SC-900 Practice Test 20 — 15 Questions

Question 1

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Accepted Answer

Create labels, then Publish labels, then Set auto-labeling rules, then Run scans, then Review results. Data classification involves creating labels, publishing them, setting auto-labeling rules, running scans, and reviewing results.

Answer

Create labels, then Set auto-labeling rules, then Publish labels, then Run scans, then Review results

Answer

Run scans, then Create labels, then Publish labels, then Set auto-labeling rules, then Review results

Answer

Create labels, then Publish labels, then Run scans, then Set auto-labeling rules, then Review results

Question 2

A company uses Microsoft 365 and wants to protect its users from malicious links and attachments in email, as well as phishing attacks. Which Microsoft security solution is specifically designed for email and collaboration protection?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) is the dedicated security solution for email and collaboration workloads. It provides protection against malicious links (Safe Links), malicious attachments (Safe Attachments), and anti-phishing policies specifically for Exchange Online, SharePoint, OneDrive, and Teams. This directly matches the question's requirement for email and collaboration protection.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 3

Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?

Accepted Answer

Access is blocked. The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.

Answer

Access is granted because the policy is only for Office 365 and the user uses Exchange Online

Answer

Access is granted after MFA registration prompt

Answer

Access is granted because the device is compliant

Question 4

A company uses Microsoft Entra ID. They want to ensure only current employees have access to a sensitive HR application. They implement a process where group membership for the HR app is reviewed quarterly by the HR manager, and any unnecessary access is automatically removed. Which Microsoft Entra feature should they use?

Accepted Answer

C. The scenario describes a recurring review of group membership for the HR application, with automatic removal of unnecessary access. This is exactly what Microsoft Entra ID Governance's Access Reviews feature provides: scheduled reviews (e.g., quarterly) where a reviewer (the HR manager) attests to each member's continued need, and stale access is automatically revoked upon completion.

Answer

A

Answer

B

Answer

D

Question 5

Match each compliance term to its correct definition.

Accepted Answer

Data Loss Prevention: Helps prevent sensitive information from being shared outside the organization. Compliance terms in Microsoft 365 cover data protection, communication restrictions, data governance, and legal discovery. DLP prevents data leaks, Information Barriers control internal communication, Records Management handles retention, and eDiscovery supports legal processes.

Answer

Data Loss Prevention: Restricts communication and collaboration between specific groups

Answer

Records Management: Helps prevent sensitive information from being shared outside the organization

Question 6

A company runs critical applications on Windows Server virtual machines in Azure and on-premises. The security team wants to reduce the exposure of administrative ports (e.g., RDP, SSH) by requiring administrators to request just-in-time (JIT) access. The request should require approval from a central team, and the port should be opened only for a limited time. Which Microsoft security solution provides this JIT capability for both Azure and on-premises servers (when connected via Azure Arc)?

Accepted Answer

Microsoft Defender for Cloud (with just-in-time VM access). Microsoft Defender for Cloud's just-in-time (JIT) VM access capability reduces exposure to administrative ports (RDP, SSH) by locking down inbound traffic to Azure VMs and Azure Arc-enabled on-premises servers. It requires administrators to request access, which can be configured to require approval from a central team, and automatically opens the specified ports for a limited time before closing them again. This directly matches the scenario's need for JIT access with approval and time-limited port opening across hybrid environments.

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 7

A security administrator needs to identify and remediate misconfigurations in Azure resources that could lead to security breaches. They want a central dashboard that provides a secure score based on security controls and recommendations. Which Microsoft solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a centralized dashboard that continuously assesses Azure resources against security best practices, delivering a secure score based on implemented security controls and actionable recommendations. This directly matches the administrator's need to identify and remediate misconfigurations that could lead to breaches.

Answer

Microsoft Sentinel

Answer

Microsoft 365 Defender

Answer

Microsoft Intune

Question 8

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.. Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

Question 9

Your organization has implemented Microsoft Entra ID Governance. You need to review and attest to the access rights of users in a specific group every quarter. The group contains both direct members and members from nested groups. Which Microsoft Entra feature should you use to automate this review?

Accepted Answer

Access reviews. Access Reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group membership, including both direct members and transitive members from nested groups. This feature automates the attestation process by sending reviewers notifications and tracking their decisions, ensuring compliance with quarterly review requirements.

Answer

Lifecycle workflows

Answer

Privileged Identity Management

Answer

Entitlement management

Question 10

A company wants to use Microsoft Intune to manage devices. Which TWO capabilities does Intune provide?

Accepted Answer

Mobile device management (MDM). Microsoft Intune provides Mobile Device Management (MDM) capabilities, allowing administrators to enroll devices, enforce configuration policies, and remotely wipe corporate data. Option D is correct because Intune also provides Mobile Application Management (MAM), enabling control over app access and data protection without requiring full device enrollment, using app protection policies.

Answer

Compliance assessment for cloud resources

Answer

Endpoint detection and response

Answer

Identity and access management

Question 11

A company wants to classify and label data in Microsoft SharePoint Online automatically based on content containing passport numbers. Which Microsoft Purview feature should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive information types, such as passport numbers. This enables automatic classification and labeling without manual intervention, meeting the requirement to label data based on content.

Answer

Audit log

Answer

Data classification dashboard

Answer

Data loss prevention (DLP) policy

Question 12

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

Accepted Answer

SAML-based single sign-on. D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Answer

Kerberos delegation

Answer

OpenID Connect authentication

Answer

SCIM-based user provisioning

Question 13

A company implements a security measure to ensure that only authorized employees can view sensitive customer records. Which principle of the CIA triad does this measure primarily protect?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive information is accessible only to authorized individuals. By restricting access to customer records to authorized employees, the company directly prevents unauthorized disclosure, which is the core goal of confidentiality in the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Accountability

Question 14

You are a security administrator for a company that uses Microsoft 365. The compliance team needs to automatically classify and protect sensitive data such as credit card numbers in emails and documents. Which Microsoft Purview solution should you recommend?

Accepted Answer

Microsoft Purview Information Protection. A is correct because Microsoft Purview Information Protection (formerly Azure Information Protection) provides automatic classification of sensitive data, such as credit card numbers, by applying sensitivity labels based on rules and patterns. It also offers protection through encryption or access restrictions. This solution directly addresses the compliance team's requirement for both automatic classification and protection. Data Loss Prevention (DLP) enforces protective actions after classification but does not perform the classification itself.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Data Loss Prevention

Question 15

Refer to the exhibit. A security analyst runs this Microsoft Graph PowerShell command. What is the most likely purpose of this command?

Accepted Answer

To find users whose user principal name starts with 'j'.. The Microsoft Graph PowerShell command shown (likely Get-MgUser -Filter "startswith(userPrincipalName,'j')") retrieves users whose userPrincipalName begins with 'j'. The Get-MgUser cmdlet with a startswith filter returns matching user objects, so the purpose is to find users with a UPN starting with 'j'. This is a read-only query, not an update or delete operation.

Answer

To update the display names of users starting with 'j'.

Answer

To remove users whose user principal name starts with 'j'.

Answer

To list all users and their group memberships.