SC-900 Practice Test 2 — 10 Questions

Question 1

Which TWO features are part of Microsoft Purview Information Protection?

Accepted Answer

Automatic classification based on sensitive content. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Automatic classification based on sensitive content (Option C) is a core capability of MIP, using built-in or custom sensitive information types to detect and label data automatically. Sensitivity labels (Option D) are the primary mechanism in MIP to apply protection actions such as encryption, access restrictions, and visual markings to documents and emails.

Answer

Communication monitoring

Answer

Retention policies

Answer

Audit log investigation

Question 2

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.

Answer

Audit

Answer

eDiscovery

Question 3

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

Accepted Answer

The user's last sign-in dates. The command `Get-MgUser -UserId user@contoso.com -Property SignInActivity | Select-Object -Property SignInActivity` retrieves the `SignInActivity` property of the specified user, which contains the `lastSignInDateTime` and `lastNonInteractiveSignInDateTime` fields. This data directly provides the user's last sign-in dates, making option B correct.

Answer

The user's license assignments

Answer

The user's assigned roles

Answer

The user's group memberships

Question 4

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session controls for real-time monitoring of app usage. Microsoft Defender for Cloud Apps provides session controls that enable real-time monitoring and control of app usage. These controls use reverse proxy architecture to enforce policies on user activities within cloud apps, such as blocking downloads or requiring multi-factor authentication during a session.

Answer

Mobile device management

Answer

Device compliance enforcement

Answer

Email filtering and anti-phishing

Question 5

A financial services company uses Microsoft Purview to manage compliance. They need to automatically apply a 'Confidential' label to all documents containing financial data in SharePoint. What should they configure?

Accepted Answer

Auto-labeling policy for sensitivity labels. Auto-labeling policies for sensitivity labels in Microsoft Purview allow organizations to automatically apply labels to documents based on conditions such as sensitive information types (e.g., financial data patterns). This meets the requirement to label documents containing financial data in SharePoint without manual intervention, leveraging built-in or custom sensitive info types.

Answer

Data classification dashboard

Answer

Trainable classifiers for manual labeling

Answer

Data Loss Prevention (DLP) policy

Question 6

Refer to the exhibit. An administrator runs the Azure CLI commands shown. What is the purpose of these commands?

Accepted Answer

To authenticate a service principal for automated tasks.. The Azure CLI commands shown are used to authenticate a service principal for automated tasks. Specifically, `az login --service-principal -u -p --tenant ` authenticates using the service principal's credentials without interactive user login, enabling non-interactive automation or scripts.

Answer

To create a new service principal.

Answer

To list all Azure subscriptions.

Answer

To log in to Azure as a user with MFA.

Question 7

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

Accepted Answer

The cmdlet Get-MgInformationProtectionPolicy does not return labels.. The cmdlet Get-MgInformationProtectionPolicy retrieves the policy configuration but does not return individual sensitivity labels. To update a specific label, you must use Get-MgInformationProtectionSensitivityLabel to first retrieve the label object, then pipe it to Set-MgInformationProtectionSensitivityLabel. The error 'label not found' occurs because the cmdlet used does not expose labels, not because the label is missing or misspelled.

Answer

The -Settings parameter is deprecated.

Answer

The user does not have permissions to view labels.

Answer

The label name is misspelled.

Question 8

Which TWO capabilities are part of Microsoft Entra ID Governance?

Accepted Answer

Entitlement Management. Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.

Answer

Identity Protection

Answer

Conditional Access

Answer

Self-Service Password Reset

Question 9

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.

Answer

Communication compliance

Answer

Insider risk management

Answer

eDiscovery

Question 10

Your organization is implementing a data loss prevention (DLP) policy to prevent sensitive data from being shared via email. Users in the finance department need to send financial reports to external auditors. What should you configure?

Accepted Answer

Configure a DLP policy with an override option allowing users to justify the sharing. Configuring a DLP policy with an override option allows finance users to share financial reports with external auditors while still providing a justification, ensuring legitimate business needs are met without blocking all external sharing. Option A is incorrect because DLP policies use allow lists for exceptions, but an override with justification is more appropriate for this scenario. Option C is incorrect because sensitivity labels can encrypt emails, but they do not replace the need for a DLP policy with override for specific external sharing. Option D is incorrect because a block action would prevent all external sharing, which is not suitable for legitimate business needs.

Answer

Add the auditors' domains to a DLP allow list

Answer

Assign a sensitivity label that automatically encrypts the email

Answer

Configure a DLP policy with a block action for all external sharing