SC-900 Practice Test 18 — 15 Questions

Question 1

A company uses Microsoft Entra ID and wants to automate the lifecycle of guest users. When a contractor's project ends, the guest account should be automatically blocked and then removed after 30 days. Which Microsoft Entra capability should they configure to manage this process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entitlement Management. Entitlement Management in Microsoft Entra ID Governance allows organizations to automate the lifecycle of external identities, including guest users. By configuring an access package with a specific expiration policy (e.g., 30 days after project end), the system can automatically block and then remove the guest account when the entitlement expires, without manual intervention.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Governance

Question 2

Which THREE components are part of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified security operations platform that integrates threat signals across endpoints, identities, and email/collaboration tools. Its core components include Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Identity (identity security), and Microsoft Defender for Endpoint (endpoint detection and response). Option A (Microsoft Purview) is a data governance and compliance solution, not part of XDR. Option C (Microsoft Sentinel) is a cloud-native SIEM that can ingest data from XDR but is not a built-in component of Defender XDR. Therefore, the correct answers are B, D, and E.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 3

A company runs containerized applications on Azure Kubernetes Service (AKS) and stores container images in Azure Container Registry. The security team wants to automatically scan container images for vulnerabilities every time a new image is pushed to the registry and receive recommendations for remediation. Which Microsoft security solution should they enable?

Accepted Answer

C. Microsoft Defender for Cloud. Microsoft Defender for Cloud provides integrated vulnerability assessment for container images stored in Azure Container Registry. When enabled, it automatically scans each new image pushed to the registry, identifies known vulnerabilities (using the Qualys scanner or Microsoft's own threat intelligence), and generates actionable remediation recommendations. This directly meets the security team's requirement for automated scanning and remediation guidance.

Answer

A. Microsoft Defender for Endpoint

Answer

B. Microsoft Defender for Identity

Answer

D. Microsoft Defender for Office 365

Question 4

A company wants to block all sign-ins using legacy authentication protocols because these protocols do not support multi-factor authentication (MFA). Which component of a Microsoft Entra ID Conditional Access policy should be configured to achieve this?

Accepted Answer

Conditions (Client apps). To block legacy authentication protocols, you configure the 'Client apps' condition in a Conditional Access policy. This setting allows you to target specific authentication clients, such as Exchange ActiveSync, POP3, IMAP, and SMTP, which do not support MFA. By selecting 'Exchange ActiveSync clients' and 'Other clients' under the Client apps condition, you can enforce a block on all sign-ins using these legacy protocols.

Answer

Cloud apps or actions

Answer

Grant

Answer

Session

Question 5

A company needs to provide a developer with temporary, time-bound administrative access to Azure resources to debug a production issue. The access must require approval from the manager and automatically expire after 4 hours. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. This directly matches the requirement for temporary, manager-approved administrative access that expires after 4 hours.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entitlement Management

Question 6

A company wants to automatically detect and alert the security team when a user sign-in appears to originate from a known compromised credential or from an anonymizing VPN service. The company wants to receive a risk score for each sign-in and be able to trigger automated remediation actions. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks, including sign-ins from compromised credentials and anonymizing VPN services (e.g., Tor). It assigns a risk score (low, medium, high) to each sign-in and user, and supports automated remediation actions such as requiring multi-factor authentication (MFA) or blocking sign-in via Conditional Access policies integrated with the risk detection.

Answer

Microsoft Entra Identity Governance

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra External Identities

Question 7

Your company uses Microsoft Entra ID. You need to enable users to sign in to third-party SaaS applications using their corporate credentials without storing passwords in those apps. Which Microsoft Entra feature should you configure?

Accepted Answer

Configure single sign-on (SSO) using federation. Configuring single sign-on (SSO) using federation allows users to authenticate against Microsoft Entra ID (their corporate identity provider) and then pass a security token to third-party SaaS applications. This eliminates the need for the SaaS app to store or manage user passwords, as authentication happens via standards like SAML 2.0 or WS-Federation, and the app trusts the token issued by Entra ID.

Answer

Deploy Microsoft Entra Self-Service Password Reset

Answer

Configure conditional access policies with MFA

Answer

Enable Microsoft Entra Identity Protection

Question 8

A user logs into the company's network using their username and password. After successful login, the user attempts to open a financial report but receives an access denied message because they are not a member of the 'Finance' security group. Which security concept is best illustrated by the access denial?

Accepted Answer

Authorization. The access denial occurs because the user lacks the necessary permissions to open the financial report, even though their identity was verified. This is the core function of authorization, which determines what resources an authenticated user can access. In this scenario, the user is authenticated but not authorized to access the report due to missing group membership.

Answer

Authentication

Answer

Accounting

Answer

Non-repudiation

Question 9

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email via the Outlook mobile app. Which policy type should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID are the correct choice because they evaluate device compliance status (reported by Intune) as a condition for granting access to cloud apps like Exchange Online. By requiring that only compliant devices can access corporate email via the Outlook mobile app, you configure a Conditional Access policy that blocks or grants access based on the device compliance state, integrating Intune's compliance assessment with Entra ID's access control.

Answer

Device configuration policies

Answer

App protection policies

Answer

Device compliance policies

Question 10

Your organization is implementing Microsoft Purview to manage sensitive data. You need to ensure that documents containing credit card numbers are automatically detected and protected. Which Microsoft Purview solution should you configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive data, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply protective actions like blocking sharing or encrypting the document. Microsoft Purview DLP policies can scan content at rest, in transit, and in use across Exchange, SharePoint, OneDrive, Teams, and endpoints, ensuring credit card numbers are identified and protected in real time.

Answer

eDiscovery (Premium)

Answer

Audit (Standard)

Answer

Information Barriers

Question 11

A financial company processes stock trades. To ensure that a trader cannot later deny having submitted a specific trade order, the system captures a digital signature from the trader for each order. Which security goal is being addressed by this practice?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny having performed a specific action. By capturing a digital signature from the trader for each trade order, the system creates cryptographic proof that the trader indeed submitted that order. This prevents the trader from later claiming they did not authorize the trade, directly addressing the non-repudiation goal.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 12

Your company uses Microsoft 365 E5 and wants to provide a unified security dashboard showing alerts from endpoints, email, identity, and cloud apps. Which solution should you use?

Accepted Answer

Microsoft Defender XDR portal (security.microsoft.com). Microsoft Defender XDR portal (security.microsoft.com) aggregates alerts from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), identity (Microsoft Defender for Identity), and cloud apps (Microsoft Defender for Cloud Apps) into a single unified dashboard. This is the correct solution because it provides cross-domain correlation and a centralized view of security incidents across these Microsoft 365 E5 workloads without requiring additional licensing or data ingestion.

Answer

Microsoft Sentinel

Answer

Microsoft Intune admin center

Answer

Microsoft Purview Compliance Portal

Question 13

Your organization uses Microsoft Entra ID for identity management. You need to allow external partners to access a specific SharePoint Online site without requiring them to have a Microsoft Entra ID account in your tenant. Which feature should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration to invite partners as guest users.. Microsoft Entra B2B collaboration is the correct feature because it allows you to invite external partners as guest users who can access resources like SharePoint Online using their own identity (e.g., a Microsoft account or a corporate account from another identity provider) without requiring a separate Microsoft Entra ID account in your tenant. This leverages the B2B collaboration protocol, which uses SAML/WS-Federation or OIDC for federation, enabling seamless access while maintaining centralized access control.

Answer

Set up identity protection to allow external access.

Answer

Configure Microsoft Entra B2C for the partners.

Answer

Create guest user accounts for each partner.

Question 14

Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.

Answer

Self-Service Password Reset (SSPR)

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 15

A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data collection agent for Microsoft Sentinel that supports collecting security logs from Windows and Linux on-premises servers. It replaces the legacy Microsoft Monitoring Agent (MMA) and provides a more secure, scalable, and performant method to send logs to Azure Log Analytics workspaces, which underpin Sentinel.

Answer

Syslog connector

Answer

Microsoft Monitoring Agent (MMA)

Answer

Office 365 connector