SC-900 Practice Test 17 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.. You need to use a Conditional Access policy with the 'Require session control' grant, targeting 'All cloud apps' and 'Unmanaged devices' as conditions. This integrates with Microsoft Defender for Cloud Apps to enforce additional authentication (via Microsoft Entra ID) and enable session monitoring, such as real-time activity logging and download blocking, for the sanctioned app when accessed from unmanaged devices.

Answer

Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.

Answer

Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.

Answer

Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.

Question 2

A user reports they cannot access the company portal from their personal device. The device is not enrolled in Microsoft Intune. The admin wants to ensure only compliant devices can access corporate resources. What should the admin configure?

Accepted Answer

Conditional Access policy requiring device compliance. A is correct because a Conditional Access policy can require device compliance before granting access to corporate resources. When the device is not enrolled in Microsoft Intune, it cannot report compliance status, so the policy blocks access. This ensures only managed, compliant devices can access the company portal.

Answer

Enable password writeback

Answer

Enable Identity Protection sign-in risk policy

Answer

Microsoft Entra Privileged Identity Management

Question 3

Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?

Accepted Answer

MFA registration campaign. The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.

Answer

Identity Protection

Answer

Conditional Access

Answer

Security defaults

Question 4

Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides centralized security analytics and threat intelligence across the entire enterprise, including on-premises and multi-cloud environments. It collects data from various sources via connectors (e.g., Azure Monitor Agent, Syslog, Windows Security Events) and allows security teams to manage policies, detect threats, and respond from a single pane of glass. This makes it a correct answer for centrally managing security policies across hybrid environments.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 5

A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?

Accepted Answer

Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.

Answer

Identity Protection

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 6

Your organization wants to centrally manage security policies for all devices (Windows, iOS, Android) and ensure they meet compliance requirements before accessing corporate resources. Which Microsoft solution should you use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct solution because it is a cloud-based mobile device management (MDM) and mobile application management (MAM) service that centrally manages security policies across Windows, iOS, and Android devices. It enforces compliance requirements—such as encryption, OS version, and jailbreak detection—before granting access to corporate resources, integrating with Conditional Access in Microsoft Entra ID.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Entra ID

Question 7

A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?

Accepted Answer

The corporate laptops are not marked as compliant devices.. The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.

Answer

Users are authenticating via device code flow.

Answer

The Conditional Access policy has the 'Persistent browser session' setting enabled.

Answer

The policy is blocking legacy authentication.

Question 8

A security administrator needs to identify users who are repeatedly failing to authenticate from unusual locations. Which Microsoft 365 security feature provides this visibility?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects and reports risky sign-in behaviors, including repeated authentication failures from unusual locations. It uses machine learning models to evaluate sign-in risk based on factors like unfamiliar IP addresses, anonymous IP addresses, and atypical travel patterns, providing security administrators with visibility into such anomalies.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 9

An organization wants to automatically revoke access to cloud apps when an employee leaves the company. Which Microsoft Entra feature should they use?

Accepted Answer

Automated user provisioning. Automated user provisioning (B) is the correct answer because it can automatically disable or remove a user's access to cloud apps when the user is deleted or deactivated in the HR system or on-premises directory. This feature synchronizes identity lifecycle events (e.g., termination) to connected SaaS applications, ensuring revocation of access without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 10

Your organization needs to classify documents containing personally identifiable information (PII) like social security numbers. Which Microsoft Purview solution should you configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection (A) is the correct solution because it provides classification and labeling capabilities specifically designed to identify, label, and protect sensitive data such as PII (e.g., social security numbers). It uses trainable classifiers and exact data match (EDM) to automatically detect sensitive content and apply appropriate protection actions like encryption or access restrictions.

Answer

Records Management

Answer

Auditing

Answer

Communication Compliance

Question 11

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their social media accounts, such as Google or Facebook. Which feature should you configure?

Accepted Answer

External ID. External ID (now known as Microsoft Entra External ID) allows you to configure identity providers for social accounts like Google and Facebook. This enables users to sign in with their existing social credentials by establishing federation via OAuth 2.0 or OpenID Connect protocols, rather than requiring a separate Microsoft Entra ID account.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Conditional Access

Question 12

Refer to the exhibit. You are reviewing a risk detection report in Microsoft Entra Identity Protection. The report shows a user with high risk level and two risk events. What does the status 'remediated' indicate?

Accepted Answer

The risk has been resolved by a remediation action such as password reset.. In Microsoft Entra Identity Protection, the 'remediated' status indicates that the risk associated with the user has been resolved through an automated or manual remediation action, such as a password reset or completion of a multi-factor authentication (MFA) challenge. This means the detected risk event is no longer considered active, and the user's account has been brought back to a secure state. Option B correctly identifies that the risk was resolved by a remediation action.

Answer

The risk is still active and requires investigation.

Answer

The user's account has been confirmed as compromised.

Answer

The risk was dismissed by an administrator as false positive.

Question 13

Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Safe Links policy. Safe Links is the correct feature because it provides real-time URL reputation checking at the time of click. When a user clicks a link in an email, Safe Links checks the link against Microsoft's threat intelligence to determine if it is malicious, even if the email itself was not blocked by EOP. This allows investigation of the suspicious link's reputation after delivery.

Answer

Exchange Online Protection (EOP) filtering

Answer

Anti-phish policy

Answer

Safe Attachments policy

Question 14

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove malicious attachments from emails before they reach user inboxes. Which protection feature should be configured?

Accepted Answer

Safe Attachments policies. Safe Attachments policies in Microsoft Defender for Office 365 are specifically designed to detect and neutralize malicious attachments in email messages before they reach user inboxes. This feature uses a detonation environment to open attachments in a sandbox, analyzing their behavior for threats, and then automatically removes or replaces the attachment if it is found to be malicious.

Answer

Anti-spam policies

Answer

Anti-phishing policies

Answer

Safe Links policies

Question 15

During a security incident, a SOC analyst needs to investigate a compromised user account that accessed multiple cloud apps. Which Microsoft Defender XDR feature provides a unified view of the attack timeline across endpoints, identities, and cloud apps?

Accepted Answer

Incident response. Incident response in Microsoft Defender XDR aggregates alerts and activities from endpoints, identities, and cloud apps into a single incident view, providing a unified attack timeline. This allows the SOC analyst to see the full scope of the compromised user account's actions across all integrated workloads without switching between consoles.

Answer

Microsoft Secure Score

Answer

Advanced hunting

Answer

Action center