SC-900 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

Accepted Answer

Open the associated incident to view all related alerts and entities.. Microsoft 365 Defender incidents aggregate multiple alerts and entities (users, devices, mailboxes) into a single view, providing the full context needed to understand the attack chain. Opening the incident first allows the analyst to correlate the alert with related alerts, affected assets, and the incident timeline, which is the recommended initial step in incident response workflows.

Answer

Isolate the affected user's device immediately.

Answer

Mark the alert as resolved.

Answer

Run an automated simulation to test the alert.

Question 2

A company uses Microsoft 365 and needs to identify and protect sensitive data, such as credit card numbers, stored in SharePoint Online and OneDrive for Business. They also want to prevent users from sharing this data externally. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data like credit card numbers (using built-in sensitive information types such as Credit Card Number) across Microsoft 365 services, including SharePoint Online and OneDrive for Business. DLP policies can enforce rules to block or restrict external sharing of such data, directly meeting the requirement to prevent users from sharing sensitive data externally.

Answer

Data Lifecycle Management (DLM)

Answer

Information Protection (sensitivity labels)

Answer

Audit (Standard)

Question 3

A user reports that they cannot access a cloud app even though they are in the correct location and have a valid license. The administrator suspects a Conditional Access policy might be blocking access. Which tool should the admin use to diagnose the issue?

Accepted Answer

Sign-in logs. Sign-in logs provide detailed information about every sign-in attempt, including whether Conditional Access policies were applied, which policies were triggered, and the outcome (success or failure). When a user reports they cannot access an app and a Conditional Access policy is suspected, reviewing the sign-in logs for that user's attempts will directly show if a policy blocked access and why, making it the primary diagnostic tool for an existing issue.

Answer

My Apps portal

Answer

Conditional Access 'What If' tool

Answer

Audit logs

Question 4

Your organization needs to create a policy that prevents users from sharing credit card numbers in emails. Which Microsoft Purview solution should you configure?

Accepted Answer

Data loss prevention (DLP) policy. Data loss prevention (DLP) policies in Microsoft Purview are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. By configuring a DLP policy with a credit card number sensitive info type, the organization can block users from sending emails containing those patterns, either by preventing the email from being sent or by triggering a policy tip. This directly addresses the requirement to prevent sharing of credit card numbers in emails.

Answer

Communication Compliance

Answer

Retention policy

Answer

eDiscovery

Question 5

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a passcode can access corporate email. What should you configure?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune evaluates device settings, such as requiring a passcode, and marks devices as noncompliant if they lack one. Conditional Access policies can then block noncompliant devices from accessing corporate email, ensuring only compliant devices with a passcode are allowed.

Answer

Device configuration policy

Answer

Enrollment restrictions

Answer

App protection policy

Question 6

You are configuring Microsoft Entra ID Governance. You need to ensure that when a user leaves the organization, their access to all SaaS applications is automatically revoked. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Access Reviews. Microsoft Entra Access Reviews allows administrators to create recurring reviews of user access to SaaS applications. When a user leaves the organization, an automated access review can be configured to remove their access based on the review results, ensuring revocation of access to all assigned SaaS apps. This directly addresses the requirement for automatic revocation upon departure.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Terms of Use

Question 7

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

Accepted Answer

Email & collaboration in Microsoft Defender XDR. Microsoft Defender XDR's Email & collaboration feature (part of Defender for Office 365) is the correct tool for investigating a suspicious email. It provides a unified investigation experience, including threat explorer, email entity pages, and detonation analysis, allowing you to inspect the email's headers, attachments, URLs, and determine its threat level using Microsoft's threat intelligence and machine learning models.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 8

Your company uses Microsoft Defender for Cloud Apps. You want to discover which cloud apps are being used in your organization and assess their risk levels. What should you use?

Accepted Answer

Cloud Discovery. Cloud Discovery is the feature within Microsoft Defender for Cloud Apps that analyzes traffic logs to identify which cloud apps are being used in your organization and assesses their risk based on the Cloud App Security Catalog. It provides visibility into Shadow IT by discovering unsanctioned app usage and assigning a risk score to each app.

Answer

Cloud App Security Catalog

Answer

Microsoft Purview Data Map

Answer

Microsoft Intune app inventory

Question 9

Your organization uses Microsoft 365 and wants to automatically quarantine suspicious emails before they reach users' inboxes. Which solution should you configure?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Exchange Online Protection (EOP) and advanced threat protection features such as Safe Attachments and Safe Links. These capabilities automatically quarantine suspicious emails—including those with malicious attachments, phishing URLs, or spoofed senders—before they reach user inboxes, based on policy-defined actions like 'Quarantine message'.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 10

An organization uses Microsoft Purview Communication Compliance. They need to monitor Microsoft Teams messages for potential insider trading language. What should they configure?

Accepted Answer

A Communication Compliance policy. B is correct because Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate or policy-violating communications, including insider trading language in Microsoft Teams messages. By configuring a Communication Compliance policy, the organization can define custom conditions (e.g., keywords, patterns, or classifiers) to scan Teams chats and channels for prohibited financial language, enabling automated alerts and remediation workflows.

Answer

An eDiscovery case

Answer

A Data Loss Prevention policy

Answer

A sensitivity label policy

Question 11

An organization must prove to an auditor that only authorized users have accessed sensitive HR files over the past year. The compliance team needs to generate a report of all access events to these files. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides detailed logging of all access events to sensitive files, including who accessed them, when, and from where. The compliance team can generate a comprehensive report of these events over the past year, meeting the auditor's requirement to prove only authorized users accessed the HR files. Audit (Premium) offers extended retention (up to 10 years) and advanced search capabilities, making it ideal for forensic investigations and compliance audits.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Information Protection

Question 12

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

Accepted Answer

Device health report. The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.

Answer

Threat analytics report

Answer

Vulnerability management dashboard

Answer

Microsoft Secure Score report

Question 13

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. What should they configure?

Accepted Answer

Compliance policy and conditional access. Combining a compliance policy (which checks the device OS version against a minimum requirement) with a Conditional Access policy (which blocks access if the device is non-compliant) is the standard Microsoft approach to enforce OS version requirements for accessing corporate email. The compliance policy marks devices below the minimum OS version as non-compliant, and the Conditional Access policy then denies access to Exchange Online or other corporate resources for those non-compliant devices.

Answer

App protection policy

Answer

Device enrollment restriction

Answer

Device configuration profile

Question 14

A large enterprise uses Microsoft Entra ID with P2 licenses. The security team wants to implement just-in-time (JIT) access for privileged roles and require approval for role activation. Additionally, they want to receive alerts when a role is activated outside business hours. Which feature should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM).. Microsoft Entra Privileged Identity Management (PIM) is the correct feature because it provides just-in-time (JIT) activation of privileged roles, supports approval workflows for role activation, and can send alerts when roles are activated outside business hours. PIM is specifically designed for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID, including time-bound activation and notification settings.

Answer

Microsoft Entra Identity Protection.

Answer

Conditional Access policies.

Answer

Microsoft Entra entitlement management.

Question 15

Your organization uses Microsoft Purview Communication Compliance to detect potential harassment in Microsoft Teams messages. Which role is required to review and act on policy matches?

Accepted Answer

Communication Compliance analyst. The Communication Compliance analyst role is specifically designed to review policy matches, investigate message details, and take remediation actions such as escalating or resolving alerts in Microsoft Purview Communication Compliance. This role has the necessary permissions to view and act on detected violations without the broader administrative privileges of a Compliance administrator.

Answer

Communication Compliance admin

Answer

Communication Compliance investigator

Answer

Compliance administrator