SC-900 Practice Test 2 — 10 Questions

Question 1

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

Accepted Answer

Blocks sign-ins that have a high sign-in risk level. The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Answer

Blocks sign-ins for users with high user risk

Answer

Blocks all sign-ins for the assigned users

Answer

Requires multi-factor authentication for high-risk sign-ins

Question 2

Your organization wants to label emails and documents as 'Confidential' automatically based on content patterns. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling (sensitivity labels). Auto-labeling (sensitivity labels) in Microsoft Purview can automatically apply 'Confidential' labels to emails and documents based on content patterns, such as credit card numbers or specific keywords. This feature uses pattern matching and machine learning classifiers to detect sensitive content and assign the appropriate sensitivity label without manual intervention.

Answer

Audit log

Answer

Retention labels

Answer

Data Loss Prevention policy

Question 3

A user is locked out of their account due to multiple failed sign-in attempts. Which Microsoft Entra ID feature can automatically block suspicious sign-in attempts based on risk?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect and automatically block suspicious sign-in attempts based on risk signals such as anonymous IP addresses, atypical travel, or leaked credentials. When a user is locked out due to multiple failed attempts, Entra ID Protection can evaluate the sign-in risk and enforce a block or require multi-factor authentication before allowing access.

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra ID Governance

Answer

Conditional Access

Question 4

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

Accepted Answer

Top 10 high-severity alert titles by number of distinct affected devices. The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Answer

Top 10 alert titles by number of distinct devices, including all severities

Answer

Top 10 devices with the most high-severity alerts

Answer

Top 10 high-severity alert titles by total number of alerts

Question 5

Which TWO features are part of Microsoft Purview Information Protection?

Accepted Answer

Automatic classification based on sensitive content. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Automatic classification based on sensitive content (Option C) is a core capability of MIP, using built-in or custom sensitive information types to detect and label data automatically. Sensitivity labels (Option D) are the primary mechanism in MIP to apply protection actions such as encryption, access restrictions, and visual markings to documents and emails.

Answer

Communication monitoring

Answer

Retention policies

Answer

Audit log investigation

Question 6

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.

Answer

Audit

Answer

eDiscovery

Question 7

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

Accepted Answer

The user's last sign-in dates. The command `Get-MgUser -UserId user@contoso.com -Property SignInActivity | Select-Object -Property SignInActivity` retrieves the `SignInActivity` property of the specified user, which contains the `lastSignInDateTime` and `lastNonInteractiveSignInDateTime` fields. This data directly provides the user's last sign-in dates, making option B correct.

Answer

The user's license assignments

Answer

The user's assigned roles

Answer

The user's group memberships

Question 8

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session controls for real-time monitoring of app usage. Microsoft Defender for Cloud Apps provides session controls that enable real-time monitoring and control of app usage. These controls use reverse proxy architecture to enforce policies on user activities within cloud apps, such as blocking downloads or requiring multi-factor authentication during a session.

Answer

Mobile device management

Answer

Device compliance enforcement

Answer

Email filtering and anti-phishing

Question 9

A financial services company uses Microsoft Purview to manage compliance. They need to automatically apply a 'Confidential' label to all documents containing financial data in SharePoint. What should they configure?

Accepted Answer

Auto-labeling policy for sensitivity labels. Auto-labeling policies for sensitivity labels in Microsoft Purview allow organizations to automatically apply labels to documents based on conditions such as sensitive information types (e.g., financial data patterns). This meets the requirement to label documents containing financial data in SharePoint without manual intervention, leveraging built-in or custom sensitive info types.

Answer

Data classification dashboard

Answer

Trainable classifiers for manual labeling

Answer

Data Loss Prevention (DLP) policy

Question 10

Refer to the exhibit. An administrator runs the Azure CLI commands shown. What is the purpose of these commands?

Accepted Answer

To authenticate a service principal for automated tasks.. The Azure CLI commands shown are used to authenticate a service principal for automated tasks. Specifically, `az login --service-principal -u -p --tenant ` authenticates using the service principal's credentials without interactive user login, enabling non-interactive automation or scripts.

Answer

To create a new service principal.

Answer

To list all Azure subscriptions.

Answer

To log in to Azure as a user with MFA.