A company has a large number of discovered apps. They want to prioritize which apps to investigate based on risk and usage. What is the most efficient way to do this?

Use the Cloud Discovery dashboard to sort apps by risk score and usage.

Create an access policy that blocks all high-risk apps.

Manually review each app in the catalog.

Export all discovery data to a CSV file for analysis.

A company wants to monitor user activities in a custom SaaS app that provides an API. They want to enforce access policies based on user location. What should they do?

Create an OAuth app policy for the custom app.

Add the app to the Cloud app catalog as a custom app.

Connect the custom app as a connected app in Defender for Cloud Apps.

Create a session policy that monitors the app.

A company wants to enforce session controls for a legacy web app that does not support modern authentication. They have already configured Conditional Access app control. What is the best approach to ensure session controls are applied?

Use Cloud Discovery to monitor the app.

Connect the app via its API to enable session controls.

Create an access policy that blocks the app.

Use Conditional Access app control with the app configured for header-based authentication.

Which of the following is a prerequisite for connecting an app in Microsoft Defender for Cloud Apps?

The app must be in the Cloud App Catalog

The app must be a Microsoft cloud app

The app must support API-based access

The app must be installed on-premises

A company uses Microsoft Defender for Cloud Apps with Conditional Access app control. They want to prevent users from downloading sensitive files from SharePoint Online while still allowing them to view and edit files in the browser. What should they configure?

Configure an OAuth app policy to revoke permissions for SharePoint.

Disable the SharePoint connector in Defender for Cloud Apps.

Create an access policy that blocks the SharePoint app for all users.

Create a session policy that blocks the download action for the SharePoint app when the file is classified as sensitive.

Microsoft Certified:Identity and Access Administrator Associate

Domain 3Objective 4

Manage and Monitor App Access by Using Microsoft Defender for Cloud Apps SC-300 Practice Questions (Page 4)

Part of the Plan and implement workload identities domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

20–25%of the exam

Questions 16–20

16expert · hard
A company has a large number of discovered apps. They want to prioritize which apps to investigate based on risk and usage. What is the most efficient way to do this?
Select an answer first
17application · medium
A company wants to monitor user activities in a custom SaaS app that provides an API. They want to enforce access policies based on user location. What should they do?
Select an answer first
18expert · hard
A company wants to enforce session controls for a legacy web app that does not support modern authentication. They have already configured Conditional Access app control. What is the best approach to ensure session controls are applied?
Select an answer first
19foundation · medium
Which of the following is a prerequisite for connecting an app in Microsoft Defender for Cloud Apps?
Select an answer first
20application · medium
A company uses Microsoft Defender for Cloud Apps with Conditional Access app control. They want to prevent users from downloading sensitive files from SharePoint Online while still allowing them to view and edit files in the browser. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.