SC-900 Practice Test 13 — 15 Questions

Question 1

A security team is evaluating Microsoft security solutions to monitor user activities across multiple SaaS applications, including Salesforce and Dropbox, for signs of compromised accounts and data exfiltration. Which solution is specifically designed for this purpose?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides deep visibility, data classification, and threat detection across SaaS applications like Salesforce and Dropbox. It uses behavioral analytics and anomaly detection to identify compromised accounts and data exfiltration by monitoring user activities and applying policies such as activity policies and app governance.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft 365 Defender

Question 2

A company uses Microsoft Entra ID (Microsoft Entra ID) to manage user access to cloud applications. The security team wants to enforce that users must provide a second form of authentication, such as a phone call or mobile app notification, in addition to their password. Which Microsoft Entra capability should they enable?

Accepted Answer

Multi-Factor Authentication. Multi-Factor Authentication (MFA) is the correct capability because it requires users to provide a second form of authentication (e.g., phone call, mobile app notification) in addition to their password. This directly addresses the security team's requirement for a second authentication factor, which is the core function of MFA in Microsoft Entra ID.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management

Question 3

A security architect is designing a defense strategy for the organization's network. The architect assumes that an attacker may already have breached the perimeter and is operating inside the network. Therefore, the design does not automatically trust any user or device, even if they are inside the corporate network, and requires continuous verification for every access request. Which security principle does this approach best represent?

Accepted Answer

Zero Trust. The Zero Trust security principle is based on the assumption that an attacker may already be inside the network, so no user or device is automatically trusted, regardless of location. This model requires continuous verification for every access request, enforcing strict identity verification and least-privilege access controls at each step. The scenario directly describes the core tenet of Zero Trust: 'never trust, always verify.'

Answer

Defense in depth

Answer

Shared responsibility

Answer

Least privilege

Question 4

A security administrator at an organization using Microsoft Entra ID needs to automatically detect user sign-ins that exhibit risky behavior, such as signing in from a suspicious IP address or using leaked credentials. The administrator also wants the system to automatically calculate a risk level for each user and take actions like requiring a password reset when risk is high. Which Microsoft Entra ID feature should the administrator use?

Accepted Answer

Identity Protection. Microsoft Entra ID Protection is the correct feature because it automatically detects risky sign-in behaviors—such as sign-ins from suspicious IP addresses, anonymous IP addresses, or leaked credentials—and calculates a user risk level. It can then automatically trigger remediation actions like requiring a password reset when the risk level is high, directly matching the administrator's requirements.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Answer

Identity Governance

Question 5

A security manager explains that the company's security strategy relies on multiple layers of controls, such as firewalls, antivirus software, and multi-factor authentication, so that if one layer fails, another can still prevent an attack. Which security principle does this strategy best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct answer because it explicitly describes a layered security strategy where multiple independent controls (firewalls, antivirus, MFA) are deployed so that if one layer is bypassed or fails, subsequent layers still provide protection. This principle is foundational to modern security architecture and directly matches the scenario of using diverse controls to prevent a single point of failure.

Answer

Least privilege

Answer

Zero Trust

Answer

Separation of duties

Question 6

An organization is moving a virtual machine to Azure Infrastructure as a Service (IaaS). According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Applying security updates to the guest operating system. In an IaaS deployment, the customer retains responsibility for securing the guest operating system, including applying security updates. Microsoft manages the physical infrastructure and hypervisor, while the customer must patch and configure the OS running inside the virtual machine.

Answer

Physical security of the datacenter

Answer

Maintaining the hypervisor

Answer

Power and cooling infrastructure

Question 7

A security manager wants to ensure that an employee who sends an email cannot later deny having sent it. Which security concept and associated technology is best suited to achieve this?

Accepted Answer

Non-repudiation, achieved through digital signatures. Non-repudiation ensures that a party cannot deny an action, such as sending an email. Digital signatures, which use asymmetric cryptography (e.g., RSA or ECDSA) and a hash of the message, provide cryptographic proof of the sender's identity and message integrity, making denial impossible.

Answer

Confidentiality, achieved through encryption

Answer

Integrity, achieved through hashing

Answer

Access control, achieved through permissions

Question 8

An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)

Accepted Answer

Physical security of the datacenters. In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.

Answer

Patching the guest operating system on the VM

Answer

Configuring network security group (NSG) firewall rules

Question 9

A security team is using Microsoft Entra ID Protection. They want to automatically block sign-ins from known malicious IP addresses, but if a user's account is compromised (e.g., leaked credentials), they want to force the user to change their password upon next sign-in. Which two risk policies should they configure? (Select all that apply.)

Accepted Answer

Sign-in risk policy set to 'Block access' for High risk. Option A is correct because the sign-in risk policy in Microsoft Entra ID Protection can be configured to automatically block access when a sign-in is detected as high risk, such as from a known malicious IP address. This policy evaluates real-time risk signals during authentication and enforces the specified action (e.g., 'Block access') without requiring additional Conditional Access policies.

Answer

MFA registration policy

Answer

Conditional Access policy with a custom block rule

Question 10

An organization uses Microsoft 365 Defender and wants to automate the investigation and response to common email-based phishing attacks. They want the system to automatically take actions such as deleting malicious emails from user inboxes across the organization after analysis. Which Microsoft 365 Defender component provides this automated capability?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed for email-based threats like phishing. When a phishing email is detected, AIR can automatically trigger remediation actions—such as soft-deleting or hard-deleting the malicious message from user mailboxes—based on predefined playbooks, without requiring manual intervention.

Answer

Azure AD Identity Protection

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 11

A financial services organization needs to automatically classify and protect sensitive documents containing credit card information in SharePoint Online and OneDrive for Business. They want a purple-colored label to be applied automatically when the document is saved, and the document should be encrypted with a predefined template that restricts editing to internal users only. Which Microsoft Purview solution should they configure?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview can automatically apply a purple-colored label to documents containing credit card information when saved in SharePoint Online or OneDrive for Business. This label can be configured with encryption using a predefined template that restricts editing to internal users only, meeting the organization's classification and protection requirements.

Answer

Data Loss Prevention (DLP) policies

Answer

Data Lifecycle Management (retention labels)

Answer

Audit (Unified Auditing)

Question 12

An organization uses Microsoft Entra ID to manage user access. The security policy requires that membership in the 'Finance - Sensitive Data' group must be reviewed every quarter by the group owner to confirm that each member still requires access. The group owner must approve or deny each membership, and any denied memberships should be automatically removed. Which Microsoft Entra ID feature should be configured to automate this process?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews is the correct feature because it enables periodic review of group memberships, where the group owner can approve or deny each member's continued access. When a member is denied, Access Reviews can be configured to automatically remove that user from the group, satisfying the security policy's requirement for quarterly reviews and automatic removal of denied memberships.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Protection

Question 13

An organization runs workloads in Azure, an on-premises data center, and multiple third-party cloud environments. The security team needs a single, cloud-native solution that provides a unified view of the security posture across all these environments, along with a secure score and actionable recommendations. They also want to protect these workloads with advanced threat detection. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct choice because it provides a unified cloud-native security posture management (CSPM) solution that covers Azure, on-premises, and multi-cloud environments (including AWS and GCP). It delivers a secure score based on security controls and actionable recommendations via Azure Policy, and includes advanced threat detection (e.g., fileless attack detection, network anomaly detection) for workloads across these environments.

Answer

Microsoft Sentinel

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Endpoint

Question 14

Sequence the steps to set up Microsoft Sentinel for a new workspace.

Question 15

A security administrator is configuring permissions for a new cloud-based expense reporting application. The administrator assigns each employee only the permissions they need to perform their job functions. For example, employees in the Sales department can view expense reports but cannot approve or modify financial data. Which security principle is the administrator implementing?

Accepted Answer

Least privilege. The administrator is granting each employee only the permissions necessary to perform their job functions, such as Sales being able to view but not approve or modify financial data. This directly implements the principle of least privilege, which restricts access rights to the minimum required for legitimate tasks. In cloud-based applications like expense reporting systems, least privilege reduces the attack surface and limits potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust