SC-300 Exam Questions & Answers

In SC-300, Microsoft emphasizes Azure AD B2B collaboration for cross-tenant access without extra Microsoft 365 licensing. The guidance explains that organizations can invite external users as guests to their tenant to access Microsoft 365 resources such as SharePoint Online and Teams, and guest access does not require an additional Microsoft 365 license for the guest. The host tenant remains licensed for the workloads being accessed, and Azure AD billing for B2B collaboration is handled through External Identities (MAU) if configured. The study content also notes that synchronizing a single on-premises AD forest to multiple Azure AD tenants is not a supported topology with a single Azure AD Connect server, and deploying another AAD Connect to sync the same identities to a second tenant introduces complexity and is unnecessary when the requirement is simply to let users in one tenant access resources in another. Application Proxy (publishing on-prem apps) is unrelated to granting SharePoint Online cross-tenant access. Therefore, the minimum-effort, license-compliant approach is to invite Contoso East users as B2B guests in the Contoso West tenant and assign them the required SharePoint permissions.

According to the Microsoft Entra ID Protection section of the SC-300 Study Guide and the official Microsoft documentation on risk detections and retention, Microsoft Entra ID stores risky user activity and detections for 90 days. This includes logs of risky users, risky sign-ins, and risk detections identified by machine learning models and heuristic signals.

The retention period of 90 days ensures administrators can analyze user risk patterns, investigate compromised accounts, and implement mitigations such as Conditional Access or user risk policies. After 90 days, these logs are automatically purged unless exported to a SIEM such as Microsoft Sentinel for extended retention.

Microsoft Learn states:

''Identity Protection retains data for 90 days. Administrators can view risk detections, risky users, and risky sign-ins in the portal or query them using Microsoft Graph.''

In SC-300, the mitigation for unsolicited MFA prompts (push fatigue) is Fraud alert on Azure AD MFA. The materials state that administrators can ''allow users to report suspicious MFA prompts and automatically block the user when they select Report fraud in Microsoft Authenticator.'' By contrast, Account lockout settings are designed to ''temporarily lock an account after a configurable number of consecutive MFA denials to thwart brute-force attempts,'' and they do not initiate an automatic block tied to a user's fraud report. The study guide further clarifies that fraud alerts ''can automatically block the user for a specified period (default 90 days) when a fraudulent attempt is reported,'' which is precisely the behavior required in the scenario. Therefore, merely configuring Account lockout settings will not meet the goal of automatically blocking users when they report an unsolicited prompt.

When enabling Microsoft Entra (Azure AD) login for a virtual machine, you must assign a managed identity so that the VM can authenticate to Azure AD and access other Azure resources securely without storing credentials.

Between the two types of managed identities---system-assigned and user-assigned---the system-assigned identity is the most appropriate when the identity is unique to the VM and should be automatically managed by Azure.

Once you enable a system-assigned managed identity, Azure creates an identity tied directly to the VM's lifecycle. It allows the VM to request tokens from Microsoft Entra ID and access resources within Sub1 under the permissions granted through RBAC.

From Microsoft documentation:

''To enable Microsoft Entra login for your VM, the VM must have a system-assigned managed identity that is granted access to Azure resources.''