SC-900 Practice Test 18 — 15 Questions

Question 1

An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A DLP policy with a rule that detects credit card numbers and blocks sharing. Microsoft Purview DLP policies are specifically designed to detect and automatically block the sharing of sensitive data, such as credit card numbers, across services like Exchange Online (email) and Microsoft Teams. By creating a DLP policy with a rule that includes a sensitive information type for credit card numbers and an action to block external sharing, the organization can enforce the required protection. Retention labels, audit policies, and sensitivity labels do not provide the real-time blocking capability needed for this scenario.

Answer

A retention label to retain credit card data

Answer

An audit policy to log credit card sharing

Answer

A sensitivity label that marks credit card data

Question 2

Your organization needs to monitor Microsoft Teams chats for inappropriate language and alert compliance officers. Which Microsoft Purview solution should you implement?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect inappropriate language, such as profanity, harassment, or sensitive content, in Microsoft Teams chats and other communication channels. It uses built-in trainable classifiers and customizable policies to automatically flag violations and alert compliance officers, enabling proactive remediation.

Answer

eDiscovery

Answer

Auditing

Answer

Information Protection

Question 3

A company deploys a sensitivity label as shown in the exhibit. The custom sensitive information type 'Custom_PII_Type' is configured to detect employee IDs. What happens when a user creates a new document in SharePoint Online that contains an employee ID?

Accepted Answer

The document is automatically labeled 'Highly Confidential' and encrypted.. The sensitivity label is configured for auto-labeling with a condition that detects the custom sensitive information type 'Custom_PII_Type'. When a user creates a document in SharePoint Online containing an employee ID, Microsoft 365 automatically applies the 'Highly Confidential' label and enforces encryption as defined in the label policy, without requiring manual user action.

Answer

The user is prompted to manually apply the label.

Answer

The document is blocked from being shared externally.

Answer

The document is deleted automatically.

Question 4

Your organization uses Microsoft Entra ID free tier. You need to synchronize user accounts from your on-premises Active Directory to the cloud. You also need to synchronize password hashes so that users can use the same password for cloud and on-premises resources. Which tool should you use?

Accepted Answer

Install Microsoft Entra Connect and enable password hash synchronization.. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory user accounts to Microsoft Entra ID (formerly Azure AD) and enabling password hash synchronization. Password hash synchronization allows users to use the same password for both on-premises and cloud resources by syncing a hash of the on-premises password to Entra ID, which is supported in the free tier of Entra ID.

Answer

Configure Microsoft Entra Domain Services to sync from on-premises.

Answer

Use Microsoft Graph API to create users and set passwords.

Answer

Deploy Active Directory Federation Services (AD FS) to enable single sign-on.

Question 5

Refer to the exhibit. An administrator runs this PowerShell command. What is the purpose of this command?

Accepted Answer

To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.. The PowerShell cmdlet `Search-UnifiedAuditLog` is used to retrieve audit records from the Microsoft 365 unified audit log. The `-StartDate` and `-EndDate` parameters define the time range (last 90 days), and the `-RecordType` parameter filters for SharePoint audit events. The `-Operations` parameter with `FileAccessed` and `FileModified` specifies that only file access and modification events should be returned, making this command's purpose to retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.

Answer

To set a retention policy for the HR site.

Answer

To apply a retention label to all files in the HR site.

Answer

To delete all files in the HR site that were accessed in the last 90 days.

Question 6

A company wants to classify and label documents in SharePoint automatically based on sensitive content like social security numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically detect sensitive content such as social security numbers in SharePoint documents and apply the appropriate sensitivity label. This enables consistent classification and protection without manual user intervention, directly meeting the company's requirement.

Answer

eDiscovery

Answer

Audit log

Answer

Data loss prevention policy

Question 7

A company runs Azure SQL databases containing customer transaction data. The security team needs to detect and alert on suspicious database access patterns, such as SQL injection attempts or access from unusual locations. Which Microsoft security solution should they enable?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides advanced threat protection for Azure SQL databases, including anomaly detection for suspicious activities like SQL injection and unusual access patterns. It uses machine learning to baseline normal database behavior and triggers alerts when deviations occur, such as access from atypical geographic locations or malicious query patterns.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 8

Your organization uses Microsoft Purview eDiscovery (Premium) to manage a legal case. You need to place a hold on custodians' mailboxes and SharePoint sites to preserve relevant data. Which step must you first take in the eDiscovery workflow?

Accepted Answer

Create a case. In Microsoft Purview eDiscovery (Premium), the workflow begins with creating a case, which serves as the container for all subsequent actions, including holds, searches, and review sets. Without a case, you cannot place holds on custodians' mailboxes or SharePoint sites because the hold is scoped to the case. Therefore, creating a case is the mandatory first step before any preservation or search activities.

Answer

Export results

Answer

Create a review set

Answer

Search for content

Question 9

Refer to the exhibit. A Microsoft Purview Data Loss Prevention (DLP) policy is configured. What does this policy do?

Accepted Answer

It generates an alert if more than 10 emails with the Confidential label are sent to an external recipient.. The DLP policy rule shown in the exhibit specifies an action to 'Send an alert' when the condition 'Number of emails sent to external recipients with label Confidential exceeds 10' is met. This means the policy generates an alert (e.g., via email or incident report) when more than 10 emails containing the Confidential label are sent to external recipients, without blocking the emails.

Answer

It blocks all emails sent to external recipients with the Confidential label.

Answer

It prevents internal users from sending Confidential emails to each other.

Answer

It automatically applies the Confidential label to emails sent to external recipients.

Question 10

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender for Endpoint. The query returns no results. What is the most likely cause?

Accepted Answer

The device is not onboarded to Defender for Endpoint. The KQL query in Microsoft Defender for Endpoint returns no results because the device is not onboarded. Defender for Endpoint can only report on devices that have been enrolled and are actively sending telemetry. If a device is not onboarded, no data exists for it in the security portal, so any query targeting that device will return empty results.

Answer

The device has a risk score of zero

Answer

The device runs macOS

Answer

The analyst lacks permissions to view the device

Question 11

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

Accepted Answer

Microsoft Authenticator app (passwordless). The Microsoft Authenticator app (passwordless) allows users to sign in to Microsoft Entra ID using biometrics (fingerprint, face, or PIN) on their mobile device without entering a password. This feature uses the device's built-in biometric capabilities to verify the user's identity, making it the correct choice for the described scenario.

Answer

Windows Hello for Business

Answer

SMS-based sign-in

Answer

FIDO2 security keys

Question 12

Refer to the exhibit. You are configuring an access package in Microsoft Entra Entitlement Management. Based on the policy, which users can request access to the HR App?

Accepted Answer

Any user in the organization can request access, but guests require manager approval.. The access package policy shown in the exhibit is configured with 'For users in your directory' as the scope and 'Specific connected organization' is not selected, meaning any internal user can request. The policy also has 'Approval' set to 'Manager approval' only for 'Guest users', so internal users do not require approval, while guests do. This matches the description that any user in the organization can request, but guests need manager approval.

Answer

Only administrators can assign access.

Answer

Only users in the HR department can request access.

Answer

Only guest users can request access.

Question 13

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

Accepted Answer

A dynamic security group based on department attribute.. The exhibit shows a rule syntax of `(user.department -eq "Sales")`, which is the expression used to dynamically add or remove members based on the department attribute. This is the defining characteristic of a dynamic security group in Microsoft Entra ID, where membership is evaluated automatically when user attributes change.

Answer

A Microsoft 365 group with dynamic membership.

Answer

A dynamic group based on user location.

Answer

A static security group with assigned members.

Question 14

Your organization wants to automatically investigate and remediate email-based threats in Microsoft 365. Which security solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct solution because it is specifically designed to protect against email-based threats such as phishing, malware, and business email compromise (BEC). It provides automated investigation and remediation capabilities through features like Automated Investigation and Response (AIR) and Threat Explorer, which can automatically analyze and remediate malicious emails, attachments, and URLs in Exchange Online.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 15

Which Microsoft Entra ID feature allows an organization to provide external partners with access to its applications while maintaining control over authentication and governance?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (including B2B collaboration) enables secure sharing of apps with external users. It allows the organization to manage identities and enforce policies like MFA for guests.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management