Correct Answer: A  🗳️

Explanation: Only visible for PassTorrent members. You can sign-up / login (it's free).

Correct Answer:

Explanation:

SC-300 materials stress that to enforce modern controls (like MFA) on on-premises apps, you must front them with Azure AD so Conditional Access can evaluate sign-ins. The documentation states that Azure AD Application Proxy "provides secure remote access to on-premises applications" and that apps published through it can have "Conditional Access policies, including multifactor authentication" applied at sign-in. In other words, once the legacy app is published by Application Proxy, Azure AD sits in the path, enabling you to meet the requirement to enforce MFA when accessing on-premises applications and to combine it with your location-based exemptions.
For SharePoint Online restrictions, SC-300 points to Microsoft Cloud App Security (Defender for Cloud Apps) for real-time governance: you can create session policies that "control and limit activities in real time" and, for SharePoint Online and other Microsoft 365 apps, "monitor user sessions and block download, cut, copy, and print" when conditions (device state, risk, or location) warrant it. Since the scenario already has anomaly detections enabled, configuring Cloud App Security policies aligns directly with the requirement to place access restrictions on SharePoint Online without altering tenant-wide consent settings. Thus, publish on- prem apps with Application Proxy to bring them under Conditional Access (for MFA), and use Cloud App Security policies to enforce SharePoint Online session and download controls.

Correct Answer: A  🗳️

Explanation: Only visible for PassTorrent members. You can sign-up / login (it's free).

Correct Answer:

Explanation:

Box 1: Yes
Invitations can only be sent to outlook.com. Therefore, User1 can accept the invitation and access the application.
Box 2. Yes
Invitations can only be sent to outlook.com. However, User2 has already received and accepted an invitation so User2 can access the application.
Box 3. No
Invitations can only be sent to outlook.com. Therefore, User3 will not receive an invitation.
Based on the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module
"Manage external collaboration settings in Azure AD", Azure Active Directory provides granular control over external collaboration through External collaboration settings and Collaboration restrictions. These settings control which external domains can receive guest invitations.
The configuration in the exhibit shows:
"Allow invitations only to the specified domains (most restrictive)"
Target Domain: Outlook.com
This means invitations can only be sent to users whose email domains are explicitly listed (in this case, Outlook.com). Any other external domain (like fabrikam.com or adatum.com) is not permitted to receive or accept invitations.
[email protected]
Domain Outlook.com is listed under allowed domains.
Although the invitation was initially not accepted, since the domain is allowed, User1 can accept the invitation and gain access.# Answer: Yes [email protected] The domain fabrikam.com is not listed in the allowed domains list.
However, this user already accepted the invitation before the restriction was configured.
Once a guest has accepted the invitation, they are an existing guest object in Azure AD and retain access unless explicitly removed.# Answer: Yes [email protected] Domain adatum.com is not listed under allowed domains.
Therefore, this user cannot receive or accept new invitations for collaboration resources like SharePoint Online.# Answer: No Summary from Microsoft documentation:
"When collaboration restrictions are set to allow invitations only to specified domains, invitations to all other domains are blocked. Existing guest users who have already accepted invitations remain unaffected." (Source: Microsoft Learn - Configure external collaboration settings in Azure AD)

Correct Answer: B  🗳️

Explanation: Only visible for PassTorrent members. You can sign-up / login (it's free).