You have Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1.
Department has the users shown in the Users exhibit. (Click the Users tab.)

Department1 has the groups shown in the Groups exhibit (Click the Groups tab.)

The User Administrator role assignments are shown in the Assignments exhibit. (Click the Assignments tab.)

The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
A screenshot of a computer screen Description automatically generated

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft 365 E5 subscription and an Azure subscription. You need to meet the following requirements:
* Ensure that users can sign in to Azure virtual machines by using their Microsoft 365 credentials.
* Delegate the ability to create new virtual machines.
What should you use for each requirement? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Correct Answer:

Explanation

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft 365 tenant that contains a group named Group1 as shown in the Group1 exhibit. (Click theGroup1tab.)

You create an enterprise application named App1 as shown in the App1 Properties exhibit. (Click theApp1 Propertiestab.)

You configure self-service for App1 as shown in the App1 Self-service exhibit. (Click theApp1Self- servicetab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE:Each correct selection is worth one point.

Correct Answer:

Explanation:
No
No
Yes
a) When you assign a group to an application, only users in the group will have access. The assignment does not cascade to nested groups.
b) Tested in lab, existing owners will be replaced. Also direct assignment (resource owner) is path of least privilege. (replicated in test) c) Application setting 'visible to users' is set to No, then no users see this application on their My Apps portal and O365 launcher.
Reference
According to the Microsoft SC-300: Identity and Access Administrator Study Guide, Azure AD Enterprise Application Self-service configuration determines how users can request access, who approves it, and whether access is automatically granted. Let's analyze each statement based on the exhibits:
* Members of Group3 can access App1 without approval from User1 - NOIn the Group1 exhibit, Group1 contains User1, User4, and Group3. In the App1 Self-Service exhibit, it shows that "Require approval before granting access" is set to Yes, and User1 is designated as the approver. Therefore, even though Group3 members might indirectly be part of Group1, access requests to App1 must still be approved by User1 before being granted.
* After configuring self-service, the owner of Group1 is User1 - NOThe PowerShell command Get- AzureADGroupOwner clearly shows that Admin (not User1) is the owner of Group1. Configuring self- service for an application does not change group ownership; it only defines how access requests are handled. Ownership of Group1 remains with Admin.
* App1 appears in the Microsoft 365 app launcher of User4 - YESIn the App1 Properties exhibit, the
"User assignment required" setting is set to Yes. This means only assigned users (directly or via groups) can see and access the application. Since Group1 is configured as the target group for user assignment and User4 is a member of Group1, User4 will see App1 in their Office 365 app launcher after assignment approval.
This logic follows Microsoft Learn documentation:
"When a user is assigned to an enterprise application (either directly or through group membership), the application appears in the user's Office 365 app launcher once access is granted."

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains two resource groups named RG1 and RG2, a storage account named storage1.
You assign roles for the subscription as shown in the following table.

You assign roles for RG1 as shown in the following table.

You assign roles for storage1 as shown in the following exhibit.

Roles are NOT assigned for other Azure resources.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Correct Answer:

Explanation:

This scenario tests your knowledge of Azure Role-Based Access Control (RBAC) and the scope hierarchy in Azure (Management Group # Subscription # Resource Group # Resource).
* At the subscription level, User1 has the Reader role. This allows the user to view all resources within the subscription, but not access data stored inside those resources.
* At the RG1 level, User1 also has Reader and Data Access. This role is special - it grants both read access to resource configuration and data access to the underlying data plane (for example, the blobs in a storage account).
1# # User1 can read the data stored in storage1 # YES Since storage1 is inside RG1, and Reader and Data Access covers both resource and data access, User1 can read data stored in storage1 (e.g., list blobs, view content).
# Answer: YES
* At the subscription level, User2 has the Reader role (read-only, no create permissions).
* At the RG1 level, User2 has the Contributor role - this allows full management permissions on resources within RG1.
* The question asks about RG2, not RG1.
2# # User2 can create a virtual network in RG2 # YES However, RG2 does not have any explicit assignment for User2.
But since Contributor at the subscription level gives create/delete permission across all resources, and here User2's Contributor role is scoped to RG1 only, it does not extend to RG2.
So User2 cannot create resources in RG2 because Contributor permission doesn't propagate across resource groups unless assigned at a higher scope.
# Correct Answer: NO (User2 cannot create in RG2)
* The JSON data shows that User3 has the User Access Administrator role assigned directly on the storage1 resource. The User Access Administrator role allows managing role assignments (RBAC) at that specific scope - granting or removing access to others.
3# # User3 can assign roles for storage1 # YES Therefore, User3 can assign (and remove) RBAC roles for storage1.
# Answer: YES
* Microsoft Learn: Implement Role-Based Access Control (RBAC)
* Microsoft Learn: Understand scope inheritance in Azure RBAC
* Microsoft Learn: Manage access using the User Access Administrator role
* Exam Ref SC-300: Manage access to Azure resources using roles and assignments Key References from Microsoft SC-300 Official Materials:

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft 365 tenant.
You need to identify users who have leaked credentials. The solution must meet the following requirements.
* Identity sign-Ins by users who ate suspected of having leaked credentials.
* Rag the sign-ins as a high risk event.
* Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation
Graphical user interface, text, application, email Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

Comment: *

Name: *

Email: *

Verification: *