Microsoft · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A company wants to require multi-factor authentication (MFA) for all users accessing a financial application, but only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should be used?
Identity Protection
Conditional Access
Conditional Access allows administrators to define policies that grant or block access based on conditions such as network location, requiring MFA when outside the corporate network.
Privileged Identity Management (PIM)
Self-Service Password Reset (SSPR)
An organization uses Microsoft Entra ID Protection. A user's sign-in is flagged with a risk level of 'High' because of an anonymous IP address. The administrator wants to automatically block the sign-in while allowing the user to self-remediate. Which should be configured?
A Conditional Access policy requiring MFA for high-risk sign-ins
A user risk policy configured to require a password change
A sign-in risk policy configured to block access
Sign-in risk policies in Identity Protection can block sign-ins based on risk level (e.g., High). The user can later remediate their account via a user risk policy.
An MFA registration policy for all users
A company manages Azure resources for multiple departments. The security team needs to grant IT administrators temporary, just-in-time access to high-privilege roles (e.g., Contributor, Owner) only when needed, with approval workflows. Which Microsoft Entra ID capability should they configure?
Conditional Access
Identity Protection
Privileged Identity Management (PIM)
PIM provides time-based and approval-based role activation to manage, control, and monitor access to privileged resources. It supports just-in-time access for elevated roles.
Entitlement Management (Identity Governance)
A company uses Microsoft Entra ID and needs to regularly review membership of a group that grants access to a sensitive HR application. The identity team wants to automate quarterly reviews and automatically remove users who fail to respond or are denied by the reviewer. Which Microsoft Entra ID feature should they use?
Conditional Access
Identity Protection
Privileged Identity Management (PIM)
Access Reviews
Access Reviews enables administrators to create recurring reviews of group memberships, application access, and role assignments. Unresponsive or denied users can be automatically removed based on review settings.
A company uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) only for external guest users, while allowing internal employees to sign in without MFA. Which Conditional Access setting should be configured?
Require MFA for all users
Exclude internal users by group
Target the 'Guest or external users' identity type
Conditional Access policies allow targeting specific identity types, including 'Guest or external users'. This ensures the MFA requirement applies only to external users.
Use Identity Protection's user risk policy
A company wants to block all sign-ins using legacy authentication protocols because these protocols do not support multi-factor authentication (MFA). Which component of a Microsoft Entra ID Conditional Access policy should be configured to achieve this?
Cloud apps or actions
Conditions (Client apps)
The Conditions section includes a Client apps filter that can block legacy authentication protocols, effectively enforcing the use of modern authenticating clients.
Grant
Session
Want more Describe the capabilities of Microsoft Entra practice?
Practice this domainA security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?
Regulatory compliance dashboard
This dashboard directly provides compliance assessments against industry standards like CIS and NIST, showing which controls pass or fail.
Secure Score
Azure Policy
Microsoft Sentinel
An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?
Microsoft Defender for Cloud
Microsoft 365 Defender portal (security.microsoft.com)
This portal provides a unified view of threats across endpoints, email, identities, and apps, with integrated incident response.
Azure Sentinel
Microsoft Defender for Identity
A security team is evaluating Microsoft security solutions to monitor user activities across multiple SaaS applications, including Salesforce and Dropbox, for signs of compromised accounts and data exfiltration. Which solution is specifically designed for this purpose?
Microsoft Defender for Cloud Apps
Correct. Defender for Cloud Apps is designed as a CASB to monitor and protect SaaS applications like Salesforce and Dropbox from threats such as compromised accounts and data exfiltration.
Microsoft Defender for Endpoint
Microsoft Sentinel
Microsoft 365 Defender
A company manages Azure virtual machines and on-premises servers. The security team needs a single dashboard that provides a secure score and actionable recommendations to improve the security posture across both environments. Which Microsoft solution should be used?
Microsoft 365 Defender portal
Microsoft Defender for Cloud
Defender for Cloud delivers security posture management with secure score and recommendations for Azure, on-premises, and multi-cloud environments.
Microsoft Sentinel
Microsoft Defender for Cloud Apps
A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)
Microsoft Defender for Endpoint
Defender for Endpoint is a core component of Microsoft 365 Defender, providing endpoint security and threat detection.
Microsoft Defender for Cloud
Microsoft Defender for Office 365
Defender for Office 365 is included in Microsoft 365 Defender, protecting email and collaboration tools.
Microsoft Sentinel
A security analyst is using Microsoft 365 Defender to investigate a sophisticated multi-stage attack. The analyst needs to query data across endpoints, email, and identity logs to identify the attacker's behavior patterns and correlate events. Which Microsoft 365 Defender capability should the analyst use?
Automated investigation and response
Threat analytics
Advanced hunting
Advanced hunting uses KQL to query raw data from multiple Microsoft 365 Defender components, enabling custom threat hunting and correlation across data sources.
Action center
Want more Describe the capabilities of Microsoft security solutions practice?
Practice this domainA healthcare organization uses Microsoft Purview to protect patient health information (PHI). They need to identify sensitive data stored in Microsoft SharePoint Online and prevent unauthorized sharing. Which two Purview solutions should they implement? (Select all that apply.)
Data Classification
Data Classification (including automatic sensitivity labeling) helps identify and label PHI content in SharePoint Online.
Data Loss Prevention (DLP)
DLP policies can detect and prevent unauthorized sharing of files containing PHI, such as through external sharing links.
Insider Risk Management
Communication Compliance
A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?
Create new assessments for each regulation
Configure improvement actions with owners
Improvement actions represent individual controls that can be assigned to an owner for remediation, enabling automatic assignment and tracking.
Set up connectors to import external risk data
Use the Microsoft 365 admin center to delegate tasks
A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?
Data Lifecycle Management
eDiscovery (Premium)
Correct. eDiscovery (Premium) allows administrators to place holds on content locations, preventing deletion for the duration of a legal case, overriding any existing deletion policies.
Audit (Premium)
Communication Compliance
A company wants to automatically apply a 'Confidential' sensitivity label to any document that contains a credit card number, and also encrypt the document as part of the label. Which two components must be configured to achieve this? (Choose two.)
A sensitivity label with encryption settings
Correct. The sensitivity label must define the protection (encryption) that will be applied to documents containing credit card numbers.
A DLP policy that detects sensitive info
An auto-labeling policy
Correct. The auto-labeling policy applies the sensitivity label automatically to documents that match specified conditions (e.g., containing a credit card number).
A data classification dashboard
A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?
Data Loss Prevention (DLP)
Data Lifecycle Management
Data Lifecycle Management provides retention labels and policies to automatically retain data for a defined period and then delete it, meeting the regulatory requirement.
eDiscovery
Information Protection
A healthcare organization uses Microsoft 365 and wants to prevent users from sending emails that contain patient health information (PHI) to external recipients. Which Microsoft Purview solution should they implement?
Data Lifecycle Management
Data Loss Prevention (DLP)
DLP policies can inspect content in emails and files for sensitive data, and then block or warn users according to the configured rules.
Insider Risk Management
eDiscovery
Want more Describe the capabilities of Microsoft compliance solutions practice?
Practice this domainA security analyst is explaining the core principles of information security to a new team member. Which principle ensures that data is not modified by unauthorized parties?
Confidentiality
Integrity
Integrity ensures that data remains accurate and unaltered by unauthorized parties, preventing tampering.
Availability
Non-repudiation
A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?
Patching the physical servers hosting the database
Managing access controls and authentication for database users
The customer retains responsibility for managing user identities, permissions, and authentication to the database.
Securing the hypervisor running the virtual machines
Hardening the network firewalls at the datacenter perimeter
A security architect is adopting a new security model that assumes breach and verifies every access request. The model eliminates implicit trust and requires continuous validation. Which security model is being implemented?
Defense in Depth
Zero Trust
Zero Trust is based on the principle of 'never trust, always verify,' assumes breach, and verifies every access request regardless of location or network.
Least Privilege
Shared Responsibility
A company is migrating its on-premises workloads to Azure. The CISO wants to understand the division of security responsibilities between Microsoft and the customer across cloud service models. For which cloud service model does the customer have the most security responsibility?
Software as a Service (SaaS)
Platform as a Service (PaaS)
Infrastructure as a Service (IaaS)
In IaaS, the customer manages the virtual machines, operating systems, applications, and data, while the provider manages the physical hosts and network. This gives the customer the most security responsibility among cloud service models.
On-premises
A security architect is designing a new security posture based on the Zero Trust model. The architect wants to ensure that every access request is fully authenticated, authorized, and encrypted before granting access, and that access is granted only to the minimum necessary resources. Which three principles of Zero Trust align with these requirements? (Choose three.)
Verify explicitly
Correct. This principle states that every access request must be fully authenticated, authorized, and encrypted before granting access.
Least privilege access
Correct. This principle ensures users are granted only the minimum necessary access to perform their tasks, aligning with the requirement to grant access only to necessary resources.
Assume breach
Correct. Assume breach means minimizing the blast radius and segmenting access to limit damage if a breach occurs, supporting continuous verification and encryption.
Network segmentation
A company's security policy requires that customer data must only be accessible by authorized sales representatives. Which security principle does this requirement directly enforce?
Integrity
Availability
Confidentiality
Confidentiality is the principle of limiting access to data only to those who are authorized, which directly matches the requirement.
Non-repudiation
Want more Describe the concepts of security, compliance, and identity practice?
Practice this domainThe SC-900 exam has 50 questions and must be completed in 60 minutes. The passing score is 700/1000.
Conceptual questions on security, compliance, and identity concepts in Microsoft and Azure environments.
The exam covers 4 domains: Describe the capabilities of Microsoft Entra, Describe the capabilities of Microsoft security solutions, Describe the capabilities of Microsoft compliance solutions, Describe the concepts of security, compliance, and identity. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft SC-900 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.