SC-900 Practice Test 12 — 15 Questions

Question 1

You are reviewing a Conditional Access policy JSON:

{
  "displayName": "Require MFA or compliant device for Office 365 from untrusted locations",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["Office365"]
    },
    "locations": {
      "includeLocations": ["All"],
      "excludeLocations": ["AllTrusted"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa", "compliantDevice"]
  }
}

What is the result of this policy?

Accepted Answer

Users from untrusted locations must complete MFA or use a compliant device to access Office 365. The policy JSON grants access to Office 365 if the user is from an untrusted location and either completes MFA or uses a compliant device. This matches option B exactly. The 'OR' condition between MFA and compliant device is key, and the scope is limited to Office 365, not all cloud apps.

Answer

All users must complete MFA to access all cloud apps

Answer

Users must complete MFA and use a compliant device from all locations

Answer

Users from trusted locations must complete MFA and use a compliant device

Question 2

Your organization must ensure that financial reports are protected with encryption and cannot be forwarded. Which two Microsoft Purview features should you combine?

Accepted Answer

Sensitivity labels with encryption and Data Loss Prevention. Sensitivity labels with encryption allow you to apply persistent encryption to financial reports, ensuring they remain protected even when shared. Data Loss Prevention (DLP) policies can then block or warn users from forwarding these encrypted reports via email or other channels, providing a combined solution for encryption and forwarding prevention.

Answer

Data Lifecycle Management and Data Loss Prevention

Answer

Retention policies and Records Management

Answer

Information Barriers and Communication Compliance

Answer

eDiscovery (Premium) and Audit (Standard)

Question 3

A company uses Azure virtual machines and on-premises Windows servers. The security team wants a single solution that provides vulnerability assessment, a regulatory compliance dashboard (e.g., for ISO 27001), and integrated threat detection such as fileless malware and anomalous logins. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) is the correct choice because it provides unified security management across Azure VMs and on-premises servers. It includes built-in vulnerability assessment (via Qualys or Microsoft Defender Vulnerability Management), a regulatory compliance dashboard with built-in standards like ISO 27001, and integrated threat detection for fileless malware, anomalous logins, and other advanced attacks. This single solution meets all the requirements listed in the question.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Question 4

Which TWO of the following are capabilities of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that aggregates log data from across an organization to detect, investigate, and respond to threats. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response workflows.

Answer

Endpoint detection and response (EDR)

Answer

Vulnerability scanning

Answer

Data classification and labeling

Question 5

A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.

Answer

Data Loss Prevention (DLP)

Answer

Audit

Answer

Compliance Manager

Question 6

A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.

Answer

App Governance

Answer

Information Protection

Answer

Conditional Access App Control

Question 7

A company hosts a line-of-business application on an Azure virtual machine. The IT team is responsible for configuring the operating system, installing security updates, and managing the application code. An auditor asks who is responsible for the physical security of the data center where the virtual machine runs. According to the shared responsibility model for cloud services, who is responsible?

Accepted Answer

Microsoft. Under the shared responsibility model, Microsoft is responsible for the physical security of its Azure data centers, including access controls, surveillance, and environmental safeguards. The customer is responsible for securing the virtual machine's operating system, applications, and data, but not the physical infrastructure. Therefore, Microsoft retains responsibility for physical security even when the customer manages the guest OS and application.

Answer

The customer

Answer

Both the customer and Microsoft equally

Answer

Neither – physical security is no longer needed in the cloud

Question 8

An organization needs to detect and address potential policy violations in Microsoft Teams chat messages and channel conversations. They want to configure a policy that automatically scans for keywords related to confidential information and for sensitive data patterns like credit card numbers. When a violation is found, the policy should notify the user and their manager, and optionally escalate to a designated reviewer. Which Microsoft Purview solution should they configure?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and other communication channels by scanning for keywords and sensitive data patterns (e.g., credit card numbers). It can automatically notify the user and their manager, and optionally escalate violations to a designated reviewer for remediation, directly matching the organization's requirements.

Answer

Data Lifecycle Management

Answer

eDiscovery

Answer

Audit

Question 9

An organization uses Microsoft Entra ID. The security team wants to require multi-factor authentication (MFA) for users who sign in from sessions that Microsoft Entra ID Protection determines to have medium or high sign-in risk. Users signing in from low-risk sessions should not be prompted for MFA. Which feature should the security team configure?

Accepted Answer

Configure a Conditional Access policy with Sign-in risk as a condition and MFA as a grant control. A Conditional Access policy can use Sign-in risk (a condition from Microsoft Entra ID Protection) to require MFA as a grant control. This allows the security team to enforce MFA only for sessions with medium or high sign-in risk, while low-risk sessions are not prompted, exactly matching the requirement.

Answer

Configure a user risk policy in Microsoft Entra ID Protection

Answer

Assign the Global Administrator role with Privileged Identity Management (PIM) activation requiring MFA

Answer

Create an access review in Microsoft Entra ID Governance

Question 10

An organization uses Microsoft Entra ID Protection. A user's sign-in is flagged with a risk level of 'High' because of an anonymous IP address. The administrator wants to automatically block the sign-in while allowing the user to self-remediate. Which should be configured?

Accepted Answer

A sign-in risk policy configured to block access. A sign-in risk policy in Microsoft Entra ID Protection can be configured to automatically block access when a sign-in is detected as high risk (e.g., from an anonymous IP address). This policy operates at the sign-in level, allowing the administrator to block the sign-in while still enabling the user to self-remediate (e.g., by signing in again after the risk is mitigated). Option C directly matches this requirement.

Answer

A Conditional Access policy requiring MFA for high-risk sign-ins

Answer

A user risk policy configured to require a password change

Answer

An MFA registration policy for all users

Question 11

A Microsoft Purview retention policy is configured to retain emails for 365 days and then delete them. What will happen to emails after 365 days?

Accepted Answer

Emails will be retained for 365 days and then deleted. The retention policy is configured to retain emails for 365 days and then delete them. In Microsoft Purview, when a retention policy specifies a retention period followed by a deletion action, content is preserved for the entire duration and then permanently removed at the end of the period. Therefore, after 365 days, the emails will be deleted automatically.

Answer

Emails will be deleted immediately

Answer

Emails will be retained and then reviewed for deletion

Answer

Emails will be kept indefinitely

Question 12

A company uses Microsoft Entra ID and wants to enforce multifactor authentication (MFA) for all users accessing a sensitive customer relationship management (CRM) application, but only when the access request originates from outside the corporate network. Which component of a Conditional Access policy should the administrator configure to specify this location-based requirement?

Accepted Answer

Conditions. The 'Conditions' section of a Conditional Access policy allows administrators to define the circumstances under which the policy is applied, including the location from which an access request originates. By configuring a location condition, you can specify that MFA is enforced only when users access the CRM application from outside the corporate network, using named locations or IP ranges. This is the correct component to enforce the location-based requirement.

Answer

Assignments

Answer

Grant controls

Answer

Session controls

Question 13

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically block sign-ins from users whose credentials have been compromised and require them to change their password before access is granted. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct capability because it automatically detects compromised credentials by analyzing telemetry from Microsoft's Threat Intelligence and the wider ecosystem. When a user's credentials are found in a known leak, Entra ID Protection can enforce a policy that blocks sign-in and requires the user to change their password via an integrated remediation workflow, directly addressing the scenario.

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Answer

Self-Service Password Reset (SSPR)

Question 14

A legal team is handling a lawsuit and needs to gather all electronically stored information (ESI) related to a specific case from across Microsoft 365, including emails, Teams messages, and SharePoint documents. They need to place a hold on the custodians' data to prevent deletion or modification, and then collect, review, and export the data. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal cases, including the ability to place legal holds on custodians' data across Exchange, Teams, SharePoint, and OneDrive to preserve ESI, and then collect, review, and export that data. The Premium tier adds advanced features like custodian management, review sets, and predictive coding, which are essential for complex litigation scenarios.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Data Lifecycle Management

Question 15

A company wants to deploy a single security operations portal that provides a unified view of alerts and incidents from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Which Microsoft portal should the security team use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (https://security.microsoft.com) is the correct answer because it provides a unified security operations center (SOC) experience, aggregating alerts and incidents from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This portal enables security teams to triage, investigate, and respond to cross-domain threats in a single pane of glass, leveraging automated incident correlation and advanced hunting capabilities.

Answer

Azure Portal

Answer

Microsoft 365 admin center

Answer

Azure Active Directory admin center