SC-900 Practice Test 15 — 15 Questions

Question 1

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Answer

Self-Service Password Reset (SSPR)

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 2

A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data collection agent for Microsoft Sentinel that supports collecting security logs from Windows and Linux on-premises servers. It replaces the legacy Microsoft Monitoring Agent (MMA) and provides a more secure, scalable, and performant method to send logs to Azure Log Analytics workspaces, which underpin Sentinel.

Answer

Syslog connector

Answer

Microsoft Monitoring Agent (MMA)

Answer

Office 365 connector

Question 3

A company uses Microsoft Entra ID (Azure AD). They have a cloud-based HR system (e.g., Workday) that contains employee records. They want to automate the process of creating user accounts in Microsoft Entra ID for new hires and deactivating accounts for terminated employees based on information from the HR system. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra Application Provisioning. Microsoft Entra Application Provisioning (specifically HR-driven provisioning) is the correct feature because it automates the creation, update, and deactivation of user accounts in Microsoft Entra ID based on changes in an external HR system like Workday. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize employee lifecycle events from the HR source to Entra ID, enabling fully automated user provisioning without manual intervention.

Answer

Microsoft Entra Connect

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra Access Reviews

Question 4

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention, while maintaining security by requiring multi-factor authentication (MFA) during the reset process. Which feature should you enable?

Accepted Answer

Microsoft Entra self-service password reset (SSPR).. Microsoft Entra self-service password reset (SSPR) is the feature specifically designed to allow users to reset their own passwords without help desk intervention. When combined with Microsoft Entra Multi-Factor Authentication (MFA) as a registration and reset requirement, SSPR enforces MFA during the reset process, meeting both the self-service and security requirements.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra Multi-Factor Authentication.

Answer

Conditional Access policies.

Question 5

A company is involved in litigation and needs to preserve all Exchange Online mailboxes and SharePoint sites related to the case. The legal team also requires the ability to search, review, and export relevant content. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, reviewing, and exporting content from Exchange Online mailboxes and SharePoint sites. It supports legal hold placement on custodians and data sources, advanced search with keyword and proximity queries, review sets with analytics, and export in a format suitable for litigation. This directly matches the requirement to preserve all relevant mailboxes and sites while enabling the legal team to search, review, and export content.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Premium)

Question 6

Your organization uses Microsoft Sentinel as a SIEM. You need to collect security events from on-premises servers. Which connector should you use?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct connector because it is the primary agent for collecting security events from on-premises Windows and Linux servers into a Log Analytics workspace, which Microsoft Sentinel uses as its data source. AMA supports data collection rules (DCRs) to filter and route specific security event IDs, replacing the legacy Log Analytics agent. This enables Sentinel to ingest Windows Security Events (e.g., Event ID 4625 for failed logons) for threat detection and incident creation.

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Answer

Log Analytics workspace

Question 7

A company has several custom-developed web applications hosted on-premises. The company wants to provide employees with secure remote access to these applications without deploying a traditional VPN. Employees should be able to sign in using their existing Microsoft Entra ID credentials, and the solution should pass through multi-factor authentication policies. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It allows employees to sign in with their existing Microsoft Entra ID credentials and enforces conditional access policies, including multi-factor authentication, without requiring a traditional VPN.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 8

Refer to the exhibit. A sensitivity label is configured as shown. A user applies the parent label to a document containing credit card numbers. What is the expected behavior?

Accepted Answer

The document gets the parent label's encryption (ViewOnly) and header, but no watermark. When a user manually applies a parent sensitivity label that has sublabels, only the parent label's settings (encryption and header) are applied. The sublabel's watermark is not applied because sublabels are separate entities that must be explicitly selected; they are not automatically inherited or triggered by applying the parent label. The encryption (ViewOnly) and header come from the parent label's configuration, while the watermark belongs to the sublabel and is not applied.

Answer

The document gets the parent label's header and the sublabel's encryption and watermark

Answer

The document gets no protection because credit card numbers are only detected by auto-labeling

Answer

The document gets the parent label's encryption and header, and auto-labeling applies the sublabel

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.

Answer

Activity policy

Answer

App discovery policy

Answer

Session policy

Question 10

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are the correct Microsoft Purview capability to prevent sensitive data from being inadvertently shared during Copilot interactions. DLP policies can inspect content in real time, including Copilot prompts and responses, and apply actions such as blocking or warning when sensitive information types (e.g., credit card numbers, social security numbers) are detected. This directly addresses the requirement to prevent inadvertent sharing of sensitive data within the Copilot environment.

Answer

Customer Lockbox

Answer

Sensitivity labels

Answer

eDiscovery

Question 11

Contoso has a hybrid identity with AD DS synced to Microsoft Entra ID. They want to block legacy authentication protocols that bypass MFA. Which security solution should they use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID can be configured to block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic authentication) by targeting client apps that do not support modern authentication. This directly prevents bypass of MFA because legacy protocols do not support MFA challenges, making them a common attack vector. By creating a policy that blocks all access from legacy authentication clients, Contoso enforces MFA for all sign-ins that use modern authentication.

Answer

Microsoft Entra Password Protection

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect Health

Question 12

Your legal team needs to search for all emails from a specific executive that mention a project name 'ProjectX' for a litigation hold. Which Microsoft Purview tool should they use?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery (specifically Content Search or eDiscovery (Premium)) is the correct tool because it is designed to search across Exchange Online mailboxes, SharePoint sites, and other data sources for specific content like emails containing 'ProjectX' from a specific executive. This capability directly supports litigation holds by allowing you to identify, preserve, and export relevant data. Communication Compliance focuses on policy-based detection of inappropriate communications, not ad-hoc searches for litigation.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Question 13

Your organization needs to audit all changes to sensitive files in SharePoint Online for at least 180 days. Which Microsoft Purview feature should be enabled?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides the extended retention of audit logs (up to 10 years) and the ability to search for high-value events such as changes to sensitive files. For a requirement of at least 180 days, Audit (Premium) is necessary because standard audit logs are retained for only 90 days. This feature logs all modifications to SharePoint Online files, including who changed what and when, meeting the auditing requirement.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Data Lifecycle Management

Question 14

Your company wants to allow partners to use their own corporate credentials to access a specific SharePoint site. Which Microsoft Entra ID feature supports this?

Accepted Answer

B2B collaboration. Microsoft Entra ID B2B (business-to-business) collaboration allows you to invite external users from partner organizations to access your company's resources, such as SharePoint sites, using their own corporate credentials. This feature supports identity federation with the partner's Microsoft Entra ID or other identity providers, enabling seamless single sign-on (SSO) without requiring the partner users to create new accounts in your tenant.

Answer

App Registrations

Answer

B2C collaboration

Answer

Device Registration

Question 15

A company wants to automatically detect and remediate inappropriate messages in Microsoft Teams. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect and remediate inappropriate messages in Microsoft Teams, including offensive language, harassment, and sensitive information. It uses configurable policies to automatically scan messages and apply remediation actions like flagging, notifying managers, or removing content, directly addressing the requirement for automated detection and remediation.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Data Loss Prevention