Instant Access Microsoft.SC-300.v2026-08-27.q219 Actual Practice Test Engine for Free (Page 7)

Question 26

You have a Microsoft 365 tenant that has 5,000 users. One hundred of the users are executives. The executives have a dedicated support team.
You need to ensure that the support team can reset passwords and manage multi-factor authentication (MFA) settings for only the executives. The solution must use the principle of least privilege.
Which object type and Azure Active Directory (Azure AD) role should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Question 27

You have a Microsoft 365 tenant.
The Azure Active Directory (Azure AD) tenant syncs to an on-premises Active Directory domain. The domain contains the servers shown in the following table.

The domain controllers are prevented from communicating to the internet.
You implement Azure AD Password Protection on Server1 and Server2.
You deploy a new server named Server4 that runs Windows Server 2019.
You need to ensure that Azure AD Password Protection will continue to work if a single server fails.
What should you implement on Server4?

A.Azure AD Connect
B.Azure AD Application Proxy
C.Password Change Notification Service (PCNS)
D.the Azure AD Password Protection proxy service

Question 28

You have an Azure subscription that contains a user named User1. You onboard Microsoft Entra Permissions Management. You need to perform the following tasks:
* Identify all the accounts that are assigned the Global Administrator role permanently.
* Review the Permission Creep Index (PCI) of User1.
Which tab in Permissions Management should you use for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Question 29

You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity. You need to ensure that VM1 can retrieve the values of secrets stored in Vault 1. The solution must minimize administrative effort. What should you do first?

A.Configure the Resource access settings for Vault1.
B.C onfigure the permissions model for Vault1
C.Add a user-assigned managed identity to VM1.
D.Assign an Azure role to VM1.

Correct Answer: D

To ensure VM1 can retrieve the values of secrets stored in Vault1 while minimizing administrative effort, you should assign an Azure role to VM1 .
1. Managed Identities and Key Vault Access: VM1 has a system-assigned managed identity . This identity acts as a Service Principal in Microsoft Entra ID (formerly Azure AD). To access Key Vault secrets, this identity must be granted permissions on the Key Vault.
2. Permission Models (RBAC vs. Access Policies): Azure Key Vault supports two permission models:
* Azure role-based access control (Azure RBAC): The recommended, modern authorization system. It allows you to mana ge access to Key Vault keys, secrets, and certificates centrally using Azure IAM (Identity and Access Management), just like other Azure resources. It provides fine-grained access control and integrates with PIM (Privileged Identity Management).
* Vault acce ss policy: The legacy model where permissions are defined within the Key Vault ' s own " Access policies " blade.
3. Why " Assign an Azure role " (Option D) is the Correct First Step:
* Minimizing Administrative Effort: Using Azure RBAC is the recommended best pra ctice for minimizing effort because it unifies access management across Azure resources.
* The Action: To grant the required access (reading secrets) under the RBAC model, you must assign a specific role to the managed identity. The appropriate role is Key V ault Secrets User , which grants permission to read secret contents (Get and List operations) without granting administrative privileges (adhering to Least Privilege).
* Scenario Analysis: While older Key Vaults defaulted to Access Policies, new vaults and th e " minimize effort " requirement point towards the RBAC model. Option A ( " Configure the Resource access settings " ) is vague and likely refers to the " Access configuration " or " Access policies " blade, but " Assign an Azure role " is the definitive action to gr ant access in the modern RBAC workflow. If the vault were in Access Policy mode, one would typically " Add an access policy, " but that specific option is not listed, reinforcing that RBAC (Option D) is the intended path.
Documentation Extract:
" Azure RBAC is an authorization system built on Azure Resource Manager that provides centralized access management of Azure resources... The Azure RBAC model allows users to set permissions on different scope levels... To grant access to a specific user, group, or app lication... assign a role. For example, the Key Vault Secrets User role allows a user to read secret contents. " (Source: Microsoft Learn - Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control)

Question 30

You have a Microsoft 365 tenant.
You configure a conditional access policy as shown in the Conditional Access policy exhibit. (Click the Conditional Access policy tab.)

You view the User administrator role settings as shown in the Role setting details exhibit. (Click the Role setting details tab.)

You view the User administrator role assignments as shown in the Role assignments exhibit. (Click the Role assignments lab.)

For each of the following statement, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Question 26

Question 27

Question 28

Question 29

Question 30

Download PDF File