1.
* Administrative effort must be minimized.
Which type of credentials should you use?

• A. an Azure AD user account
• B. a user-assigned managed identity
• C. a system-assigned managed identity
• D. A SQL Server account

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).