SC-300 Certification Practice Question #214

Question

You have an on-premises server named Server1 that runs Windows Server.

You have a Microsoft Entra tenant that contains an app registration named App1. App1 has Microsoft Graph application permissions.

You need to configure the environment to support App1. The solution must meet the following requirements:

•	App1 must be accessible only from the corporate network.
•	The credentials for App1 must NOT be stored as plain text.
•	Non-interactive scheduled tasks on Server1 must be able to authenticate to App1.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Three requirements drive both selections. "Accessible only from the corporate network" is a network/location restriction, which is enforced by a **Conditional Access policy** (named locations) scoped to the app — the other tenant-side options (authentication method, application proxy, permission classification) do not gate access by network. For the credential: a **client secret** is stored as plain text (violates the requirement), and both **system-assigned and user-assigned managed identities** are only available to workloads running on Azure resources — Server1 is on-premises, so they are not usable. A **certificate** uploaded to the app registration lets the non-interactive scheduled task authenticate to App1 with no plain-text secret. MS Learn confirms managed identities are Azure-only and that on-prem/daemon apps use a service principal with a certificate. All three comments agree on CAP + Certificate; confidence is set at 88 (strong, confidently-resolved HOTSPOT) rather than higher because no official Suggested Answer or Most-Voted marker is present and individual vote counts are low.

More SC-300 practice questions