Plan and Implement App Registrations SC-300 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has an app that needs to read calendar data for the signed-in user. The app is a web app that uses delegated permissions. The admin has added the Calendars.Read permission to the app registration. What else must be done before the app can successfully call Microsoft Graph?

   • AAdd a client secret to the app registration
   • BAssign the user to an app role
   • CEnsure the user has consented to the permission
   • DGrant admin consent for the Calendars.Read permission
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web app is being developed and will use the OAuth 2.0 authorization code flow with PKCE. The app will run in multiple environments: development, staging, and production. Each environment has a different URL. You need to configure the app registration so that authentication works in all environments. What should you do?

   • AUse the same redirect URI for all environments by configuring a reverse proxy.
   • BAdd only the production URL as a redirect URI and use a wildcard to cover the other environments.
   • CAdd all three environment URLs as redirect URIs in the same app registration.
   • DCreate a separate app registration for each environment, each with its own redirect URI.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When planning an app registration strategy, which factor should be considered to minimize the risk of over-privileged applications?

   • ACreating a separate app registration for each application and granting only the permissions it requires
   • BAssigning all available API permissions to the registration so future features work without changes
   • CUsing the same app registration for multiple applications to reduce administrative overhead
   • DPlacing all app registrations in the same administrative unit to simplify management
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A web app is being migrated from an on-premises identity provider to Microsoft Entra ID. The app currently uses a redirect URI of https://app.contoso.com/auth/callback. During testing, you notice that the authentication fails with an 'AADSTS50011' error. The redirect URI in the app registration is set to https://app.contoso.com/auth/callback. What is the most likely cause?

   • AThe app registration is set to 'Allow public client flows'.
   • BThe app registration is missing the 'Web' platform.
   • CThe redirect URI has a trailing slash or is not an exact match.
   • DThe app registration is using a client secret that has expired.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is deploying a new line-of-business app that requires the Mail.Read delegated permission to Microsoft Graph. The app will be used by all 500 employees. The tenant has the default user consent settings. An admin wants to ensure that users can sign in and use the app without seeing a consent prompt. What should the admin do?

   • AGrant admin consent for the Mail.Read permission on the app registration
   • BAsk each user to consent when they first sign in
   • CEnable the app to use application permissions instead of delegated
   • DAdd the users to a group and assign the app role to the group
   Reveal Solution Discussion Select an answer first