SC-900 Practice Test 17 — 15 Questions

Question 1

A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) such as medical record numbers in outgoing email, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive data like PHI (e.g., medical record numbers) in outgoing emails using built-in or custom sensitive info types, block unauthorized external sharing, and trigger a retention label action via auto-labeling policies to retain the emails for six years. DLP policies integrate with Exchange Online to inspect email content in transit, apply access restrictions, and enforce retention labels through Power Automate or auto-labeling rules.

Answer

Microsoft Purview Information Protection (sensitivity labels)

Answer

Microsoft Purview Data Lifecycle Management (retention policies)

Answer

Microsoft Purview Audit

Question 2

A healthcare organization must comply with HIPAA regulations. They store patient health information (PHI) in SharePoint Online documents. The compliance team needs to automatically detect PHI (e.g., medical record numbers) in documents, apply a sensitivity label that encrypts the document, and prevent users from removing that label. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 3

A security administrator wants to use Microsoft Defender for Cloud to protect Azure VMs. Which two of the following should be enabled to meet the requirements? (Choose two.)

Accepted Answer

Just-in-Time (JIT) VM access. Just-in-Time (JIT) VM access reduces the attack surface by locking down inbound traffic to Azure VMs, only opening ports (e.g., RDP 3389, SSH 22) when requested and for a limited time after approval via Microsoft Defender for Cloud. This directly protects Azure VMs by preventing persistent exposure of management ports.

Answer

Azure Bastion

Answer

Vulnerability assessment

Question 4

A healthcare organization uses digital signatures on electronic medical records to ensure that the records have not been tampered with during transmission. Which security goal is primarily being addressed by this practice?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the electronic medical record, which is then encrypted with the signer's private key. Any tampering with the record during transmission will cause the hash verification to fail, directly ensuring data integrity. This practice does not primarily address confidentiality (which requires encryption) or availability (which focuses on uptime).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 5

A legal team is managing a large litigation case involving over two million documents in SharePoint Online and Exchange Online. They want to reduce the time required for manual review by using a machine learning model that learns from a seed set of relevant and non-relevant documents and then predicts the relevance of the remaining documents. Which Microsoft Purview solution provides this advanced analytical capability?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) in Microsoft Purview provides advanced analytics capabilities, including predictive coding, which uses machine learning models trained on a seed set of relevant and non-relevant documents to automatically predict the relevance of the remaining content. This directly addresses the legal team's need to reduce manual review time for over two million documents in SharePoint Online and Exchange Online.

Answer

Communication Compliance

Answer

eDiscovery (Standard)

Answer

Audit (Premium)

Question 6

A hospital encrypts patient data stored in a database using AES-256 encryption. If an attacker manages to copy the database file, they cannot read the protected information. Which security goal is primarily achieved by this encryption measure?

Accepted Answer

Confidentiality. AES-256 encryption ensures that even if an attacker gains unauthorized access to the database file, the data remains unreadable without the decryption key. This directly protects the secrecy of the patient data, which is the definition of confidentiality. In the context of the SC-900, encryption at rest is a primary mechanism for achieving confidentiality of stored data.

Answer

Integrity

Answer

Availability

Answer

Auditability

Question 7

A security architect explains the Zero Trust model to the board. They state that every access request must be fully authenticated and authorized based on identity, device health, location, and risk, regardless of whether the user is on the corporate network. Which Zero Trust principle does this statement represent?

Accepted Answer

Verify explicitly. The statement emphasizes that every access request must be authenticated and authorized based on identity, device health, location, and risk, regardless of network location. This directly aligns with the 'Verify explicitly' principle of Zero Trust, which mandates that authentication and authorization are performed for every request using all available data points, not just once at the perimeter.

Answer

Least privilege

Answer

Assume breach

Answer

Microsegmentation

Question 8

A security analyst downloads a software installer from a vendor's website. To ensure the file has not been tampered with during transmission, the analyst compares the SHA-256 hash of the downloaded file against the hash published on the vendor's official site. This practice primarily validates which security goal?

Accepted Answer

Integrity. Comparing the SHA-256 hash of the downloaded installer against the vendor's published hash verifies that the file has not been altered during transmission. This directly validates integrity, which ensures data remains unchanged from its original source. Hashing is a one-way cryptographic function; any change in the file, even a single bit, produces a completely different hash value, making tampering detectable.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 9

A multinational corporation must comply with regulations that require them to keep financial records for 7 years and then permanently delete them. However, they are currently involved in litigation that requires preservation of all documents related to a specific project. They use Microsoft Purview. Which combination of features should they use to meet both requirements?

Accepted Answer

Data Lifecycle Management to retain for 7 years then delete, and eDiscovery (Premium) to place a legal hold on the project documents. Option A is correct because Data Lifecycle Management (DLM) allows you to create retention labels that enforce a 7-year retention period followed by automatic deletion, satisfying the regulatory requirement. eDiscovery (Premium) provides the ability to place a legal hold on specific documents, which overrides the deletion policy to preserve data relevant to ongoing litigation. This combination ensures both compliance with the retention/deletion mandate and the preservation obligation.

Answer

Data Lifecycle Management to retain for 7 years then delete, and Sensitivity labels to mark documents

Answer

Audit (Premium) to log access and eDiscovery (Premium) to search

Answer

Information Protection to classify data and Data Lifecycle Management to retain

Question 10

A security architect is explaining the Zero Trust model to the board. The architect emphasizes that the network perimeter can no longer be considered a safe zone. Which statement best describes the modern primary security perimeter according to Zero Trust principles?

Accepted Answer

The identity of the user and device. In the Zero Trust model, the primary security perimeter is the identity of the user and device, not the network location. This is because Zero Trust assumes breach and requires explicit verification for every access request, regardless of whether it originates from inside or outside the corporate network. By treating identity as the new control plane, organizations enforce least-privilege access and continuous authentication, making the user and device identity the critical trust boundary.

Answer

The corporate network firewall and VPN

Answer

The physical on-premises data center

Answer

The endpoint antivirus and anti-malware solution

Question 11

A security operations team needs to protect their organization's Windows 10 and Windows 11 devices from advanced persistent threats (APTs), ransomware, and fileless malware. They also require a centralized dashboard to view device security posture, investigate incidents, and perform proactive threat hunting using advanced queries. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows 10 and Windows 11 devices against advanced persistent threats (APTs), ransomware, and fileless malware. It includes a centralized dashboard (Microsoft 365 Defender portal) for viewing device security posture, investigating incidents, and performing proactive threat hunting using advanced hunting queries based on Kusto Query Language (KQL).

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 12

A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?

Accepted Answer

Least privilege. Option C is correct because regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Azure AD access reviews, where data owners certify or revoke user access.

Answer

Defense in depth

Answer

Zero trust

Answer

Separation of duties

Question 13

A security operations center (SOC) team needs a centralized platform to collect logs from firewalls, servers, and cloud applications. They want to analyze these logs to detect threats, create custom alerts, and automate response actions using playbooks. The solution should also provide threat intelligence feeds and allow for advanced hunting with Kusto Query Language (KQL). Which Microsoft security solution should the team implement?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides a centralized platform for collecting logs from diverse sources (firewalls, servers, cloud apps), enables custom alert creation, automates response via playbooks (Azure Logic Apps), integrates threat intelligence feeds, and supports advanced hunting using Kusto Query Language (KQL).

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview Compliance Manager

Question 14

A security team is investigating a data exfiltration incident. They need to see detailed events such as when a user accessed a file, the exact action (read, write, delete), and the file name. They also need to perform custom searches across all users. Which Microsoft Purview audit solution should they use to meet these requirements?

Accepted Answer

Audit (Premium). Audit (Premium) is the correct choice because it provides detailed audit logs that include specific actions (read, write, delete), file names, and user access events, and it supports custom searches across all users via the Microsoft Purview compliance portal or Search-UnifiedAuditLog cmdlet. Audit (Standard) only captures basic metadata like who accessed a resource and when, but not the granular action or file name details required for data exfiltration investigation.

Answer

Audit (Standard)

Answer

eDiscovery (Standard)

Answer

Communication Compliance

Question 15

A security operations team uses Microsoft Defender for Cloud and has connected their AWS and GCP accounts. They want to continuously assess the security posture of AWS EC2 instances against the CIS AWS Foundations Benchmark and receive prioritized recommendations. Which feature of Defender for Cloud should they use?

Accepted Answer

Cloud Security Posture Management (CSPM). Option A is correct because Cloud Security Posture Management (CSPM) in Microsoft Defender for Cloud is specifically designed to continuously assess the security posture of multi-cloud resources (including AWS EC2 instances) against industry benchmarks like the CIS AWS Foundations Benchmark. CSPM provides a compliance dashboard, prioritized recommendations, and automated remediation guidance, directly addressing the team's need for ongoing assessment and prioritized recommendations.

Answer

Microsoft Defender for Servers

Answer

Security Alerts

Answer

Workload protections