Microsoft - SC-300: Microsoft Identity and Access Administrator

Sample Questions

Explanation:

Microsoft Entra Internet Access and Microsoft Entra Private Access comprise Microsoft's Security Service Edge (SSE) solution. Global Secure Access is the unifying term used for both Microsoft Entra Internet Access and Microsoft Entra Private Access. Global Secure Access is the unified location in the Microsoft Entra admin center. Global Secure Access is built upon the core principles of Zero Trust to use least privilege, verify explicitly, and assume breach.

Global Secure Access supports two connectivity options: installing a client on end-user device and configuring a remote network, for example a branch location with a physical router. The Global Secure Access client is available for Windows, macOS, Android, and iOS, but not for Linux. Remote network connectivity supports any operating system.

References:

What is Global Secure Access?

Understand remote network connectivity

Known limitations for Global Secure Access

• Deploy Global Secure Access.
• Create a Global Secure Access security profile named Profile1.
• Create the following Conditional Access policy:
• Name: CAPolicy1
• Target resources: All internet resources with Global Secure Access
  
• Session: Use Global Secure Access security profile: Profile1

Explanation:

In Global Secure Access (GSA), traffic is split into three forwarding profiles:

1. Microsoft traffic profile - Microsoft 365 and other Microsoft cloud services

2. Internet access profile - General internet (non-Microsoft SaaS, public websites)

3. Private access profile - Private apps published via GSA (replaces VPN scenarios)

CAPolicy1 targets All internet resources with Global Secure Access. When you target All internet resources with Global Secure Access, the policy applies to Microsoft traffic and Internet access. It does not apply to Private access, because private access uses enterprise/private applications, not internet resources.

Global Secure Access security profiles are used to inspect and control general internet traffic, not Microsoft-optimized traffic or private app traffic. Even though CAPolicy1 is linked to both forwarding profiles when you target All internet resources with Global Secure Access, the security profile itself is applied to the Internet access profile only.

References:

What is Global Secure Access?

Global Secure Access traffic forwarding profiles

How to configure Global Secure Access web content filtering

• Apply Policy1 to all the Windows devices.
• Assess the compliance of the Windows devices with Policy1.

Explanation:

The 500 Windows 11 devices are joined to the on-premises Active Directory Domain Services (AD DS) domain. To ensure, that we can apply an Entra ID Conditional Access policy to the devices, we need to implement Microsoft Entra Connect or Microsoft Entra Cloud Connect and sync computer objects of the devices to Entra ID. Microsoft Entra hybrid joined devices are joined to your on-premises Active Directory and registered with Microsoft Entra ID.

To assess the compliance of the Windows devices, we need to enroll the devices in Microsoft Intune and apply an Intune compliance policy. Microsoft Intune compliance policies are sets of rules and conditions that you use to evaluate the configuration of your managed devices. These policies can help you secure organizational data and resources from devices that don't meet those configuration requirements. Managed devices must satisfy the conditions you set in your policies to be considered compliant by Intune.

References:

Microsoft Entra hybrid joined devices

Use compliance policies to set rules for devices you manage with Intune

• Name: CAPolicy1
• Assignments
• Users: Group1, Group2
• Target resources: All internet resources with Global Secure Access
• Access controls
• Grant: Require multifactor authentication

Explanation:

Traffic forwarding profiles enable admins to forward specific traffic to Global Secure Access. We can assign traffic forwarding profiles to users running the Global Secure Access client or to remote networks for clientless devices.

In Global Secure Access (GSA), traffic is split into three forwarding profiles:

1. Microsoft traffic profile - Microsoft 365 and other Microsoft cloud services

2. Internet access profile - General internet (non-Microsoft SaaS, public websites)

3. Private access profile - Private apps published via GSA (replaces VPN scenarios)

CAPolicy1 targets All internet resources with Global Secure Access. When you target All internet resources with Global Secure Access, the policy applies to Microsoft traffic and Internet access. Here, only the Microsoft traffic profile is enabled. So, Global Secure Access will only affect traffic to Microsoft 365 and other Microsoft cloud services.

User1 is connected to RemoteNetwork1 and a member of Group1. When User1 signs in to Microsoft Exchange Online, CAPolicy1 applies and requires multifactor authentication (MFA).

User2 is connected to RemoteNetwork1 and a member of Group1. When User2 signs in to Microsoft SharePoint Online, CAPolicy1 applies and requires multifactor authentication (MFA).

User3 is connected to RemoteNetwork2 and a member of Group2. When User3 signs in to Microsoft Exchange Online, CAPolicy1 does not apply and User3 will not be prompted for multifactor authentication (MFA).

References:

What is Global Secure Access?

Global Secure Access traffic forwarding profiles

How to create a remote network with Global Secure Access

Explanation:

The Global Secure Access client, an essential component of Global Secure Access, helps organizations manage and secure network traffic on end-user devices. The client's main role is to route traffic that needs to be secured by Global Secure Access to the cloud service. All other traffic goes directly to the network. The Forwarding Profiles, configured in the portal, determine which traffic the Global Secure Access client routes to the cloud service.

You install the client on a device, such as computer or phone, and then use Global Secure Access settings in the Microsoft Entra admin center to secure the device. Clients are currently available for Windows, Android, macOS, and iOS.

For macOS app deployment through Intune, you upload the installer package format used by macOS, which is a .pkg file (GlobalSecureAccessClient.pkg).

References:

Global Secure Access client overview

Install the Global Secure Access client for macOS