AAD-300

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.What should you use?

• The Identity Governance blade in the Azure Active Directory admin center

• The Set-AzureAdUser cmdlet

• The Licenses blade in the Azure Active Directory admin center

• The Set-WindowsProductKey cmdlet

You have an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to bulk invite Azure AD business-to-business (B2B) collaboration users. Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution.

• email address and redirection URL

• redirection URL and username

• username and email

• shared key and password

• password and email

You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant. You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes. You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.

Solution: You configure password writeback. Does this meet the goal?

• Yes

• No

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1.A contractor uses the credentials of [e-mail] need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [e-mail] should you do?

• Run the New-AzADUser cmdlet.

• Add a WS-Fed identity provider.

• Configure the External collaboration settings.

• Create a guest user account in contoso.com.

You have a new Microsoft 365 tenant that uses a domain name of contoso.onmicrosoft.com. You register the name contoso.com with a domain registrar. You need to use contoso.com as the default domain name for new Microsoft 365 users. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place

• Add a custom domain name of contoso.com

• Successfully Verify the domain name

• Set the domain to primary

• Create a new TXT record in DNS

You have an Azure Active Directory (Azure AD) Azure AD tenant. You need to bulk create 25 new user accounts by uploading a template file. Which properties are required in the template file?

• displayName, identityIssuer, usageLocation, and userType

• accountEnabled, givenName, surname, and userPrincipalName

• accountEnabled, displayName, userPrincipalName, and passwordProfile

• accountEnabled, passwordProfile, usageLocation, and userPrincipalName

You need to resolve the recent security incident issues. What should you configure for each incident? To answer, drag the appropriate policy types to the correct issues. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point. Select and Place:

• A sign-in risk policy

• A sign-in from a suspicious behaviour

• A sign-in risk policy

• Leaked Credentials

• A user risk policy

• Resources accessed from an anonymous IP address

Answer explanation

A user risk policy -User-linked detections include:Leaked credentials: This risk detection type indicates that the user's valid credentials have been leaked. When cybercriminals compromise valid passwords of legitimate users, they often share those credentials.User risk policy.Identity Protection can calculate what it believes is normal for a user's behavior and use that to base decisions for their risk. User risk is a calculation of probability that an identity has been compromised. Administrators can make a decision based on this risk score signal to enforce organizational requirements. Administrators can choose to block access, allow access, or allow access but require a password change using Azure AD self-service password reset.

A sign-in risk policy -Suspicious browser: Suspicious browser detection indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser.

A sign-in risk policy -A sign-in risks include activity from anonymous IP address: This detection is discovered by Microsoft Defender for Cloud Apps. This detection identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.Note: The following three policies are available in Azure AD Identity Protection to protect users and respond to suspicious activity. You can choose to turn the policy enforcement on or off, select users or groups for the policy to apply to, and decide if you want to block access at sign-in or prompt for additional action.* User risk policyIdentifies and responds to user accounts that may have compromised credentials. Can prompt the user to create a new password.* Sign in risk policyIdentifies and responds to suspicious sign-in attempts. Can prompt the user to provide additional forms of verification using Azure AD Multi-Factor Authentication.* MFA registration policyMakes sure users are registered for Azure AD Multi-Factor Authentication. If a sign-in risk policy prompts for MFA, the user must already be registered for AzureAD Multi-Factor Authentication.

You have an Azure AD tenant that contains a user named User1.User1 needs to manage license assignments and reset user passwords. Which role should you assign to User1?

• Helpdesk administrator

• Billing administrator

• License administrator

• User administrator

Your company has a Microsoft 365 tenant. The company has a call center that contains 300 users. In the call center, the users share desktop computers and might use a different computer every day. The call center computers are NOT configured for biometric identification. The users are prohibited from having a mobile phone in the call center.You need to require multi-factor authentication (MFA) for the call center users when they access Microsoft 365 services. What should you include in the solution?

• a named network location

• the Microsoft Authenticator app

• Windows Hello for Business authentication

• FIDO2 tokens

You have an Azure Active Directory (Azure AD) tenant named contoso.com. All users who run applications registered in Azure AD are subject to conditional access policies. You need to prevent the users from using legacy authentication. What should you include in the conditional access policies to filter out legacy authentication attempts?

• a cloud apps or actions condition

• a user risk condition

• a client apps condition

• a sign-in risk condition