SC-300 Azure AD Conditional Access

Question 1

Which Conditional Access grant control requires users to use a device that is marked as compliant in Microsoft Intune?

Accepted Answer

Require device to be marked as compliant

Answer

The 'Require device to be marked as compliant' grant control enforces that the accessing device meets Intune compliance policies.

Question 2

A Conditional Access policy is set to 'Report-only' mode. What is the effect on users?

Accepted Answer

Policy evaluates but does not enforce; results are logged only

Answer

Report-only mode evaluates the policy against sign-in events and logs the outcome without enforcing the controls.

Question 3

Which named location type in Conditional Access allows you to specify trusted locations using IP ranges?

Accepted Answer

IP ranges location

Answer

IP ranges named locations let administrators define trusted network zones by specifying IPv4 or IPv6 CIDR blocks.

Question 4

You want to require MFA only when users sign in from outside the corporate network. Which Conditional Access condition should you configure?

Accepted Answer

Named locations

Answer

Named locations let you include or exclude specific IP ranges so MFA is enforced only for sign-ins originating outside the trusted corporate network.

Question 5

Which session control in Conditional Access restricts the duration of a user's authenticated session before re-authentication is required?

Accepted Answer

Sign-in frequency

Answer

Sign-in frequency controls how often users must re-authenticate, overriding the default session lifetime.

SC-300 - Microsoft Identity and Access Administrator Practice Test