[Dec 02, 2025] Lesson Brilliant PDF for the SC-300 Tests Free Updated Today [Q143-Q163]

[Dec 02, 2025] Lesson Brilliant PDF for the SC-300 Tests Free Updated Today

Get New 2025 Valid Practice Microsoft Certified: Identity and Access Administrator Associate SC-300 Q&A - Testing Engine

The Microsoft SC-300 exam consists of multiple-choice questions and performance-based scenarios that assess a candidate's ability to plan and implement identity and access solutions, manage identity and access components, and troubleshoot common issues. SC-300 exam is designed to test a candidate's technical skills as well as their ability to solve real-world problems.

The Importance of Microsoft SC-300 Certification Exam

The Microsoft SC-300 exam is the first step in a series of steps to become a Microsoft Certified Professional. It is the first Microsoft certification exam available for Windows Server 2012 R2. You must pass the Microsoft SC-300 exam before you can take the next certification exam. We all dream of earning some money. Most of us want to achieve that dream sooner than later. The only way to earn that big amount of money is through hard work. And the only way to hard work is through dedication. The Microsoft SC-300 Certification Exam will ensure that your dedication is rewarded with the best job. The Microsoft SC-300 Certification Exam will help you to get a promotion in your organization. The certification will also help you in getting a higher salary package. This way, the professionals will get the chance to earn more and reach the next level. Microsoft SC-300 Dumps is a great way to prepare yourself for that exam. It is the best way to start a new career and get promoted.

NEW QUESTION # 143
You have an Azure subscription that contains the users shown in the following table.

You need to implement Azure AD Privileged Identity Management (PIM).
Which users can use PIM to activate their role permissions?

A. Admin1 and Admin2 only
B. Admin! only
C. Admin2 only
D. Admin2 and Admin3 only
E. Admin3 only
F. Admin1, Admin2, and Admin3

Answer: A

NEW QUESTION # 144
You need to identify which roles to use for managing role assignments. The solution must meet the delegation requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

NEW QUESTION # 145
You need to meet the technical requirements for the probability that user identifies were compromised.
What should the users do first, and what should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 146
A user named User1 attempts to sign in to the tenant by entering the following incorrect passwords:
Pa55w0rd12
Pa55w0rd12
Pa55w0rd12
Pa55w.rd12
Pa55w.rd123
Pa55w.rd123
Pa55w.rd123
Pa55word12
Pa55word12
Pa55word12
Pa55w.rd12
You need to identify how many sign-in attempts were tracked for User1, and how User1 can unlock her account before the 300-second lockout duration expires.
What should identify? To answer, select the appropriate
NOTE:Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

NEW QUESTION # 147
You configure a new Microsoft 365 tenant to use a default domain name of contoso.com.
You need to ensure that you can control access to Microsoft 365 resources by using conditional access policies.
What should you do first?

A. Configure password protection for Windows Server Active Directory.
B. Disable Security defaults.
C. Disable the User consent settings.
D. Configure a multi-factor authentication (MFA) registration policy.

Answer: B

Explanation:
Reference:
New Microsoft 365/Azure AD tenants enable Security defaults by default. The SC-300 materials emphasize that Security defaults and Conditional Access cannot be used together; to create and enforce custom Conditional Access policies (for example, requiring MFA under specific conditions), you must turn off Security defaults first. After disabling Security defaults, you can define Conditional Access policies that target specific users, apps, locations, or device states, and require controls such as MFA or session restrictions.
Disabling user consent, configuring on-premises password protection, or merely creating an MFA registration policy do not enable Conditional Access; they address different capabilities. Therefore, the first step to control access with Conditional Access is to disable Security defaults.

NEW QUESTION # 148
You have a Microsoft Exchange organization that uses an SMTP' address space of contoso.com.
Several users use their contoso.com email address for self-service sign up to Azure Active Directory (Azure AD).
You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.
You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self- service sign-up to Microsoft 365 services.
Which PowerShell cmdlet should you run?

A. Set-MsolDomain
B. Update-MsolfederatedDomain
C. Set-MsolDomainFederationSettings
D. Set-MsolCompanySettings

Answer: D

Explanation:
According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn content under "Manage Azure AD tenants and configure tenant properties", self-service sign-up (also known as viral sign-up) allows users to create accounts in an existing Azure AD tenant using an email domain associated with that tenant. This feature lets external or ungoverned users create identities if it is not explicitly disabled, which can cause unauthorized account creation in the organization's namespace.
To stop users from performing self-service sign-ups using the organization's verified domain (e.g., contoso.
com), administrators must disable the AllowEmailVerifiedUsers setting in Azure Active Directory using PowerShell. This configuration change prevents users from automatically creating accounts with the organization's domain when registering for Microsoft 365 or other Azure services.
The cmdlet used to configure tenant-level settings like this is Set-MsolCompanySettings from the MSOnline module.
The specific PowerShell command would be:
Set-MsolCompanySettings -AllowEmailVerifiedUsers $false
This command disables self-service sign-up for email-verified users, ensuring that only administrators can create accounts in the tenant.
Other cmdlets in the options serve different purposes:
* Set-MsolDomainFederationSettings - Used for configuring federation settings for a domain.
* Update-MsolFederatedDomain - Used to update or repair federation trust settings.
* Set-MsolDomain - Used to configure domain-specific properties (e.g., authentication type).
As per Microsoft's official documentation:
"To prevent users from self-service sign-up using your organization's verified domain, set AllowEmailVerifiedUsers to $false using Set-MsolCompanySettings."

NEW QUESTION # 149
Your network contains an on premises Active Directory domain named conIoso.com. The domain contains the objects shown in the following table.

You install Microsoft Entra Connect. You configure the Domain and OU filtering settings as shown in the Domain and OU filtering exhibit. (Click the domain and OU Filtering tab.) You configure the Filter user and devices settings as shown in the Filter Users and Devices exhibit. (Click the filter Users and Devices tab).
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Answer:

Explanation:

Explanation:

NEW QUESTION # 150
You have a Microsoft 365 tenant.
Sometimes, users use external, third-party applications that require limited access to the Microsoft 365 data of the respective user. The users register the applications in Azure Active Directory (Azure AD).
You need to receive an alert if a registered application gains read and write access to the users' email.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/cloud-app-security/app-permission-policy

NEW QUESTION # 151
You have a Microsoft 365 E5 subscription that contains two users named User1 and User2.
You need to ensure that User1 can create access reviews for groups, and that User2 can review the history report for all the completed access reviews. The solution must use the principle of least privilege.
Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 152
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1 and the groups shown in the following table.

In the tenant, you create the groups shown in the following table.

Which members can you add to GroupA and GroupB? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

Reference:
https://bitsizedbytes.wordpress.com/2018/12/10/distribution-security-and-office-365-groups-nesting/

NEW QUESTION # 153
You have a Microsoft 365 tenant and an Active Directory domain named adatum.com.
You deploy Azure AD Connect by using the Express Settings.
You need to configure self-service password reset (SSPR) to meet the following requirements:
* When users reset their password, they must be prompted to respond to a mobile app notification or answer three predefined security questions.
* Passwords must be synced between the tenant and the domain regardless of where the password was reset.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation
Graphical user interface, text, application Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions

NEW QUESTION # 154
You have an Azure AD tenant that contains the users shown in the following table.

You have the Azure AD Identity Protection policies shown in the following table.

You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

NEW QUESTION # 155
You need to resolve the recent security incident issues.
What should you configure for each incident? To answer, drag the appropriate policy types to the correct issues. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation

NEW QUESTION # 156
A user named User1 attempts to sign in to the tenant by entering the following incorrect passwords:
Pa55w0rd12
Pa55w0rd12
Pa55w0rd12
Pa55w.rd12
Pa55w.rd123
Pa55w.rd123
Pa55w.rd123
Pa55word12
Pa55word12
Pa55word12
Pa55w.rd12
You need to identify how many sign-in attempts were tracked for User1, and how User1 can unlock her account before the 300-second lockout duration expires.
What should identify? To answer, select the appropriate
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

NEW QUESTION # 157
You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

You plan to implement Azure AD Identity Protection.
Which users can configure the user risk policy, and which users can view the risky users report? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

NEW QUESTION # 158
You have a Microsoft 365 tenant.
You need to Identity users who have leaked credentials. The solution must meet the following requirements:
* Identity sign-ms by users who are suspected of having leaked credentials.
* Flag the sign-ins as a high-risk event.
* Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.
What should you use? To answer, select the appropriate options m the answer area.

Answer:

Explanation:

Explanation:

NEW QUESTION # 159
You need to implement the planned changes for litware.com. What should you configure?

A. staging mode in Azure AD Connect for the litware.com domain
B. Azure AD Connect cloud sync between the Azure AD tenant and litware.com
C. Azure AD Connect to include the litware.com domain

Answer: A

NEW QUESTION # 160
You have a Microsoft 365 tenant that has 5,000 users. One hundred of the users are executives. The executives have a dedicated support team.
You need to ensure that the support team can reset passwords and manage multi-factor authentication (MFA) settings for only the executives. The solution must use the principle of least privilege.
Which object type and Azure Active Directory (Azure AD) role should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

NEW QUESTION # 161
You have an Azure Active Directory (Azure AD) tenant that has the default App registrations settings. The tenant contains the users shown in the following table.

You purchase two cloud apps named App1 and App2. The global administrator registers App1 in Azure AD.
You need to identify who can assign users to App1, and who can register App2 in Azure AD.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE:Each correct selection is worth one point.

Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-assign-users
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added

NEW QUESTION # 162
You have Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1.
Department has the users shown in the Users exhibit. (Click the Users tab.)

Department1 has the groups shown in the Groups exhibit (Click the Groups tab.)

The User Administrator role assignments are shown in the Assignments exhibit. (Click the Assignments tab.)

The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.