SC-900 Practice Test 20 — 15 Questions

Question 1

A company wants to automatically detect and remediate inappropriate messages in Microsoft Teams. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect and remediate inappropriate messages in Microsoft Teams, including offensive language, harassment, and sensitive information. It uses configurable policies to automatically scan messages and apply remediation actions like flagging, notifying managers, or removing content, directly addressing the requirement for automated detection and remediation.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Data Loss Prevention

Question 2

A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The fingerprint scan demonstrates authentication, as the user proves their identity through a biometric factor. The subsequent role-based check of group membership ('Data Analyst') to grant database access demonstrates authorization. Therefore, only Option A (Authentication and authorization) is correct. Option B is incorrect because confidentiality and integrity are not demonstrated in this scenario: the scenario does not address data protection from unauthorized disclosure (confidentiality) or assurance that data is accurate and unmodified (integrity). The authorization check prevents unauthorized access, which is a component of access control but not a direct demonstration of confidentiality; integrity is not shown at all. Option C is incorrect because identification (claiming an identity) is not shown; the fingerprint is used for proof, not claim, and non-repudiation is not established. Option D is incorrect because availability of the database and accountability of user actions are not demonstrated.

Answer

Confidentiality and integrity

Answer

Identification and non-repudiation

Answer

Availability and accountability

Question 3

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

Accepted Answer

Open the associated incident to view all related alerts and entities.. Microsoft 365 Defender incidents aggregate multiple alerts and entities (users, devices, mailboxes) into a single view, providing the full context needed to understand the attack chain. Opening the incident first allows the analyst to correlate the alert with related alerts, affected assets, and the incident timeline, which is the recommended initial step in incident response workflows.

Answer

Isolate the affected user's device immediately.

Answer

Mark the alert as resolved.

Answer

Run an automated simulation to test the alert.

Question 4

Your organization needs to create a policy that prevents users from sharing credit card numbers in emails. Which Microsoft Purview solution should you configure?

Accepted Answer

Data loss prevention (DLP) policy. Data loss prevention (DLP) policies in Microsoft Purview are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. By configuring a DLP policy with a credit card number sensitive info type, the organization can block users from sending emails containing those patterns, either by preventing the email from being sent or by triggering a policy tip. This directly addresses the requirement to prevent sharing of credit card numbers in emails.

Answer

Communication Compliance

Answer

Retention policy

Answer

eDiscovery

Question 5

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a passcode can access corporate email. What should you configure?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune evaluates device settings, such as requiring a passcode, and marks devices as noncompliant if they lack one. Conditional Access policies can then block noncompliant devices from accessing corporate email, ensuring only compliant devices with a passcode are allowed.

Answer

Device configuration policy

Answer

Enrollment restrictions

Answer

App protection policy

Question 6

You are configuring Microsoft Entra ID Governance. You need to ensure that when a user leaves the organization, their access to all SaaS applications is automatically revoked. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Access Reviews. Microsoft Entra Access Reviews allows administrators to create recurring reviews of user access to SaaS applications. When a user leaves the organization, an automated access review can be configured to remove their access based on the review results, ensuring revocation of access to all assigned SaaS apps. This directly addresses the requirement for automatic revocation upon departure.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Terms of Use

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the correct mechanism to enforce access controls based on device compliance status. By integrating with Intune's device compliance policies, a Conditional Access policy can block or allow access to corporate email (e.g., Exchange Online) based on whether the device is marked as compliant. This is the standard approach for controlling access to cloud apps like email based on device health.

Answer

An app protection policy in Microsoft 365 admin center

Answer

A conditional access policy in Azure AD

Answer

A device compliance policy in Intune

Question 8

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

Accepted Answer

To detect when a file labeled 'Highly Confidential' is shared externally. The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.

Answer

To identify all files shared externally regardless of sensitivity

Answer

To automatically block external sharing of sensitive files

Answer

To list all alerts generated by the rule

Question 9

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

Accepted Answer

Email & collaboration in Microsoft Defender XDR. Microsoft Defender XDR's Email & collaboration feature (part of Defender for Office 365) is the correct tool for investigating a suspicious email. It provides a unified investigation experience, including threat explorer, email entity pages, and detonation analysis, allowing you to inspect the email's headers, attachments, URLs, and determine its threat level using Microsoft's threat intelligence and machine learning models.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 10

Your company uses Microsoft Defender for Cloud Apps. You want to discover which cloud apps are being used in your organization and assess their risk levels. What should you use?

Accepted Answer

Cloud Discovery. Cloud Discovery is the feature within Microsoft Defender for Cloud Apps that analyzes traffic logs to identify which cloud apps are being used in your organization and assesses their risk based on the Cloud App Security Catalog. It provides visibility into Shadow IT by discovering unsanctioned app usage and assigning a risk score to each app.

Answer

Cloud App Security Catalog

Answer

Microsoft Purview Data Map

Answer

Microsoft Intune app inventory

Question 11

Your organization uses Microsoft 365 and wants to automatically quarantine suspicious emails before they reach users' inboxes. Which solution should you configure?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Exchange Online Protection (EOP) and advanced threat protection features such as Safe Attachments and Safe Links. These capabilities automatically quarantine suspicious emails—including those with malicious attachments, phishing URLs, or spoofed senders—before they reach user inboxes, based on policy-defined actions like 'Quarantine message'.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

An organization uses Microsoft Purview Communication Compliance. They need to monitor Microsoft Teams messages for potential insider trading language. What should they configure?

Accepted Answer

A Communication Compliance policy. B is correct because Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate or policy-violating communications, including insider trading language in Microsoft Teams messages. By configuring a Communication Compliance policy, the organization can define custom conditions (e.g., keywords, patterns, or classifiers) to scan Teams chats and channels for prohibited financial language, enabling automated alerts and remediation workflows.

Answer

An eDiscovery case

Answer

A Data Loss Prevention policy

Answer

A sensitivity label policy

Question 13

An organization must prove to an auditor that only authorized users have accessed sensitive HR files over the past year. The compliance team needs to generate a report of all access events to these files. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides detailed logging of all access events to sensitive files, including who accessed them, when, and from where. The compliance team can generate a comprehensive report of these events over the past year, meeting the auditor's requirement to prove only authorized users accessed the HR files. Audit (Premium) offers extended retention (up to 10 years) and advanced search capabilities, making it ideal for forensic investigations and compliance audits.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Information Protection

Question 14

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

Accepted Answer

Device health report. The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.

Answer

Threat analytics report

Answer

Vulnerability management dashboard

Answer

Microsoft Secure Score report

Question 15

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. What should they configure?

Accepted Answer

Compliance policy and conditional access. Combining a compliance policy (which checks the device OS version against a minimum requirement) with a Conditional Access policy (which blocks access if the device is non-compliant) is the standard Microsoft approach to enforce OS version requirements for accessing corporate email. The compliance policy marks devices below the minimum OS version as non-compliant, and the Conditional Access policy then denies access to Exchange Online or other corporate resources for those non-compliant devices.

Answer

App protection policy

Answer

Device enrollment restriction

Answer

Device configuration profile