SC-900 Practice Test 12 — 15 Questions

Question 1

A company uses Microsoft 365 and is concerned about phishing attacks targeting employees. They want to deploy a solution that can automatically analyze email messages for malicious links and attachments, and also provide click-time protection by rewriting URLs. Which Microsoft 365 Defender component should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct component because it is specifically designed to protect against email-borne threats such as phishing. It includes Safe Links and Safe Attachments features that automatically scan email messages for malicious links and attachments, and it rewrites URLs to provide click-time protection by checking the link against a dynamic threat intelligence feed at the moment of the click.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 2

A company wants to automatically apply a 'Confidential' sensitivity label to all documents containing credit card numbers. Which Microsoft Purview feature should be used to create the auto-labeling policy?

Accepted Answer

Microsoft Purview Auto-labeling policies. Microsoft Purview Auto-labeling policies are specifically designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This feature uses exact data match or pattern-based detection to label content at rest or in transit, fulfilling the requirement without manual intervention.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 3

A company's security policy requires that customer data must only be accessible by authorized sales representatives. Which security principle does this requirement directly enforce?

Accepted Answer

Confidentiality. The principle of confidentiality ensures that information is accessible only to authorized individuals or systems. In this scenario, restricting access to customer data to only authorized sales representatives aligns with maintaining confidentiality. The other options are incorrect: Integrity ensures data is not improperly modified, Availability ensures systems are operational, and Non-repudiation ensures actions cannot be denied.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 4

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

Accepted Answer

SAML 2.0. SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Answer

OAuth 2.0

Answer

SCIM

Answer

OpenID Connect

Question 5

A compliance administrator configures the above retention policy. A document created on January 1, 2025, in SharePoint Online will be retained until when?

Accepted Answer

December 31, 2025. The retention policy uses the 'When created' trigger, so a document created on January 1, 2025 is retained for 365 days from that date, expiring on December 31, 2025. Option A is incorrect because the retention period is finite. Option B is incorrect because the retention duration is 365 days from creation, not from the end of the year. Option D is incorrect because the retention period does not end on the creation date itself.

Answer

Indefinitely

Answer

January 1, 2026

Answer

January 1, 2025

Question 6

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email outside the company. Which type of DLP rule action should they configure?

Accepted Answer

Block. To prevent users from sharing credit card numbers via email outside the company, a DLP rule action of 'Block' is required. This action stops the email from being sent when sensitive content (e.g., credit card numbers) is detected, ensuring data exfiltration is prevented. The Block action can also be configured to show a policy tip to the user, but the core enforcement is the blocking of the message.

Answer

Notify

Answer

Audit only

Answer

Encrypt

Question 7

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default filters. You need to create a custom mail flow rule to block similar emails based on specific keywords in the subject line. Which tool should you use?

Accepted Answer

Exchange admin center. To create a custom mail flow rule (also known as a transport rule) that blocks emails based on specific keywords in the subject line, you must use the Exchange admin center (EAC). Mail flow rules are processed by the Exchange Online transport pipeline and are configured within the EAC or via Exchange Online PowerShell, not through the Microsoft 365 Defender portal, which focuses on threat policies and incident response rather than transport-level rule creation.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Cloud Apps portal

Answer

Microsoft Entra admin center

Question 8

A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?

Accepted Answer

Conditional Access policy feedback. Enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.

Answer

Self-Service Password Reset

Answer

Multifactor Authentication registration

Answer

Identity Protection risk policies

Question 9

An administrator needs to grant a vendor temporary access to an Azure subscription for exactly 48 hours. After that time, access must be automatically revoked. Which Microsoft Entra feature should be used?

Accepted Answer

Microsoft Entra Privileged Identity Management. Microsoft Entra Privileged Identity Management (PIM) allows administrators to configure just-in-time (JIT) access with time-bound activation and automatic expiration. By setting a maximum activation duration of 48 hours for a role assignment, PIM ensures the vendor's access is automatically revoked after that period without manual intervention.

Answer

Microsoft Entra External Identities

Answer

Microsoft Entra access reviews

Answer

Microsoft Entra Conditional Access

Question 10

Your company is implementing Microsoft Entra ID and wants to ensure that users can sign in using their existing social media accounts. Which feature should you configure?

Accepted Answer

External Identities. External Identities in Microsoft Entra ID allows you to configure identity providers for social media accounts (e.g., Google, Facebook) so users can sign in with their existing credentials. This is done by enabling federation with social identity providers via the External Identities blade, which uses OAuth 2.0 and OpenID Connect protocols to authenticate users without creating a separate Microsoft account.

Answer

B2B collaboration

Answer

Conditional Access

Answer

Identity Protection

Question 11

An organization wants to ensure that its security team can quickly identify and respond to threats across all workloads, including identities, endpoints, email, and cloud apps. Which Microsoft security solution provides a unified incident management experience?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified incident management experience across identities, endpoints, email, and cloud apps. Option A is wrong because Microsoft Sentinel is a SIEM that can ingest data from multiple sources but is not the native XDR solution. Option B is wrong because Microsoft Defender for Cloud protects cloud workloads only. Option D is wrong because Microsoft Defender for Identity focuses on identity threats only.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Question 12

A company is designing a Microsoft 365 Defender incident response workflow. They want to automatically isolate a compromised device when a ransomware alert is triggered. Which Microsoft 365 component should be used to execute the automated response action?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can isolate a device from the network when a ransomware alert is triggered. This is the correct component because it provides endpoint detection and response (EDR) with built-in playbooks for automatic containment actions like device isolation.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 13

A company uses Microsoft Entra ID for identity management. They want to allow employees to sign in using their existing Facebook credentials. Which feature should they configure?

Accepted Answer

Microsoft Entra External Identities. Microsoft Entra External Identities is the feature that allows configuring social identity providers like Facebook as authentication sources. While it is primarily designed for external users (guests/customers), it can also be used for internal employees if the organization chooses to allow federation with social identity providers. The question tests whether you know that External Identities handles social identity provider integration, regardless of the user type.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Question 14

A company is designing a data governance strategy using Microsoft Purview. They need to allow data owners to define custom attributes for data assets and control who can access those assets. Which Purview feature should they use?

Accepted Answer

Microsoft Purview Data Catalog. Microsoft Purview Data Catalog allows data owners to manage custom attributes and set access controls on data assets. Option A is wrong because Data Estate Insights provides monitoring, not governance. Option B is wrong because Data Policy enables policies on data sources, not asset-level custom attributes. Option D is wrong because Data Map is the underlying metadata store, not for end-user governance.

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Policy

Answer

Microsoft Purview Data Map

Question 15

A company uses Microsoft Entra ID. The security team needs to ensure that when users sign in to a critical financial application from an untrusted network, they must first complete multi-factor authentication (MFA). Additionally, the team wants to block the sign-in if the device is not marked as compliant by Microsoft Intune. Which conditional access grant control should they configure to meet both requirements?

Accepted Answer

Require multi-factor authentication AND Require device to be marked as compliant. Conditional Access grant controls allow you to require multiple conditions to be met simultaneously. By selecting 'Require multi-factor authentication' AND 'Require device to be marked as compliant', the policy ensures that both MFA and device compliance are enforced for the sign-in, meeting the security team's requirements.

Answer

Require multi-factor authentication only

Answer

Require one of the selected controls

Answer

Require device to be marked as compliant only