Exam SC-300 topic 2 question 78 discussion

Answer B) Delete CAPolicy1 To use Conditional Policies, you must first disable "security defaults". So to use the security defaults again, you will need to remove Conditional Access Policies that may conflict. Of all the choices provided, this is the one that makes the most sense.

To configure security defaults in your directory, you must be assigned at least the Security Administrator role. By default the first account in any directory is assigned a higher privileged role known as Global Administrator. Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults. (Imply that Conditional Access policies has conflict with security defaults) https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

B is Correct.

To enable capolicies you need to disable Security defaults therefore you need to do it viceversa If you want to Go back to Security defaults

The correct answer is B. Delete CAPolicy1. To enable Security defaults for contoso.com, Admin1 must be assigned at least the Security Administrator role1. However, this role is not available in the list of roles for Au1, which is the only authentication method for contoso.com. This is because Au1 has a Conditional Access policy named CAPolicy1 that blocks legacy authentication protocols2. Security defaults also block legacy authentication protocols, so they cannot be enabled if there is an existing Conditional Access policy that does the same3. Therefore, to enable Security defaults, Admin1 must first delete CAPolicy1 from Au1. This will allow Admin1 to sign in to contoso.com using a legacy authentication protocol and then assign themselves the Security Administrator role. After that, Admin1 can enable Security defaults for contoso.com.

A. Delete Package1 --> no sense for me. C. Assign Admin1 the Authentication Administrator role for Au1. --> The role neded on that case, is Security Administrator role. https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-defaults#enabling-security-defaults D. Configure Identity Governance. --> no sense for me. So B. Delete CAPolicy1 is the correct one.

Correct