SC-900 Practice Exam 2 — 20 Questions

Question 1

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Accepted Answer

Identify anomalous user activities such as mass file downloads. Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Answer

Review communications for policy violations

Answer

Conduct eDiscovery searches for legal cases

Answer

Block sharing of sensitive data via email

Question 2

A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?

Accepted Answer

Scheduled query rules. Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.

Answer

Hunting rules

Answer

Machine learning rules

Question 3

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 4

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Accepted Answer

Enforce company policies on communication channels. Microsoft Purview Communication Compliance allows organizations to enforce company policies on communication channels such as email, Microsoft Teams, and third-party platforms. It does this by scanning communications for policy violations (e.g., insider trading, harassment) and enabling designated reviewers to take remediation actions like escalating or archiving messages.

Answer

Automatically apply sensitivity labels to documents

Answer

Prevent sharing of credit card numbers via email

Answer

Place legal holds on user mailboxes

Question 5

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behaviors, such as a spike in file downloads within a short time window. This policy uses machine learning to establish a baseline of normal activity and triggers alerts when deviations like downloading more than 10 files from SharePoint Online in 5 minutes occur, making it the correct choice for this use case.

Answer

Session policy

Answer

OAuth app policy

Answer

File policy

Question 6

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 7

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. It combines a Conditional Access policy that requires a compliant device (enforced by Intune) with an Intune app protection policy (MAM) that prevents copying corporate data to unmanaged apps. This meets both requirements. Option A is incorrect because Windows Autopilot is for provisioning, not compliance enforcement. Option B is incorrect because MFA and Windows Hello for Business do not control device compliance or data leakage. Option C is incorrect because requiring an approved client app alone does not enforce device compliance, and Azure AD Application Proxy is for remote access to on-premises apps, not data protection.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 8

An organization wants to enable passwordless authentication for its users by using a mobile app. Which Microsoft Entra ID authentication method should they implement?

Accepted Answer

Microsoft Authenticator (passwordless sign-in). Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate via app notification. FIDO2 security keys are hardware tokens. Windows Hello for Business uses biometrics. Temporary Access Pass is for initial setup.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Question 9

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because data loss prevention policies use classification but are not the classification mechanism itself. Option B is wrong because sensitivity labels are used for applying protection based on classification, not for classification itself. Option D is wrong because retention labels are for data retention policies.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 10

A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?

Accepted Answer

A conditional access policy is blocking access based on the user's location. Although the user is a member of the Finance group and has the required sensitivity label permission, the conditional access policy blocks access based on the user's location (country). Conditional access policies can override label permissions. Option A is incorrect because the user does have the required label permission. Option B is incorrect because no licensing issue is indicated; Microsoft 365 E5 is not required for sensitivity labels. Option D is incorrect because the document does have a sensitivity label applied.

Answer

The user does not have the required sensitivity label permission

Answer

The user does not have a Microsoft 365 E5 license

Answer

The document does not have a sensitivity label applied

Question 11

Refer to the exhibit. A legal team needs to preserve all documents in SharePoint and OneDrive for 5 years. The current policy retains for 1 year. What should the administrator do to meet the requirement?

Accepted Answer

Change the retention duration to 1825 days.. The policy retains for 365 days (1 year), but the requirement is 5 years. Changing the retention duration to 1825 days (5 years) meets the requirement. Option A is wrong because the policy already includes both locations. Option B is wrong because changing to Delete would delete content. Option D is wrong because changing to KeepAndDelete would still delete after retention, but the duration is the issue.

Answer

Add Exchange Online to the locations.

Answer

Change the retention type to Delete.

Answer

Change the retention action to KeepAndDelete.

Question 12

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Accepted Answer

Sensitive information type for passport numbers. A sensitive information type (SIT) for passport numbers defines the pattern and validation logic that Microsoft Purview uses to detect passport numbers in content. An auto-labeling policy then applies the specified sensitivity label automatically when the SIT is matched, enabling automated classification and protection without user intervention.

Answer

Retention label

Answer

Data loss prevention (DLP) policy

Answer

Trainable classifier

Question 13

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

Accepted Answer

The location condition is configured to include trusted locations. The policy includes MFA for Exchange Online, but the location condition 'includeLocations' with 'AllTrusted' means it applies to trusted locations, not excludes them. To exclude trusted locations, the policy should use 'excludeLocations'. Therefore, the user is prompted for MFA when accessing from a trusted IP because the policy is incorrectly configured to include trusted locations, making option A the most likely cause.

Answer

The policy targets high sign-in risk

Answer

The policy does not apply to Exchange Online

Answer

The policy requires device compliance

Question 14

Which THREE are features of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time VM access. Just-in-time (JIT) VM access is a feature of Microsoft Defender for Cloud that reduces exposure to brute-force attacks by locking down inbound traffic to VMs. It allows you to control when specific ports (e.g., RDP port 3389 or SSH port 22) are opened on demand, based on role-based access control (RBAC) and approved requests, and automatically closes them after a configured time window.

Answer

Data classification

Answer

Incident investigation

Question 15

Which TWO of the following are benefits of using Microsoft Entra ID for identity management?

Accepted Answer

Single sign-on (SSO) to cloud applications. Single sign-on (SSO) and multi-factor authentication (MFA) are key benefits of Entra ID. Password hash synchronization is a feature of Entra Connect, not a direct benefit. On-premises Active Directory is a separate service. Security incident detection is more aligned with Microsoft Sentinel or Defender.

Answer

Password hash synchronization

Answer

Automated security incident detection

Answer

Replacement of on-premises Active Directory

Question 16

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Accepted Answer

View a compliance score that indicates your overall compliance posture.. Compliance Manager provides a compliance score to indicate your overall compliance posture (B), suggests improvement actions to achieve compliance (D), and allows you to assign compliance tasks to other users (C). Option A is incorrect because Data Loss Prevention policies are created in the Microsoft Purview compliance portal, not directly in Compliance Manager. Option E is incorrect because automatically applying sensitivity labels is done through auto-labeling policies, not Compliance Manager.

Answer

Create Data Loss Prevention policies.

Answer

Automatically apply sensitivity labels to documents.

Question 17

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security Information and Event Management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that collects and analyzes security data from across an enterprise. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response. These two core functions—SIEM and SOAR—are explicitly listed as features of Sentinel.

Answer

Data loss prevention

Answer

Endpoint detection and response

Answer

Identity governance

Question 18

A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 19

A company uses Azure SQL Database, which is a Platform as a Service (PaaS) offering. The security team is reviewing the shared responsibility model and wants to know who is responsible for applying operating system patches to the underlying infrastructure that hosts the database. Who is responsible for this task?

Accepted Answer

Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.. Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system. In the shared responsibility model for PaaS, Microsoft is responsible for applying OS patches to the host servers, while the customer manages the database configuration and data. Therefore, option B correctly identifies Microsoft as responsible for OS patching in this context.

Answer

The customer is responsible for patching the OS on virtual machines but not for PaaS; however, the customer must patch the OS for Azure SQL Database.

Answer

Both the customer and Microsoft share equal responsibility for patching the OS in a PaaS model.

Answer

The cloud service provider partner (e.g., a managed service provider) is responsible for OS patches in PaaS.

Question 20

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct solution because it is specifically designed to inspect email content and attachments for sensitive data types, such as credit card numbers, using built-in sensitive info types. When a match is detected, the policy can automatically block the email from being sent externally, enforcing the organization's data protection requirements without manual intervention.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft Intune App Protection policy

Answer

Microsoft Entra ID Conditional Access policy