SC-300 - Implement Authentication and Access Management (25% of the exam) - Section 2.6

Implement Microsoft Entra Global Secure Access for Private Access and Internet Access.

Describe Microsoft Entra Global Secure Access and distinguish Microsoft Entra Private Access for on-premises apps from Microsoft Entra Internet Access for web traffic, including the specialised Internet Access for Microsoft 365 profile. Configure traffic forwarding profiles and Global Secure Access clients to route user traffic through the service.

Global Secure Access clientsMicrosoft Entra Private AccessMicrosoft Entra Internet AccessInternet Access for Microsoft 365traffic forwarding profiles

Practice question for this objective

Free sampleImplement Authentication and Access Managementmedium

A security team wants all general outbound web browsing from corporate endpoints routed through Microsoft Entra Global Secure Access so the service can apply web content filtering and inspection, while leaving Microsoft 365 application traffic and internal private application traffic to their own dedicated profiles. Which traffic forwarding profile should the administrator enable to capture this general internet egress?

AThe Microsoft 365 traffic forwarding profile, which tunnels Exchange, SharePoint and Teams traffic
BThe Internet Access traffic forwarding profile, which tunnels general internet-bound web traffic Correct
CThe Private Access traffic forwarding profile, which tunnels traffic to published internal applications
DA Conditional Access named location profile, which tags outbound web traffic as corporate egress

The Internet Access traffic forwarding profile routes general internet browsing through Global Secure Access so web content filtering and inspection can be enforced. Global Secure Access splits traffic into separate forwarding profiles. The Internet Access profile captures general internet-bound web traffic so the service can run web content filtering, whereas the Microsoft 365 and Private Access profiles are scoped to their own destination sets and would not pick up arbitrary browsing.

Why A is wrong: The Microsoft 365 profile is scoped only to Microsoft 365 endpoints, so it would not capture general web browsing destined for arbitrary internet sites.

Why B is correct: The Internet Access profile forwards general internet-bound traffic to Global Secure Access, where web content filtering and inspection can be applied to outbound browsing.

Why C is wrong: The Private Access profile is dedicated to reaching internal published applications and does not forward general internet browsing for filtering.

Why D is wrong: A named location classifies source IP ranges for policy and is not a traffic forwarding profile that routes browsing through the service.

See more SC-300 practice questions, answers explained.

Exam traps in Implement Authentication and Access Management

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

Enable the Internet Access traffic forwarding profile, which captures broad outbound internet destinations including general web browsing for the tenant.
Why it is wrong: The Internet Access profile captures broad internet traffic, so it would also route general web browsing, which the requirement says must stay untouched.
Add each private application URL to the trusted sites list in the browser so the request is forwarded to the Global Secure Access edge.
Why it is wrong: A browser trusted sites entry changes security zone behaviour, not packet routing; it cannot redirect application traffic into the Global Secure Access tunnel.
Use a Microsoft Entra Private Access application segment that lists the blocked sites so the connector refuses the matching destinations.
Why it is wrong: Private Access publishes internal applications for inbound user access and does not perform outbound category-based filtering of public internet sites.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.