최신 SC-300日本語 무료덤프 - Microsoft Identity and Access Administrator (SC-300日本語版)

설명: (DumpTOP 회원만 볼 수 있음)

Explanation:
Server1
On DC1
Azure AD Password Protection has two components: the DC agent (installed on domain controllers) and the proxy service (installed on one or more member servers). The SC-300 materials and Microsoft Identity Governance guidance explain that the proxy service is required when domain controllers do not have direct internet access. The proxy retrieves the password protection policy and custom banned password list from Azure AD over outbound HTTPS and makes it available to DC agents. The documentation further states that you should deploy at least one proxy per forest and two for high availability, and that domain controllers do not need internet connectivity when a proxy is deployed. In this scenario, DCs are explicitly blocked from internet access, so the proxy must be placed on member servers. Both SERVER1 (Application Proxy connector) and SERVER2 (Azure AD Connect) are domain-joined member servers with internet connectivity and are appropriate locations for the AzureADPasswordProtectionProxy service; selecting both provides the recommended redundancy. The custom banned password list is configured in Azure AD at the tenant level (as part of Azure AD Password Protection settings), not on individual servers. Once configured, the policy and list are downloaded by the proxy and enforced by the DC agent during password set or change operations, satisfying the requirement to implement a banned password list for the litware.com forest.

설명: (DumpTOP 회원만 볼 수 있음)

Explanation:
User1 can sign in by using multi-factor authentication (MFA): No
User2 can sign in by using multi-factor authentication (MFA): No
User3 can sign in from an anonymous IP address: No
This scenario is based on Azure AD Identity Protection and its two core conditional access mechanisms:
* User risk policy - evaluates the probability that a user ' s identity might be compromised.
* Sign-in risk policy - evaluates the probability that a sign-in attempt might not be performed by the legitimate user.
Let's analyze step-by-step based on the tables provided:
* Risk level: Low
* User risk policy: Applies to Low and above (so Low, Medium, and High users).
* Control: Block access.
* Action performed: Confirm user compromised. Confirming a user as compromised keeps or increases their risk level until the user is remediated (i.e., password reset). Because the policy blocks access for any user risk "Low and above," User1's sign-in is blocked, and MFA will not be prompted - access is denied.
# User1 MFA sign-in: No
* Initial risk level: Medium
* Actions performed:
* Confirm sign-in safe # clears that sign-in's risk.
* Confirm user compromised # elevates user risk back to "High."
* Policies applied:
* User risk policy (Low and above): Blocks access.
* Sign-in risk policy: Applies only to High sign-ins (not relevant here).
Since User2's user risk is set to High after confirming compromised, the User risk policy blocks access for
"Low and above."
Therefore, MFA is not allowed (the session is denied outright).
# User2 MFA sign-in: No
* User risk: High
* Action performed: Dismiss user risk # resets the user risk to "No risk."
* Sign-in policy: High sign-in risk # block access. If User3 signs in from an anonymous IP, Azure AD Identity Protection detects this as a High sign-in risk (per Microsoft documentation). Since the sign-in risk policy blocks all high sign-ins, access will be blocked.
# User3 anonymous IP sign-in: No

설명: (DumpTOP 회원만 볼 수 있음)

설명: (DumpTOP 회원만 볼 수 있음)

설명: (DumpTOP 회원만 볼 수 있음)

Explanation:

SC-300 materials explain that Conditional Access (CA) evaluates assignments (who/what) and conditions
/exclusions before applying grant controls. Policy CA1 targets Group1 and requires MFA, but explicitly excludes Global Administrator and Group2. User1 is in Group1 and holds the Global Administrator role, so the directory-role exclusion means CA1 does not apply and no other policy targets User1 # no MFA prompt.
Policy CA2 targets Group2 and blocks access to all cloud apps, with an exclusion for Group3. User2 is in Group2 and not in Group3, so CA2 applies and blocks SharePoint Online sign-in. User3 is in Group2 and Group3; because Group3 is excluded from CA2, the block does not apply. User3 is not in Group1, so CA1 doesn't apply either; therefore, User3 can sign in normally. The SC-300 guidance also notes that exclusions take precedence over inclusions, and block access is an enforcing control when a matching policy applies, while policies are evaluated independently with the most restrictive applicable outcome applied per user and sign-in.

Explanation:
Statements
Answer
On February 5, 2021, User1 can answer the Review1 question again.
No
On January 25, 2021, User2 can answer the Review1 question again.
No
On January 22, 2021, User3 can answer the Review1 question.
Yes
This question examines understanding of Access Reviews in Azure Active Directory (Azure AD) as covered in the Microsoft SC-300 Identity and Access Administrator Study Guide and the Microsoft Learn module
"Plan, implement, and manage access reviews."
Here are the key facts from the scenario:
* The access review Review1 starts on January 15, 2021.
* The frequency is set to Monthly, and the duration is 14 days.
* The review ends on February 15, 2021.
* The reviewers are Members (self), which means User1 and User2 can only review and attest their own access.
* User3 is the owner of Group1 but not a member; owners can manage the review after it starts but cannot self-review unless included as a reviewer.
From the configuration and Microsoft documentation:
"When an access review is active, users designated as reviewers can submit their decisions only during the review period. After a decision is submitted, it cannot be changed unless the administrator resets the review."
1# # On February 5, 2021, User1 can answer the Review1 question again:
User1 already answered on January 17, 2021 ("Yes"). Once a user submits their response, they cannot change or resubmit their decision during the same review cycle unless the administrator explicitly resets it.
# Answer: No
2# # On January 25, 2021, User2 can answer the Review1 question again:
User2 responded "No" on January 20, 2021, within the active review window (January 15-29). After submitting, responses are locked. User2 cannot answer again unless the review is restarted.
# Answer: No
3# # On January 22, 2021, User3 can answer the Review1 question:
The review is configured for Members (self), meaning only group members (User1 and User2) can attest their access. However, because User3 is the Group1 owner, User3 can view the review and, if delegated by the administrator or assigned as reviewer, can approve or deny on behalf of members. Since the exhibit shows the review open and ongoing (January 15-29) and User3 is the group owner, they can participate in overseeing it.
# Answer: Yes

Explanation:

설명: (DumpTOP 회원만 볼 수 있음)