SC-900 Practice Test 19 — 15 Questions

Question 1

A compliance officer needs to monitor internal emails for inappropriate language and potential data leaks. The officer wants to detect policy violations and allow users to report concerns. Which Microsoft Purview solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in internal and external communications, including inappropriate language and potential data leaks. It also provides a built-in mechanism for users to report concerns, aligning directly with the compliance officer's requirements.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 2

Refer to the exhibit. You are configuring a Conditional Access policy that requires compliant device for access to Microsoft 365. The device shown in the exhibit is Azure AD joined, compliant, and managed. However, a user signing in from this device is still blocked. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires Hybrid Azure AD joined device.. The exhibit shows the device is Microsoft Entra ID joined, compliant, and managed, yet the user is still blocked. This indicates the Conditional Access policy is configured to require a Hybrid Microsoft Entra ID joined device, which is a stricter requirement than just being Microsoft Entra ID joined. A Hybrid Microsoft Entra ID joined device must be both domain-joined to on-premises Active Directory and registered with Microsoft Entra ID, whereas an Microsoft Entra ID joined device is only cloud-joined. Since the device in the exhibit is only Microsoft Entra ID joined, it does not satisfy the Hybrid Microsoft Entra ID joined condition, causing the block.

Answer

The device profile type is 'Workplace', which is not allowed.

Answer

The device is not compliant.

Answer

The device is not managed.

Question 3

Which TWO of the following are Microsoft Purview compliance solutions?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is a Microsoft Purview compliance solution that helps organizations detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers or personally identifiable information (PII), across email, SharePoint, OneDrive, and endpoints. eDiscovery is another Purview compliance solution that allows legal and compliance teams to search, hold, and export content from Microsoft 365 services for litigation or investigation purposes. Both are core capabilities within the Microsoft Purview compliance portal, distinct from identity, device management, or cloud security tools.

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud

Question 4

Refer to the exhibit. You are reviewing a Communication Compliance policy. What does this policy do when a user sends an email containing EU GDPR PII to privacy@contoso.com?

Accepted Answer

It notifies the policy owner and generates a case for investigation.. Communication Compliance policies in Microsoft 365 are designed to detect and investigate policy violations, not to enforce real-time blocking or automated deletion. When a user sends an email containing EU GDPR PII to a specified recipient like privacy@contoso.com, the policy triggers an alert, notifies the policy owner, and generates a case for investigation in the Compliance Center. This allows organizations to review and remediate potential data privacy violations without disrupting email flow.

Answer

It blocks the email from being sent.

Answer

It automatically deletes the email after 30 days.

Answer

It applies a sensitivity label to the email.

Question 5

A security analyst needs to investigate a potential ransomware attack affecting multiple endpoints. They want to centralize detection and response across devices, email, and applications. Which Microsoft solution should they use?

Accepted Answer

Microsoft 365 Defender (now Microsoft Defender XDR). Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and response across endpoints, email, identities, and applications. Microsoft Sentinel is a SIEM for broader security data. Defender for Cloud is for cloud workloads. Defender for Endpoint only covers endpoints.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud

Question 6

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

Accepted Answer

Regulatory record. Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record. Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Answer

Disposition review

Answer

Event-based retention policy

Answer

Retention label with default settings

Question 7

Match each Microsoft 365 compliance feature to its function.

Accepted Answer

eDiscovery: Search and export content from various data sources. The correct matches are: eDiscovery for searching and exporting content, Retention policies for managing retention and deletion, and Sensitivity labels for classifying and protecting data. Common confusions include mixing DLP with Sensitivity labels, and Communication Compliance with DLP.

Answer

Data Loss Prevention: Classify and protect data with encryption and visual markings

Answer

Communication Compliance: Detect and prevent accidental sharing of sensitive information

Question 8

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Accepted Answer

Security information and event management (SIEM). Correct: A (SIEM), B (UEBA), D (SOAR). C is not a Sentinel capability; it is a feature of Microsoft Intune. E is a feature of Microsoft Purview.

Answer

Mobile device management

Answer

Data loss prevention

Question 9

A company uses Microsoft Entra ID and needs to regularly review membership of a group that grants access to a sensitive HR application. The identity team wants to automate quarterly reviews and automatically remove users who fail to respond or are denied by the reviewer. Which Microsoft Entra ID feature should they use?

Accepted Answer

Access Reviews. Microsoft Entra Access Reviews are specifically designed to automate periodic attestation of group memberships, including the ability to automatically remove users who do not respond or are denied by the reviewer. This feature supports quarterly recurring reviews and integrates directly with Entra ID groups to enforce access governance for sensitive applications.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 10

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that collects security data from across an organization, providing threat detection, investigation, and response. It also includes SOAR (Security Orchestration, Automation, and Response) capabilities through playbooks and automation rules, enabling automated incident response. These two features are core to Sentinel's functionality.

Answer

Identity governance and administration

Answer

Endpoint detection and response (EDR)

Answer

Data classification and labeling

Question 11

A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Microsoft Entra Verified ID

Question 12

A company uses Microsoft Entra ID. A junior administrator needs to occasionally reset passwords for the IT department. The security team wants to grant this permission only for a limited time and require an approval from a senior administrator before the permission becomes active. All password reset actions must be audited. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Entra ID Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing the junior administrator to request a time-limited role for password reset that requires approval from a senior administrator. PIM also enables auditing of all role activations and actions, meeting the security team's requirements for limited duration, approval workflow, and auditability.

Answer

Entra ID Identity Protection

Answer

Entra ID Conditional Access

Answer

Entra ID Terms of Use

Question 13

Your company uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on a specific device. Which feature should you use to get real-time visibility into running processes and network connections?

Accepted Answer

Live response. Live response gives security operators a remote shell connection to the device, enabling real-time investigation of running processes, network connections, and other forensic data. This is the correct feature for interactive, real-time visibility into a specific device during an active malware outbreak.

Answer

Threat analytics

Answer

Device inventory

Answer

Automated investigation

Question 14

A multinational organization uses Microsoft Entra ID and wants to allow employees to sign in to a custom customer-facing application using their existing social identities (e.g., LinkedIn, Google). They also need to enforce a specific terms of use agreement and be able to revoke a user's access if their social account is compromised. Which Microsoft Entra capability should they configure?

Accepted Answer

Microsoft Entra External ID (B2C). Microsoft Entra External ID (B2C) is the correct choice because it is specifically designed for customer-facing applications that need to support social identity providers (like LinkedIn and Google) via OAuth 2.0 and OpenID Connect. It allows you to enforce a custom terms of use agreement during sign-up and provides the ability to revoke a user's access by disabling their account in the B2C directory or removing the social identity mapping, which directly addresses the requirement to respond to a compromised social account.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 15

A multinational organization uses Microsoft Entra ID for identity management. External contractors need temporary elevated access to Azure resources for a critical project. The access must be time-bound (expires after 8 hours), require manager approval, and enforce multifactor authentication (MFA) when contractors activate the role. Which Microsoft Entra capability should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation (e.g., 8-hour expiry), requires approval workflows (manager approval), and enforces multifactor authentication (MFA) during role activation. PIM is specifically designed to manage, control, and monitor access to critical resources through time-limited, approved, and MFA-protected role assignments.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews