SC-300 - Implement Authentication and Access Management - Section 2.6

Implement Microsoft Entra Global Secure Access for Private Access and Internet Access.

Describe Microsoft Entra Global Secure Access and distinguish Microsoft Entra Private Access for on-premises apps from Microsoft Entra Internet Access for web traffic, including the specialised Internet Access for Microsoft 365 profile. Configure traffic forwarding profiles and Global Secure Access clients to route user traffic through the service.

Global Secure Access clientsMicrosoft Entra Private AccessMicrosoft Entra Internet AccessInternet Access for Microsoft 365traffic forwarding profiles

Practice question for this objective

Free sampleImplement Authentication and Access Managementmedium

A security team wants all general outbound web browsing from corporate endpoints routed through Microsoft Entra Global Secure Access so the service can apply web content filtering and inspection, while leaving Microsoft 365 application traffic and internal private application traffic to their own dedicated profiles. Which traffic forwarding profile should the administrator enable to capture this general internet egress?

  • AThe Microsoft 365 traffic forwarding profile, which tunnels Exchange, SharePoint and Teams traffic
  • BThe Internet Access traffic forwarding profile, which tunnels general internet-bound web traffic Correct
  • CThe Private Access traffic forwarding profile, which tunnels traffic to published internal applications
  • DA Conditional Access named location profile, which tags outbound web traffic as corporate egress
The Internet Access traffic forwarding profile routes general internet browsing through Global Secure Access so web content filtering and inspection can be enforced. Global Secure Access splits traffic into separate forwarding profiles. The Internet Access profile captures general internet-bound web traffic so the service can run web content filtering, whereas the Microsoft 365 and Private Access profiles are scoped to their own destination sets and would not pick up arbitrary browsing.

Why A is wrong: The Microsoft 365 profile is scoped only to Microsoft 365 endpoints, so it would not capture general web browsing destined for arbitrary internet sites.

Why B is correct: The Internet Access profile forwards general internet-bound traffic to Global Secure Access, where web content filtering and inspection can be applied to outbound browsing.

Why C is wrong: The Private Access profile is dedicated to reaching internal published applications and does not forward general internet browsing for filtering.

Why D is wrong: A named location classifies source IP ranges for policy and is not a traffic forwarding profile that routes browsing through the service.

See more SC-300 practice questions, answers explained.

More in this domain

Back to all Implement Authentication and Access Management objectives, or the SC-300 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.