SC-900 Practice Test 19 — 15 Questions

Question 1

A company uses Microsoft Entra ID (Azure AD). They have a cloud-based HR system (e.g., Workday) that contains employee records. They want to automate the process of creating user accounts in Microsoft Entra ID for new hires and deactivating accounts for terminated employees based on information from the HR system. Which Microsoft Entra ID feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Application Provisioning. Microsoft Entra Application Provisioning (specifically HR-driven provisioning) is the correct feature because it automates the creation, update, and deactivation of user accounts in Microsoft Entra ID based on changes in an external HR system like Workday. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize employee lifecycle events from the HR source to Entra ID, enabling fully automated user provisioning without manual intervention.

Answer

Microsoft Entra Connect

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra Access Reviews

Question 2

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention, while maintaining security by requiring multi-factor authentication (MFA) during the reset process. Which feature should you enable?

Accepted Answer

Microsoft Entra self-service password reset (SSPR).. Microsoft Entra self-service password reset (SSPR) is the feature specifically designed to allow users to reset their own passwords without help desk intervention. When combined with Microsoft Entra Multi-Factor Authentication (MFA) as a registration and reset requirement, SSPR enforces MFA during the reset process, meeting both the self-service and security requirements.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra Multi-Factor Authentication.

Answer

Conditional Access policies.

Question 3

A company is involved in litigation and needs to preserve all Exchange Online mailboxes and SharePoint sites related to the case. The legal team also requires the ability to search, review, and export relevant content. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, reviewing, and exporting content from Exchange Online mailboxes and SharePoint sites. It supports legal hold placement on custodians and data sources, advanced search with keyword and proximity queries, review sets with analytics, and export in a format suitable for litigation. This directly matches the requirement to preserve all relevant mailboxes and sites while enabling the legal team to search, review, and export content.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Premium)

Question 4

Your organization uses Microsoft Sentinel as a SIEM. You need to collect security events from on-premises servers. Which connector should you use?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct connector because it is the primary agent for collecting security events from on-premises Windows and Linux servers into a Log Analytics workspace, which Microsoft Sentinel uses as its data source. AMA supports data collection rules (DCRs) to filter and route specific security event IDs, replacing the legacy Log Analytics agent. This enables Sentinel to ingest Windows Security Events (e.g., Event ID 4625 for failed logons) for threat detection and incident creation.

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Answer

Log Analytics workspace

Question 5

Which THREE features are part of Microsoft Entra ID? (Select three.)

Accepted Answer

Privileged Identity Management. Conditional Access is a core feature of Microsoft Entra ID that allows administrators to enforce policies based on conditions such as user location, device state, or sign-in risk, enabling granular access control. Identity Protection is also part of Microsoft Entra ID, using machine learning to detect and respond to identity-based risks like leaked credentials or anomalous sign-in patterns. Privileged Identity Management (PIM) is a key capability of Microsoft Entra ID Governance, which is a set of features within Microsoft Entra ID for managing, controlling, and monitoring access to important resources, and is explicitly covered as a Microsoft Entra ID capability in the SC-900 exam objectives.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 6

A company has several custom-developed web applications hosted on-premises. The company wants to provide employees with secure remote access to these applications without deploying a traditional VPN. Employees should be able to sign in using their existing Microsoft Entra ID credentials, and the solution should pass through multi-factor authentication policies. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It allows employees to sign in with their existing Microsoft Entra ID credentials and enforces conditional access policies, including multi-factor authentication, without requiring a traditional VPN.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 7

Refer to the exhibit. A sensitivity label is configured as shown. A user applies the parent label to a document containing credit card numbers. What is the expected behavior?

Accepted Answer

The document gets the parent label's encryption (ViewOnly) and header, but no watermark. When a user manually applies a parent sensitivity label that has sublabels, only the parent label's settings (encryption and header) are applied. The sublabel's watermark is not applied because sublabels are separate entities that must be explicitly selected; they are not automatically inherited or triggered by applying the parent label. The encryption (ViewOnly) and header come from the parent label's configuration, while the watermark belongs to the sublabel and is not applied.

Answer

The document gets the parent label's header and the sublabel's encryption and watermark

Answer

The document gets no protection because credit card numbers are only detected by auto-labeling

Answer

The document gets the parent label's encryption and header, and auto-labeling applies the sublabel

Question 8

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to ensure that when a user attempts to share a document containing credit card numbers via email, the document is blocked and the user receives a policy tip. What should you configure in the DLP policy?

Accepted Answer

Set the action to 'Block with override'. The requirement is to block the sharing of a document containing credit card numbers via email while also providing a policy tip to the user. In Microsoft Purview DLP, the 'Block with override' action blocks the sensitive data from being shared but allows the user to override the block (e.g., by providing a business justification), and it automatically triggers a policy tip to inform the user. This matches the scenario exactly.

Answer

Set the action to 'Audit only'

Answer

Set the action to 'Block'

Answer

Set the action to 'Notify only'

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.

Answer

Activity policy

Answer

App discovery policy

Answer

Session policy

Question 10

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are the correct Microsoft Purview capability to prevent sensitive data from being inadvertently shared during Copilot interactions. DLP policies can inspect content in real time, including Copilot prompts and responses, and apply actions such as blocking or warning when sensitive information types (e.g., credit card numbers, social security numbers) are detected. This directly addresses the requirement to prevent inadvertent sharing of sensitive data within the Copilot environment.

Answer

Customer Lockbox

Answer

Sensitivity labels

Answer

eDiscovery

Question 11

Contoso has a hybrid identity with AD DS synced to Microsoft Entra ID. They want to block legacy authentication protocols that bypass MFA. Which security solution should they use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID can be configured to block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic authentication) by targeting client apps that do not support modern authentication. This directly prevents bypass of MFA because legacy protocols do not support MFA challenges, making them a common attack vector. By creating a policy that blocks all access from legacy authentication clients, Contoso enforces MFA for all sign-ins that use modern authentication.

Answer

Microsoft Entra Password Protection

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect Health

Question 12

Your legal team needs to search for all emails from a specific executive that mention a project name 'ProjectX' for a litigation hold. Which Microsoft Purview tool should they use?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery (specifically Content Search or eDiscovery (Premium)) is the correct tool because it is designed to search across Exchange Online mailboxes, SharePoint sites, and other data sources for specific content like emails containing 'ProjectX' from a specific executive. This capability directly supports litigation holds by allowing you to identify, preserve, and export relevant data. Communication Compliance focuses on policy-based detection of inappropriate communications, not ad-hoc searches for litigation.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Question 13

Your organization needs to audit all changes to sensitive files in SharePoint Online for at least 180 days. Which Microsoft Purview feature should be enabled?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides the extended retention of audit logs (up to 10 years) and the ability to search for high-value events such as changes to sensitive files. For a requirement of at least 180 days, Audit (Premium) is necessary because standard audit logs are retained for only 90 days. This feature logs all modifications to SharePoint Online files, including who changed what and when, meeting the auditing requirement.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Data Lifecycle Management

Question 14

A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?

Accepted Answer

Managing access controls and authentication for database users. In the shared responsibility model for Azure SQL Database, Microsoft manages the physical infrastructure, including servers, storage, and network, while the customer is responsible for data and access management. Option B is correct because managing access controls and authentication for database users, such as configuring logins, users, and permissions via T-SQL or Azure Active Directory, falls squarely on the customer. Microsoft ensures the platform is patched and secure, but the customer must control who can access the database and what they can do.

Answer

Patching the physical servers hosting the database

Answer

Securing the hypervisor running the virtual machines

Answer

Hardening the network firewalls at the datacenter perimeter

Question 15

Your company wants to allow partners to use their own corporate credentials to access a specific SharePoint site. Which Microsoft Entra ID feature supports this?

Accepted Answer

B2B collaboration. Microsoft Entra ID B2B (business-to-business) collaboration allows you to invite external users from partner organizations to access your company's resources, such as SharePoint sites, using their own corporate credentials. This feature supports identity federation with the partner's Azure AD or other identity providers, enabling seamless single sign-on (SSO) without requiring the partner users to create new accounts in your tenant.

Answer

App Registrations

Answer

B2C collaboration

Answer

Device Registration