SC-900 Practice Test 13 — 15 Questions

Question 1

Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a DLP policy in Microsoft Purview that detects sensitive data types and blocks Copilot actions. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data types (e.g., credit card numbers, social security numbers) and automatically block or warn when Copilot for Microsoft 365 attempts to access or generate content containing such data. Option A is incorrect because Microsoft Defender for Cloud Apps is designed to control cloud app usage, but it does not integrate directly with Copilot for content-level data loss prevention. Option B is incorrect because disabling Copilot for certain users is a blunt approach that impacts productivity and does not provide targeted protection against data leakage. Option C is incorrect because while sensitivity labels help classify data, they alone do not prevent Copilot from accessing or generating sensitive content; DLP policies are required to enforce protection based on those labels.

Answer

Configure Microsoft Defender for Cloud Apps to control Copilot

Answer

Disable Copilot for users who handle sensitive data

Answer

Apply sensitivity labels to all documents containing sensitive data

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Microsoft 365 resources. You have configured a Conditional Access policy in Microsoft Entra ID that requires devices to be marked as compliant. However, some users report that they can still access email on their non-compliant Android devices. You need to troubleshoot and resolve the issue. What should you do?

Accepted Answer

Check the Conditional Access policy is enabled and includes 'Office 365 Exchange Online' as a cloud app, and that the users have the appropriate licenses for Intune.. The Conditional Access policy must be enabled and configured to include 'Office 365 Exchange Online' as a cloud app, and the affected users need to have Intune licenses assigned. If the policy is not enabled or does not target the correct app, non-compliant devices may still access email. Option A is incorrect because requiring compliance is the correct setting, not blocking; blocking is a separate action. Option C is incorrect because even if devices are enrolled, the policy must include the correct cloud app and users. Option D is incorrect because while the policy must include users, the primary issue is typically the policy not covering Exchange Online or missing licenses.

Answer

Change the Conditional Access policy to block access for non-compliant devices instead of requiring compliance.

Answer

Ensure that the Android devices are enrolled in Microsoft Intune and have a compliance policy assigned.

Answer

Verify that the Conditional Access policy includes the users who are accessing email.

Question 3

Contoso Pharmaceuticals is implementing Microsoft Purview to meet regulatory compliance (HIPAA and GDPR). They need to: (1) automatically classify and protect patient health information (PHI) and personally identifiable information (PII) in Exchange Online, SharePoint Online, and OneDrive for Business; (2) detect and prevent unauthorized sharing of sensitive data; (3) retain audit logs for 7 years; and (4) allow users to manually apply classification labels to documents. The company has 5,000 users and uses Microsoft 365 E5 licenses. The security team wants to minimize manual effort and ensure consistent protection. What should the compliance administrator configure first?

Accepted Answer

Create sensitivity labels with auto-labeling policies configured to detect PHI and PII, and publish them via label policies.. Sensitivity labels with auto-labeling policies can automatically classify and protect PHI and PII across Exchange Online, SharePoint Online, and OneDrive for Business, meeting the requirement for automated classification and consistent protection. Option A is wrong because DLP policies detect and prevent unauthorized sharing but do not classify or label data. Option C is wrong because retention policies only manage data retention, not classification or protection. Option D is wrong because auditing logs activities but does not classify or protect content.

Answer

Configure Data Loss Prevention (DLP) policies to block sharing of content containing PHI and PII.

Answer

Set up retention policies for Exchange, SharePoint, and OneDrive to retain data for 7 years.

Answer

Enable auditing for all workloads and configure alert policies for unauthorized access.

Question 4

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that:
- Prevents unauthorized sharing of privileged documents via email.
- Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them.
- Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats.
- Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted.
- Provides the ability to search for privileged documents in case of a legal hold.
What should you configure?

Accepted Answer

Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery. It combines all required capabilities: Sensitivity labels with encryption allow lawyers to classify documents as 'Privileged' and automatically encrypt them; DLP prevents unauthorized sharing of privileged documents via email; Communication Compliance monitors Teams chats for accidental exposure; Data Lifecycle Management retains privileged documents for 7 years after case closure and then automatically deletes them; eDiscovery provides the ability to search for privileged documents in case of a legal hold. Option B is incorrect because it lacks Sensitivity labels (needed for classification and encryption) and includes Audit (Standard) which does not provide the retention or search capabilities of Data Lifecycle Management and eDiscovery. Option C is incorrect because Insider Risk Management focuses on detecting risky user activities but does not enable lawyers to classify or encrypt documents, and it is not designed for monitoring Teams chats for privilege exposure; Communication Compliance is needed for that. Option D is incorrect because Information Barriers restrict communication between specific groups to prevent information sharing, but does not monitor for accidental exposure in Teams; Communication Compliance is required for that monitoring.

Answer

DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

Answer

Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

Answer

Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

Question 5

An organization stores sensitive customer data in a cloud database. The security team uses encryption to protect the data while it is stored and while it is transmitted. They also implement role-based access control to ensure only authorized users can modify the data. Which two security principles are primarily being upheld by these actions?

Accepted Answer

Confidentiality and integrity. Encryption at rest and in transit directly protects confidentiality by preventing unauthorized access to sensitive data. Role-based access control (RBAC) ensures only authorized users can modify data, which upholds integrity by preventing unauthorized or accidental changes. Availability, which concerns system uptime and accessibility, is not primarily addressed by these measures.

Answer

Availability and integrity

Answer

Confidentiality and availability

Answer

Privacy and accountability

Question 6

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to enforce that only compliant and managed devices can access corporate email in Microsoft 365. Additionally, if a device is jailbroken, access should be blocked. You also want to provide a seamless sign-in experience for compliant devices. You have Microsoft Entra ID P1 licenses. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance and use Intune compliance policies to block jailbroken devices, with seamless SSO.. It combines Conditional Access policies in Microsoft Entra ID with Intune compliance policies. Conditional Access can require device compliance, and Intune compliance policies can block jailbroken devices. Seamless SSO provides a frictionless sign-in experience for compliant devices. Option A is incorrect because MAM policies manage app-level protection without device enrollment, but they do not enforce device compliance or block jailbroken devices. Option B is incorrect because Azure AD Join registers devices but does not automatically enforce compliance policies or block jailbroken devices. Option D is incorrect because Microsoft Defender for Endpoint is a threat protection solution and does not directly manage device compliance or conditional access.

Answer

Configure Mobile Application Management (MAM) policies to restrict access.

Answer

Configure Azure AD Join for all devices and enable device registration.

Answer

Configure Microsoft Defender for Endpoint to detect jailbroken devices.

Question 7

You are the compliance administrator for a healthcare organization that must comply with HIPAA. You need to automatically detect and prevent patients' protected health information (PHI) from being shared via email. Additionally, you need to retain all emails containing PHI for 6 years. You also need to allow users to manually classify documents as 'Medical Record' with encryption that expires after 30 days. Which combination of Microsoft Purview solutions should you implement?

Accepted Answer

Data Loss Prevention (DLP) policy to block PHI; retention policy for 6 years on emails containing PHI; sensitivity label with encryption and expiration. DLP policies detect and prevent sharing of PHI via email; a retention policy retains emails containing PHI for 6 years; a sensitivity label allows users to manually apply encryption with expiration. Option B is incorrect because eDiscovery is for search and export, not for retention; retention is handled by a retention policy, not eDiscovery. Option C is incorrect because communication compliance monitors for policy violations but does not prevent sharing; additionally, a retention label alone does not enforce retention (a retention policy or auto-apply label policy would be needed). Option D is incorrect because it lacks a manual label with encryption and expiration; auto-labeling can apply retention but not encryption with expiration.

Answer

Data Loss Prevention (DLP) policy to block PHI; eDiscovery to retain emails; sensitivity label with encryption

Answer

Retention label for 6 years; sensitivity label with encryption; communication compliance to monitor sharing

Answer

Data Loss Prevention (DLP) policy to block PHI; auto-labeling policy to apply retention label; no manual label needed

Question 8

Which TWO capabilities are provided by Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Secure score and security recommendations. Microsoft Defender for Cloud provides a secure score that quantifies your security posture based on implemented controls, and it generates actionable security recommendations to remediate misconfigurations. Additionally, it offers vulnerability assessment for VMs, which identifies and helps remediate vulnerabilities in virtual machines. These are two distinct core capabilities of Defender for Cloud, while EDR, CASB, and SIEM are provided by other Microsoft security products.

Answer

Endpoint detection and response (EDR)

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Question 9

Which THREE actions can Microsoft Sentinel perform as part of automated incident response using playbooks?

Accepted Answer

Block an IP address on a firewall. Microsoft Sentinel playbooks, built on Azure Logic Apps, can automate responses to security incidents. Blocking an IP address on a firewall is a common automated action because Logic Apps connectors exist for many firewall vendors (e.g., Palo Alto, Fortinet), allowing Sentinel to trigger a block action directly from a playbook. Resetting a user's password is possible using connectors like Azure AD, enabling automated password resets as part of incident response. Creating an incident in ServiceNow is supported via the ServiceNow connector, allowing integration with IT service management (ITSM) systems. These three actions leverage available Logic Apps connectors, while installing software or modifying NSG rules are not standard actions supported by Sentinel playbooks.

Answer

Install anti-malware software on a device

Answer

Modify a network security group rule

Question 10

Refer to the exhibit. You are analyzing a Microsoft Purview Data Lifecycle Management retention policy. What is the outcome of this policy?

Accepted Answer

Content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted. The exhibit shows a Microsoft Purview Data Lifecycle Management retention policy scoped to the HR department with a retention period of 365 days and a deletion action at the end. Therefore, content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted, matching option A.

Answer

Content from the HR department in Exchange and SharePoint is deleted after 90 days

Answer

Content from all employees in Exchange and SharePoint is retained for 365 days

Answer

Content from the HR department in Exchange and SharePoint is retained for 365 days

Question 11

A user reports that they are unable to sign in to a SaaS application that is configured for single sign-on (SSO) with Microsoft Entra ID. The user can sign in to other applications. What should you check first?

Accepted Answer

Check if the user is assigned to the application in Microsoft Entra ID.. The most common cause of SSO failure for a single application, when the user can sign in to other apps, is that the user has not been assigned to that specific application in Microsoft Entra ID. Without explicit assignment, the user cannot authenticate via SSO even if their account is active and licensed. This is a core requirement for application-level access control in Entra ID.

Answer

Confirm the user's account is not disabled.

Answer

Verify that the user has reset their password recently.

Answer

Ensure the user has an appropriate Microsoft 365 license.

Question 12

Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel (option D) is correct because it is a cloud-native SIEM and SOAR platform that ingests logs from across the entire environment—including email, endpoints, and identity sources—to detect and respond to threats using analytics and automated playbooks. Microsoft Defender XDR (option E) is correct because it is a unified, pre- and post-breach detection and response solution that correlates signals across email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and identities (Microsoft Defender for Identity).

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview

Question 13

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor onboarding. The PowerShell output shows the 'OnboardingState' value is 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. Intune uses the Defender for Endpoint sensor as a compliance signal; if the sensor is not properly onboarded, the device will report as non-compliant regardless of other security settings.

Answer

Antivirus protection

Answer

Antispyware protection

Answer

Microsoft Defender Antivirus real-time protection

Question 14

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

Accepted Answer

The email is blocked, and the user receives a policy tip notification.. The DLP policy is configured to block external sharing when credit card numbers are detected. When a user sends an email with a credit card number to an external recipient, the email is blocked and the user receives a policy tip notification. Option A is incorrect because the email is not delivered. Option B is incorrect because the email is blocked, not delivered with a justification prompt. Option C is incorrect because the policy blocks external recipients regardless of internal allowance.

Answer

The email is delivered, but the user receives a warning.

Answer

The email is delivered, and the user is asked to provide a business justification.

Answer

The email is blocked, but only if the recipient is external and internal recipients are allowed.

Question 15

A company wants to allow external business partners to access a specific SharePoint Online site using their own corporate identities (such as Google or Facebook accounts). The company also needs to enforce multi-factor authentication (MFA) for these external users. Which Microsoft Entra capability should the administrator configure?

Accepted Answer

Microsoft Entra External Identities (B2B collaboration). Microsoft Entra External Identities (B2B collaboration) allows you to invite external users (including those with social identities like Google or Facebook) to access your organization's resources using their own identities. It supports conditional access policies, including the enforcement of multi-factor authentication (MFA) for guest users, which meets both requirements.

Answer

Microsoft Entra Connect

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)