SC-900 Practice Test 10 — 10 Questions

Question 1

A company uses Microsoft Defender for Cloud to secure its hybrid cloud workload. The security team needs to ensure that all virtual machines (VMs) have Just-In-Time (JIT) VM access enabled. What should they use to enforce this across subscriptions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an Azure Policy initiative that requires JIT VM access. Azure Policy can enforce JIT VM access via a built-in initiative. Assigning an Azure Policy initiative across subscriptions ensures that any VM without JIT VM access enabled is non-compliant and can be remediated. Option B (Azure Blueprints) is an orchestration tool that can deploy resources but does not enforce configuration across subscriptions at scale. Option C (Defender for Cloud servers plan) enables security features but does not enforce specific settings like JIT. Option D (Secure Score recommendations) is advisory and does not enforce compliance.

Answer

Use Azure Blueprints to deploy JIT access configuration

Answer

Enable the Defender for Cloud servers plan

Answer

Implement a Secure Score recommendation for JIT access

Question 2

A multinational corporation must comply with GDPR and requires that personal data of EU users be retained for a maximum of 90 days after account closure. After that, all personal data must be permanently deleted. Which combination of Microsoft Purview capabilities should be used?

Accepted Answer

Create a retention label with a retention period of 90 days and then delete the content automatically. A retention label can be configured to retain data for a specified period (90 days) and then automatically trigger a disposition review or permanent deletion. This meets the GDPR requirement to retain data for 90 days and then delete it. Option B is correct. eDiscovery cases (A) are used for legal holds and searches, not automated lifecycle management. Sensitivity labels (C) do not enforce retention or deletion; they classify data. DLP policies (D) are designed to prevent unauthorized sharing, not to manage retention periods.

Answer

Configure an eDiscovery case to delete content after 90 days

Answer

Apply a sensitivity label that expires after 90 days

Answer

Use a Data Loss Prevention policy to block retention after 90 days

Question 3

Your organization is required to retain all HR-related documents for 7 years after an employee leaves. After that period, the documents must be permanently deleted. Which two Microsoft Purview features should you use together?

Accepted Answer

Retention labels and retention policies. Retention labels and retention policies. Retention labels allow you to apply retention settings (e.g., retain for 7 years then delete) to specific documents, while retention policies enforce those settings at the location level (e.g., all HR document libraries). Option A (eDiscovery and audit logs) is for search and audit, not retention. Option B (DLP policies and sensitivity labels) is for data protection and classification, not retention. Option C (Sensitivity labels and auto-labeling) is for classification and automated labeling, not retention.

Answer

eDiscovery and audit logs

Answer

DLP policies and sensitivity labels

Answer

Sensitivity labels and auto-labeling

Question 4

Your organization uses Microsoft Entra ID P2 and wants to reduce the risk of identity compromise by requiring multifactor authentication (MFA) for all users, but excluding users when they are on the corporate network. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies allow you to enforce MFA based on network location, user, and device conditions. Option A is correct because the policy can target all users and exclude trusted IPs (e.g., the corporate network). Option B is wrong because self-service password reset (SSPR) does not enforce MFA. Option C is wrong because Identity Protection detects risk but does not directly enforce MFA by location. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time access for privileged roles, not general MFA.

Answer

Self-service password reset (SSPR) policy

Answer

Identity Protection risk policy

Answer

Privileged Identity Management (PIM) activation policy

Question 5

A user reports that they cannot access a critical application, receiving an error that their session has expired. The sign-in logs show the user was prompted for multifactor authentication (MFA) multiple times during the same session. What should an administrator review to reduce these interruptions?

Accepted Answer

Microsoft Entra Conditional Access session controls. Session controls in Conditional Access policies can be configured to reduce repeated MFA prompts within the same session, such as by adjusting the sign-in frequency or persistent browser session settings. Option A is wrong because tenant-wide MFA settings enforce MFA globally but do not control session-specific behavior. Option C is wrong because Identity Protection focuses on risk-based policies, not directly on session lifetime. Option D is wrong because Privileged Identity Management manages role activation and assignment, not session controls.

Answer

Microsoft Entra tenant-wide MFA settings

Answer

Microsoft Entra Identity Protection policies

Answer

Microsoft Entra Privileged Identity Management settings

Question 6

A company has been fined for failing to respond to a data subject access request (DSAR) within the required timeframe. The compliance team needs to streamline the process of identifying and exporting personal data when a DSAR is received. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) provides advanced search, hold, and export capabilities for responding to DSARs. Data Lifecycle Management handles retention. Communication Compliance monitors communications. Compliance Manager assesses compliance posture but does not handle DSAR workflows.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 7

You find a JSON representation of a sensitivity label in a SharePoint document's metadata. The label indicates encryption is applied and access is restricted to finance@contoso.com. Based on this information, what is the effect of the label applied to the document?

Accepted Answer

The document is encrypted and can only be accessed by users in the finance@contoso.com group. A sensitivity label configured with encryption settings restricts access to the specified user or group. In this scenario, the label 'Confidential' is applied with encryption and the user/group set to 'finance@contoso.com', which encrypts the document and limits access to members of that group. Option B is incorrect because the label includes encryption, not just visual marking. Option C is incorrect because access is restricted to the finance group, not any user with the decryption key. Option D is incorrect because the label enforces encryption, not retention.

Answer

The document is only marked as confidential but not encrypted

Answer

The document is encrypted and can be accessed by any user with the decryption key

Answer

The document will be retained for a specified period

Question 8

You are a compliance administrator for a multinational corporation that uses Microsoft Purview. The company must comply with the General Data Protection Regulation (GDPR). You need to implement a solution that allows data subjects to request access to their personal data stored in Exchange Online, SharePoint Online, and OneDrive for Business. The solution must provide a centralized portal for data subjects to submit requests and for privacy officers to manage the entire process, including searching for data, reviewing results, and exporting or redacting data. You also need to ensure that requests are automatically routed to the appropriate privacy officer based on the data subject's region. Microsoft Purview has been licensed for the entire organization. What should you configure?

Accepted Answer

Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.. Microsoft Purview eDiscovery (Standard) allows for content searches across Exchange, SharePoint, and OneDrive, and can be used to manage GDPR data subject requests. However, the centralized portal and automated routing are features of Microsoft Purview eDiscovery (Premium), which includes case management, review sets, and advanced workflows. Therefore, the best option is to configure eDiscovery (Premium) cases with workflow automation. Option A is too basic. Option C is for data retention, not subject access requests. Option D is for classification, not access requests.

Answer

Use Microsoft Purview Information Protection to manually classify and search for personal data.

Answer

Configure Microsoft Purview eDiscovery (Standard) cases to manage each request manually.

Answer

Create retention labels and policies to retain personal data for GDPR compliance.

Question 9

Contoso uses Microsoft Sentinel. They want to automate response to a high-severity incident by blocking the source IP in Azure Firewall and sending a notification to the SOC team via email. Which feature should they use?

Accepted Answer

Create an automation rule.. Correct: Automation rules in Microsoft Sentinel can automatically trigger playbooks (e.g., to block an IP in Azure Firewall) and send notifications based on incident creation or update, meeting the requirement. Option A (hunting query) is for proactively searching for threats, not automated response. Option C (Fusion) is a correlation engine that detects multistage attacks but does not automate actions. Option D (workbook) is for visualization and reporting, not automation.

Answer

Create a hunting query.

Answer

Enable Fusion.

Answer

Create a workbook.

Question 10

Your company wants to use Microsoft Security Copilot to help analysts investigate security incidents. Which data source can Security Copilot ingest to provide contextual insights?

Accepted Answer

Alerts from Microsoft Defender XDR. Microsoft Security Copilot can directly ingest alerts from Microsoft Defender XDR to provide contextual insights for analysts investigating security incidents. Option B is incorrect because custom IoT device logs are not natively ingested by Security Copilot; they would typically require a SIEM or data connector. Option C is incorrect because while Security Copilot can use threat intelligence, third-party feeds are not a primary direct ingestion source. Option D is incorrect because on-premises firewall syslog is not directly ingested; Security Copilot primarily ingests data from Microsoft security products and Azure services.

Answer

Custom IoT device logs

Answer

Third-party threat intelligence feeds

Answer

On-premises firewall syslog