Important Microsoft SC-300 Exam Questions

Answer: B

Explanation:

Conditional Access policies evaluate Assignments (users, cloud apps), optional Conditions, and then enforce Access controls. In SC-300, Terms of use (ToU) is enforced via Grant controls: the policy must ''require terms of use'' so that users must accept a specified ToU before access is granted. The documentation states that the ToU experience is applied when a policy includes the control to ''require terms of use,'' and this control lives under the Grant section (alongside controls like require MFA, require compliant device, etc.). Therefore, to deploy Terms1 with Policy1, configure the Grant controls and select Require terms of use and choose Terms1. Conditions or Session settings do not trigger ToU acceptance; they refine when or how access is permitted. Target resources select apps, but the enforcement of acceptance is strictly a Grant control.

Answer: D

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide, the enforcement of Modern Authentication for Microsoft 365 services such as Exchange Online is achieved through Conditional Access policies. Conditional Access allows you to block legacy authentication protocols (such as POP, IMAP, SMTP, and MAPI over HTTP) that use Basic Authentication, and require Modern Authentication (OAuth 2.0) instead. Microsoft Learn explains that you can configure a policy that ''blocks access requests using legacy authentication clients'' under Conditions Client apps and select ''Other clients (legacy authentication clients)'' to enforce Modern Authentication. Defender for Cloud Apps OAuth policies and Intune app/compliance policies do not control authentication protocols at the tenant level.

Answer: C

Explanation:

Microsoft Graph permissions can be of two types: Delegated and Application.

Delegated permissions require a signed-in user and can access only that user's data.

Application permissions are used by background services or daemons to access data across the organization without user consent if the app is granted admin consent.

In the scenario:

App1 (User1) uses Delegated can access only the user's data.

App2 (User2) uses Delegated and Application (Calendars.ReadWrite) can create appointments across all users. However, User2 has no role to grant consent for application-level permissions.

App3 (User3, User4) uses Application (Calendars.Read) only read, not write permissions.

Since User3 is an Exchange administrator, they have the authority to grant admin consent to an application. Although App3 only has ''Read,'' the Exchange administrator can manage calendar data organization-wide and can create appointments using Exchange management tools.

Hence, as per Microsoft's permissions model and SC-300 guidance, User3 is the only user who has both role and access capabilities to create appointments in every user's calendar.

Answer: D

Answer: C

Explanation:

Microsoft Entra certificate-based authentication (CBA) allows users to sign in with X.509 certificates. The SC-300 guidance explains that before users can authenticate with on-premises certificates, the tenant must trust the issuing Certificate Authorities: you must ''upload and configure the certificate authorities (root and any intermediates) that issue the user certificates,'' establishing the trust chain used to validate presented certificates. Only after the CA trust is configured can you map certificate fields and define authentication policies. Auto-enrollment (A) is optional operational convenience for issuing certs, not the first tenant configuration step. Azure Key Vault (B) is unrelated to validating client auth certificates. Windows Hello for Business (D) is a separate credential technology and not required for Entra CBA. Therefore, the first action is to add CA1 (and any intermediates) under Certificate Authorities in Microsoft Entra so that certificates issued by CA1 are recognized for sign-in.