SC-300 Certification Practice Question #176

Question

You have a Microsoft Entra tenant that contains two remote networks named RemoteNetwork1 and RemoteNetwork2 and the users shown in the following table.

You have the devices shown in the following table.

You have a Conditional Access policy that has the following settings:
 o	Name: CAPolicy1
 o	Assignments
 -	Users: Group1, Group2
 -	Target resources: All internet resources with Global Secure Access
 o	Access controls
 -	Grant: Require multifactor authentication
o	Enable policy: On

Global Secure Access traffic forwarding is configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

Exchange Online and SharePoint Online are Microsoft 365 services carried by the **Microsoft traffic forwarding profile**, which is Enabled, and CAPolicy1 ("All internet resources with Global Secure Access", Grant = MFA) is scoped to Group1 and Group2 — covering all three users. Per MS Learn, two independent mechanisms forward this traffic through GSA: (a) the **GSA client** installed on a device, and (b) a **remote network** that has the profile assigned, which explicitly does **not** require the client. So Device1 (client + RemoteNetwork1) forwards → MFA (Yes); Device2 (no client, but behind the assigned RemoteNetwork1) still forwards because remote-network acquisition needs no client → MFA (Yes); Device3 (client Deployed) forwards Microsoft traffic via its own installed client regardless of RemoteNetwork2 not being assigned → MFA (Yes). The dissenting answer (Yes/No/No) wrongly assumes the client is mandatory for Device2 and that RemoteNetwork2's absence stops Device3, but MS Learn shows neither assumption holds. Confidence is held at 77% because the two top community answers are tied 👍2–👍2 and the Suggested Answer was not captured.

More SC-300 practice questions