SC-900 Practice Test 15 — 15 Questions

Question 1

A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managing user identities and access to the application. In a PaaS deployment like Azure App Service with Azure SQL Database, the customer is responsible for managing user identities and access to the application, including authentication, authorization, and role-based access control (RBAC). Microsoft manages the underlying infrastructure, including the host OS, physical datacenter security, and network backbone, but the customer must secure application-level access and data plane operations.

Answer

Physical security of the datacenter hosting the App Service

Answer

Patching the operating system of the App Service host machines

Answer

Network security for the Azure backbone connecting datacenters

Question 2

Which TWO Microsoft security solutions can be used to detect and respond to identity-based threats? (Choose two.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (option C) is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It specifically focuses on identity-based attacks such as pass-the-hash, Kerberos golden ticket, and brute-force attempts by analyzing network traffic and behavior.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview

Answer

Microsoft Defender for Endpoint

Question 3

A company has implemented a security model where every access request is fully authenticated, authorized, and encrypted before granting access, regardless of where the request originates (corporate network or internet). The model assumes that no entity is inherently trustworthy and requires continuous verification. This model is known as:

Accepted Answer

Zero Trust. The described model—requiring full authentication, authorization, and encryption for every access request, treating no entity as inherently trustworthy, and demanding continuous verification—is the core definition of Zero Trust. This aligns with the NIST SP 800-207 standard, which explicitly states that Zero Trust assumes no implicit trust and enforces verification for every request, regardless of network location.

Answer

Defense in depth

Answer

Least privilege

Answer

Shared responsibility

Question 4

Your organization uses Microsoft Entra ID and needs to block sign-ins from legacy authentication protocols to reduce risk. Which feature should you use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow you to block sign-ins from legacy authentication protocols by targeting client apps that use protocols like POP3, IMAP, SMTP, or older Office clients that do not support modern authentication. This is the correct feature because it provides granular, policy-based control to explicitly deny authentication requests that use legacy protocols, directly addressing the requirement to reduce risk from these less secure methods.

Answer

Security defaults

Answer

Privileged Identity Management

Answer

Identity Protection

Question 5

A company uses Azure virtual machines and also has physical servers in their on-premises datacenter. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and get a secure score for both environments. They also want to integrate with Microsoft Defender for Cloud for threat protection. Which Microsoft security solution provides this unified visibility across hybrid workloads?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that delivers security recommendations, misconfiguration detection, and a secure score across both Azure virtual machines and on-premises physical servers. It natively integrates with Microsoft Defender for Cloud's threat protection capabilities, enabling hybrid workload coverage without additional licensing or complex setup.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Security Center

Question 6

A security analyst is explaining the concept of 'defense in depth' to a new team member. Which of the following best describes the defense in depth strategy?

Accepted Answer

Implementing multiple layers of security controls to protect assets. Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different parts of an IT environment (network, endpoint, application, data) to ensure that if one layer fails, another layer is already in place to mitigate the threat. This approach is fundamental to Microsoft's security architecture, as seen in products like Microsoft Defender for Cloud, which integrates protections across workloads, and Azure Active Directory (now Microsoft Entra ID), which layers conditional access policies on top of identity verification. Option B correctly captures this layered, redundant approach rather than relying on a single point of defense.

Answer

Using a single strong firewall to protect all network traffic

Answer

Relying on user training as the primary security measure

Answer

Applying encryption only to data at rest

Question 7

Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that detects user account creation events (e.g., from AzureActivity) and then correlates those with sign-in logs (e.g., from SigninLogs) from unfamiliar locations within a 24-hour window. This rule type supports complex multi-table joins and time-based correlation, which is exactly what the scenario requires.

Answer

Anomaly detection rule

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Question 8

A company has many guest users in Microsoft Entra ID who collaborate on a project in a specific SharePoint site. The compliance team needs to periodically verify that these guest users still require access to the site. If a reviewer does not respond within 30 days, the guest's access should be automatically removed. Additionally, the company wants to ensure that once access is removed, the guest user object is eventually deleted from the directory after 90 days. Which Microsoft Entra Identity Governance features should they use together?

Accepted Answer

Access Reviews configured to auto-apply results and delete guest users after a specified number of days. Access Reviews in Microsoft Entra ID can be configured to automatically apply results, removing guest access when a reviewer does not respond within a specified period (e.g., 30 days). Additionally, the 'Delete guest users not reviewed within' setting allows automatic deletion of the guest user object from the directory after a configurable number of days (e.g., 90 days). This directly meets both requirements: periodic verification of access and eventual cleanup of the directory object.

Answer

Entitlement Management access packages with an expiration policy

Answer

Lifecycle Workflows to schedule a periodic task

Answer

Privileged Identity Management (PIM) for guest roles

Question 9

A company uses Microsoft Entra ID. Their sales team wants to use a third-party customer relationship management (CRM) application that requires the 'Sign in and read user profile' permission and also a high-risk permission to 'Read all users' full profiles'. The security team wants to allow users to request access to this application, but they want to require an administrator to review and approve the high-risk permission request before consent is granted. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Admin consent workflow. The admin consent workflow in Microsoft Entra ID allows end users to request consent for applications that require permissions, while requiring administrator approval for high-risk permissions. In this scenario, the CRM app requests both a low-risk permission ('Sign in and read user profile') and a high-risk permission ('Read all users' full profiles'), and the security team wants admin review for the high-risk one. The admin consent workflow enables this by letting users initiate the request, then routing it to designated administrators for approval or denial, ensuring that high-risk permissions are not granted without oversight.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 10

A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention labels and policies that automatically retain contracts for a specified period (10 years) and then trigger a permanent deletion disposition review or direct deletion. This aligns directly with the regulatory requirement to retain data for a fixed duration and then dispose of it securely.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Information Protection

Question 11

A company uses Azure virtual machines and on-premises Windows servers. The security team wants a single solution that provides vulnerability assessment, a regulatory compliance dashboard (e.g., for ISO 27001), and integrated threat detection such as fileless malware and anomalous logins. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) is the correct choice because it provides unified security management across Azure VMs and on-premises servers. It includes built-in vulnerability assessment (via Qualys or Microsoft Defender Vulnerability Management), a regulatory compliance dashboard with built-in standards like ISO 27001, and integrated threat detection for fileless malware, anomalous logins, and other advanced attacks. This single solution meets all the requirements listed in the question.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Question 12

Which TWO of the following are capabilities of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that aggregates log data from across an organization to detect, investigate, and respond to threats. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response workflows.

Answer

Endpoint detection and response (EDR)

Answer

Vulnerability scanning

Answer

Data classification and labeling

Question 13

A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.

Answer

Data Loss Prevention (DLP)

Answer

Audit

Answer

Compliance Manager

Question 14

A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.

Answer

App Governance

Answer

Information Protection

Answer

Conditional Access App Control

Question 15

A company hosts a line-of-business application on an Azure virtual machine. The IT team is responsible for configuring the operating system, installing security updates, and managing the application code. An auditor asks who is responsible for the physical security of the data center where the virtual machine runs. According to the shared responsibility model for cloud services, who is responsible?

Accepted Answer

Microsoft. Under the shared responsibility model, Microsoft is responsible for the physical security of its Azure data centers, including access controls, surveillance, and environmental safeguards. The customer is responsible for securing the virtual machine's operating system, applications, and data, but not the physical infrastructure. Therefore, Microsoft retains responsibility for physical security even when the customer manages the guest OS and application.

Answer

The customer

Answer

Both the customer and Microsoft equally

Answer

Neither – physical security is no longer needed in the cloud