SC-900 Practice Exam 2 — 20 Questions

Question 1

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cmdlet Get-MgInformationProtectionPolicy does not return labels.. The cmdlet Get-MgInformationProtectionPolicy retrieves the policy configuration but does not return individual sensitivity labels. To update a specific label, you must use Get-MgInformationProtectionSensitivityLabel to first retrieve the label object, then pipe it to Set-MgInformationProtectionSensitivityLabel. The error 'label not found' occurs because the cmdlet used does not expose labels, not because the label is missing or misspelled.

Answer

The -Settings parameter is deprecated.

Answer

The user does not have permissions to view labels.

Answer

The label name is misspelled.

Question 2

Which TWO capabilities are part of Microsoft Entra ID Governance?

Accepted Answer

Entitlement Management. Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.

Answer

Identity Protection

Answer

Conditional Access

Answer

Self-Service Password Reset

Question 3

A company wants to protect its employees from phishing attacks delivered via email. The solution must analyze all URLs embedded in incoming emails in real-time. If a URL points to a known malicious site, the link should be blocked at the time of click. Additionally, the solution should sandbox URLs in attachments and provide time-of-click verification. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct solution because it provides Safe Links, which performs real-time URL scanning and time-of-click verification for URLs embedded in email messages and attachments. It also includes Safe Attachments, which detonates attachments in a sandbox environment to analyze embedded URLs. These capabilities directly address the requirement to block malicious links at click time and sandbox URLs in attachments.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Cloud App Security

Question 4

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.

Answer

Communication compliance

Answer

Insider risk management

Answer

eDiscovery

Question 5

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because workbooks provide visualizations, not automation. Option C is wrong because analytics rules create alerts, not automated responses. Option D is wrong because watchlists are for correlation, not response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 6

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Accepted Answer

Identify anomalous user activities such as mass file downloads. Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Answer

Review communications for policy violations

Answer

Conduct eDiscovery searches for legal cases

Answer

Block sharing of sensitive data via email

Question 7

A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?

Accepted Answer

Scheduled query rules. Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.

Answer

Hunting rules

Answer

Machine learning rules

Question 8

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 9

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behaviors, such as a spike in file downloads within a short time window. This policy uses machine learning to establish a baseline of normal activity and triggers alerts when deviations like downloading more than 10 files from SharePoint Online in 5 minutes occur, making it the correct choice for this use case.

Answer

Session policy

Answer

OAuth app policy

Answer

File policy

Question 10

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 11

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Accepted Answer

Sensitive information type for passport numbers. A sensitive information type (SIT) for passport numbers defines the pattern and validation logic that Microsoft Purview uses to detect passport numbers in content. An auto-labeling policy then applies the specified sensitivity label automatically when the SIT is matched, enabling automated classification and protection without user intervention.

Answer

Retention label

Answer

Data loss prevention (DLP) policy

Answer

Trainable classifier

Question 12

A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 13

A company uses Azure SQL Database, which is a Platform as a Service (PaaS) offering. The security team is reviewing the shared responsibility model and wants to know who is responsible for applying operating system patches to the underlying infrastructure that hosts the database. Who is responsible for this task?

Accepted Answer

Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.. Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system. In the shared responsibility model for PaaS, Microsoft is responsible for applying OS patches to the host servers, while the customer manages the database configuration and data. Therefore, option B correctly identifies Microsoft as responsible for OS patching in this context.

Answer

The customer is responsible for patching the OS on virtual machines but not for PaaS; however, the customer must patch the OS for Azure SQL Database.

Answer

Both the customer and Microsoft share equal responsibility for patching the OS in a PaaS model.

Answer

The cloud service provider partner (e.g., a managed service provider) is responsible for OS patches in PaaS.

Question 14

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct solution because it is specifically designed to inspect email content and attachments for sensitive data types, such as credit card numbers, using built-in sensitive info types. When a match is detected, the policy can automatically block the email from being sent externally, enforcing the organization's data protection requirements without manual intervention.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft Intune App Protection policy

Answer

Microsoft Entra ID Conditional Access policy

Question 15

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Accepted Answer

Conditional Access. Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Answer

Identity Protection

Answer

Security defaults

Answer

Password protection

Question 16

A compliance administrator needs to generate a report showing all user activities related to accessing highly sensitive documents in SharePoint. Which Microsoft Purview solution should they use?

Accepted Answer

Audit (Standard or Premium). Audit (Standard or Premium) logs and records all user activities, including access to highly sensitive documents in SharePoint. Audit (Premium) provides deeper visibility with events like 'FileAccessed' and 'SensitivityLabelApplied', enabling compliance administrators to generate detailed reports on who accessed sensitive content and when.

Answer

eDiscovery

Answer

Data Loss Prevention

Answer

Communication Compliance

Question 17

Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?

Accepted Answer

Add a condition to exclude accounts that are known admin accounts or service accounts.. Known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.

Answer

Change the rule to alert on every admin consent grant event regardless of account creation.

Answer

Remove the join with SigninLogs and only use AuditLogs.

Answer

Increase the time window from 10 minutes to 30 minutes.

Question 18

Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?

Accepted Answer

A sensitivity label with auto-labeling for sensitive information types. Sensitivity labels with auto-labeling can automatically detect sensitive information types (such as credit card numbers) in emails and apply a label that enforces encryption. This meets the requirement to both classify and protect the data in transit.

Answer

A trainable classifier for credit card numbers

Answer

A retention label for credit card information

Answer

A data loss prevention (DLP) policy

Question 19

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Risk-based conditional access policies. Risk-based conditional access policies (B) are a core capability of Microsoft Entra ID Protection, allowing organizations to automatically enforce access controls based on detected risk levels from user and sign-in activities. Reports on risky users and sign-ins (D) provide the foundational telemetry that Entra ID Protection uses to identify and investigate potential identity compromises, making both integral to the service.

Answer

Passwordless authentication

Answer

Just-in-time privileged access

Answer

Conditional access policies for device compliance

Question 20

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

Accepted Answer

The email is blocked and the user receives a notification.. The DLP policy in the exhibit has a condition that detects credit card numbers and an action set to 'BlockMessage' with 'NotifyUser' enabled. Since the policy is configured for Exchange (email) and the action blocks the message, the email is blocked and the user receives a notification. The 'TeamsChatAndChannel' property being false is irrelevant because the policy is applied to Exchange, not Teams.

Answer

The email is delivered normally because TeamsChatAndChannel is false.

Answer

The email is delivered but an alert is generated.

Answer

The email is encrypted before delivery.