SC-900 Practice Exam 3 — 20 Questions

Question 1

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Accepted Answer

Conditional Access. Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Answer

Identity Protection

Answer

Security defaults

Answer

Password protection

Question 2

A compliance administrator needs to generate a report showing all user activities related to accessing highly sensitive documents in SharePoint. Which Microsoft Purview solution should they use?

Accepted Answer

Audit (Standard or Premium). Audit (Standard or Premium) logs and records all user activities, including access to highly sensitive documents in SharePoint. Audit (Premium) provides deeper visibility with events like 'FileAccessed' and 'SensitivityLabelApplied', enabling compliance administrators to generate detailed reports on who accessed sensitive content and when.

Answer

eDiscovery

Answer

Data Loss Prevention

Answer

Communication Compliance

Question 3

Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?

Accepted Answer

Add a condition to exclude accounts that are known admin accounts or service accounts.. Known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.

Answer

Change the rule to alert on every admin consent grant event regardless of account creation.

Answer

Remove the join with SigninLogs and only use AuditLogs.

Answer

Increase the time window from 10 minutes to 30 minutes.

Question 4

Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?

Accepted Answer

A sensitivity label with auto-labeling for sensitive information types. Sensitivity labels with auto-labeling can automatically detect sensitive information types (such as credit card numbers) in emails and apply a label that enforces encryption. This meets the requirement to both classify and protect the data in transit.

Answer

A trainable classifier for credit card numbers

Answer

A retention label for credit card information

Answer

A data loss prevention (DLP) policy

Question 5

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Risk-based conditional access policies. Risk-based conditional access policies (B) are a core capability of Microsoft Entra ID Protection, allowing organizations to automatically enforce access controls based on detected risk levels from user and sign-in activities. Reports on risky users and sign-ins (D) provide the foundational telemetry that Entra ID Protection uses to identify and investigate potential identity compromises, making both integral to the service.

Answer

Passwordless authentication

Answer

Just-in-time privileged access

Answer

Conditional access policies for device compliance

Question 6

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

Accepted Answer

The email is blocked and the user receives a notification.. The DLP policy in the exhibit has a condition that detects credit card numbers and an action set to 'BlockMessage' with 'NotifyUser' enabled. Since the policy is configured for Exchange (email) and the action blocks the message, the email is blocked and the user receives a notification. The 'TeamsChatAndChannel' property being false is irrelevant because the policy is applied to Exchange, not Teams.

Answer

The email is delivered normally because TeamsChatAndChannel is false.

Answer

The email is delivered but an alert is generated.

Answer

The email is encrypted before delivery.

Question 7

A company has a Microsoft Entra ID tenant with thousands of users. They need to ensure that only users with a 'Manager' attribute populated can access a sensitive app. Which approach should they use?

Accepted Answer

Create a dynamic group rule that includes users with a non-empty Manager attribute, then target the group in a Conditional Access policy. A dynamic group rule can evaluate the 'Manager' attribute and include only users where it is populated. This group can then be assigned to a Conditional Access policy that requires the group membership for access to the sensitive app, ensuring only users with a manager can authenticate.

Answer

Use HR-driven provisioning to populate an on-premises attribute and sync it

Answer

Create an access package in Entitlement Management that requires manager approval

Answer

Create an Administrative Unit for users with managers and assign the app to that unit

Question 8

Which TWO of the following are Microsoft Purview solutions that help protect sensitive data?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is a Microsoft Purview solution that helps protect sensitive data by identifying, monitoring, and automatically enforcing policies to prevent accidental or unauthorized sharing of sensitive information such as credit card numbers, social security numbers, or health records across services like Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are another Purview solution that protect sensitive data by allowing administrators to classify and apply protection (encryption, visual markings) to documents and emails, and enforce controls like 'Do Not Forward' or 'Encrypt-Only' based on the label's configuration.

Answer

Communication Compliance

Answer

eDiscovery

Answer

Insider Risk Management

Question 9

Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?

Accepted Answer

Sign-ins with medium or high risk from outside the US. The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.

Answer

Sign-ins with high sign-in risk from any location

Answer

Sign-ins with medium or high risk from the US

Answer

Sign-ins from users with high user risk outside the US

Question 10

An organization wants to allow users to classify documents as 'Public', 'Internal', 'Confidential', or 'Highly Confidential' with different levels of protection. Which Microsoft Purview solution should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify and protect documents and emails by applying labels such as 'Public', 'Internal', 'Confidential', or 'Highly Confidential'. These labels can enforce encryption, visual markings (headers/footers/watermarks), and access restrictions based on the classification level, directly meeting the requirement for different levels of protection.

Answer

Data Loss Prevention (DLP)

Answer

Communication compliance

Answer

Retention policies

Question 11

Which THREE are features of Microsoft Purview Data Lifecycle Management (formerly Records Management)? (Choose three.)

Accepted Answer

Retention policies. Retention policies are a core feature of Microsoft Purview Data Lifecycle Management because they allow administrators to apply retention settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account) to automatically retain or delete content based on a defined schedule. This ensures that organizational data is kept for the required period and then removed, supporting compliance and governance requirements without manual intervention.

Answer

Data loss prevention

Answer

Sensitivity labels

Question 12

Which THREE actions can be performed by Microsoft Purview Data Loss Prevention (DLP) policies?

Accepted Answer

Send notification to users. Microsoft Purview DLP policies can send email notifications to users when a policy match occurs, alerting them to potential policy violations and providing guidance on proper data handling. This is a core end-user notification feature that helps educate users and reduce accidental data leaks.

Answer

Create audit reports of policy matches

Answer

Automatically delete files containing sensitive data

Question 13

Your company wants to use Microsoft Entra ID to provide single sign-on (SSO) to a SaaS application that supports SAML 2.0. What should you configure in Microsoft Entra ID?

Accepted Answer

Add the application from the Microsoft Entra ID Gallery in Enterprise applications. Adding the SaaS application from the Microsoft Entra ID Gallery in Enterprise applications is the standard method to configure SAML 2.0-based single sign-on (SSO). The gallery provides pre-integrated templates that include the necessary SAML endpoints, certificates, and attribute mappings, enabling seamless federation between Entra ID and the external application.

Answer

Enable Microsoft Entra ID Domain Services

Answer

Configure Microsoft Entra ID Governance

Answer

Register the application in App registrations

Question 14

Your company wants to use Microsoft Defender for Identity to detect security threats from on-premises Active Directory. What is a prerequisite for deploying Defender for Identity?

Accepted Answer

Install a sensor on a domain controller. Microsoft Defender for Identity requires a sensor installed on a domain controller to capture and analyze on-premises Active Directory traffic, including authentication events and Kerberos requests. Without this sensor, Defender for Identity cannot monitor AD activities or detect threats like pass-the-hash or Golden Ticket attacks.

Answer

Obtain Microsoft 365 E3 licenses

Answer

Install a sensor on each user's workstation

Answer

Configure Azure AD Connect

Question 15

The exhibit shows a Conditional Access policy named 'Block Legacy Auth'. The admin notices that the policy is not blocking legacy authentication as intended. Based on the output, what is the most likely reason?

Accepted Answer

The policy does not have any client app types configured to block.. The policy is not blocking legacy authentication because it lacks configured client app types. Conditional Access policies require explicit selection of client apps (e.g., Exchange ActiveSync, other clients) to target legacy authentication protocols like POP3, IMAP, and SMTP. Without this configuration, the policy has no conditions to enforce, so it cannot block any authentication attempts.

Answer

The policy name is incorrect.

Answer

The policy is assigned to no users.

Answer

The policy is disabled.

Question 16

Refer to the exhibit. A Microsoft Graph PowerShell script is shown. What is the purpose of this script?

Accepted Answer

Register a phone authentication method for users.. The script uses the `New-MgUserAuthenticationPhoneMethod` cmdlet to register a phone number as an authentication method for a user in Microsoft Entra ID. This cmdlet specifically creates a phone authentication method, which can be used for multifactor authentication or self-service password reset, but its direct purpose is to register the phone method itself.

Answer

Configure self-service password reset settings.

Answer

Reset passwords for all users named John.

Answer

Enable multifactor authentication for the users.

Question 17

Your organization has multiple on-premises directories and wants to synchronize them to Microsoft Entra ID. However, you must avoid duplicate user objects. Which feature should you configure?

Accepted Answer

Source anchor attribute. The source anchor attribute (often the objectGUID in on-premises directories) is used during synchronization to uniquely identify each object and prevent duplicates. By mapping each on-premises object to a single, immutable source anchor, Microsoft Entra Connect ensures that even if multiple directories contain the same user, only one corresponding object is created in Entra ID.

Answer

Password Hash Sync

Answer

Pass-through Authentication

Answer

Active Directory Federation Services

Question 18

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

Accepted Answer

Microsoft Purview eDiscovery (Standard). Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Standard)

Question 19

Which TWO Microsoft Purview features can be used to classify and label sensitive data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (A) are correct because they allow organizations to automatically apply sensitivity labels to data based on conditions such as sensitive information types or pattern matching, enabling classification and labeling without manual user intervention. Sensitivity labels (D) are correct because they are the core mechanism in Microsoft Purview for classifying and protecting sensitive data by applying persistent labels that can enforce encryption, access restrictions, and visual markings across Microsoft 365 services.

Answer

Data Loss Prevention policies

Answer

Retention policies

Answer

Audit policies

Question 20

You are viewing an application registration in Microsoft Entra ID. What can you conclude about this app?

Accepted Answer

The app is a single-tenant application that is enabled but has no app roles defined. The application registration shows 'App roles' with a value of 0, which means no app roles are defined. The 'Supported account types' setting indicates 'Accounts in this organizational directory only', confirming it is a single-tenant application. The 'Enabled for users to sign-in?' toggle is set to 'Yes', so the app is enabled and can be used.

Answer

The app is disabled and cannot be used

Answer

The app has custom roles for role-based access

Answer

The app is multi-tenant and can be used by other tenants