SC-900 Practice Exam 4 — 20 Questions

Question 1

Match each Microsoft Defender product to its focus area.

Question 2

Match each Microsoft security feature to its primary purpose.

Question 3

Match each authentication method to its description.

Question 4

Match each Azure security service to its purpose.

Question 5

A security operations team uses multiple Microsoft security products, including Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID Protection. They want to aggregate alerts from these sources into a single dashboard, correlate them to create incidents, and use automated playbooks to respond to threats. The team also wants to query historical security data for threat hunting. Which Microsoft solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests alerts from multiple sources, including Microsoft Defender for Endpoint, Defender for Office 365, and Entra ID Protection, into a single dashboard. It correlates these alerts into incidents using analytics rules and supports automated playbooks via Azure Logic Apps. Additionally, Sentinel provides a Kusto Query Language (KQL)-based workspace for querying historical security data, enabling threat hunting.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 6

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Question 7

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Question 8

Order the steps to deploy Microsoft Intune for mobile device management.

Question 9

Sequence the steps to enable Microsoft Defender for Cloud Apps for an organization.

Question 10

Order the steps to respond to a data breach using Microsoft 365 Defender incident response.

Question 11

Arrange the steps to configure Azure AD Privileged Identity Management (PIM) for a role in the correct order.

Question 12

Order the steps to create a conditional access policy in Azure AD.

Question 13

Sequence the steps to configure a retention policy in Microsoft Purview compliance portal.

Question 14

A user receives an encrypted email from their bank. They use their private key to decrypt the message. After reading it, they verify that the message content has not been altered during transit. Which security principle is primarily demonstrated by the verification that the content was not altered?

Accepted Answer

Integrity. The verification that the message content has not been altered during transit directly demonstrates the principle of integrity. Integrity ensures that data remains unchanged from its source to its destination, typically enforced through cryptographic hashing or digital signatures. In this scenario, the user's ability to confirm that the email content was not tampered with relies on a hash or signature verification mechanism, which is the core function of integrity protection.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 15

A company implements a security model where no user or device is automatically trusted, even if they are inside the corporate network. Every access request must be authenticated, authorized, and encrypted before granting access, regardless of the request origin. This model is known as:

Accepted Answer

Zero Trust. Option C is correct because Zero Trust is a security model that explicitly assumes no implicit trust based on network location. Every access request must be authenticated, authorized, and encrypted, regardless of whether it originates from inside or outside the corporate network. This aligns with the core Zero Trust principle of 'never trust, always verify'.

Answer

Defense in depth

Answer

Perimeter security

Answer

Least privilege

Question 16

A company is implementing a new security policy that requires every user to have only the minimum permissions necessary to perform their job duties. Which security principle does this policy align with?

Accepted Answer

Principle of least privilege. The policy requiring every user to have only the minimum permissions necessary to perform their job duties directly aligns with the Principle of Least Privilege. This principle dictates that users, applications, and systems should be granted the minimal level of access rights needed to complete their tasks, reducing the attack surface and limiting potential damage from compromised accounts. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) roles and Azure AD roles, where administrators assign specific permissions rather than broad administrative roles.

Answer

Defense in depth

Answer

Zero Trust

Answer

Separation of duties

Question 17

A company is implementing security controls to protect data during transmission between their on-premises database and a cloud storage service. They decide to use TLS encryption. Which security goal is primarily addressed by ensuring that data is not altered during transit?

Accepted Answer

Integrity. TLS encryption provides data integrity through message authentication codes (MACs) that detect any unauthorized modification during transit. The question specifically asks about ensuring data is not altered, which is the definition of integrity, not confidentiality or availability.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 18

A company maintains an on-premises Active Directory environment with over 10,000 domain-joined computers. The security team is concerned about advanced attacks that use stolen credentials to move laterally, such as pass-the-hash attacks or DCSync attacks targeting domain controllers. They need a solution that monitors on-premises Active Directory traffic and event logs to detect these identity-based threats and provides alerts for investigation. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and event logs to detect advanced identity-based threats like pass-the-hash, pass-the-ticket, and DCSync attacks. It uses behavioral analytics and machine learning to identify suspicious activities, such as anomalous Kerberos ticket requests or replication attempts, and provides real-time alerts for investigation.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 19

A company is migrating its on-premises applications to Azure. The CIO states that the company is fully responsible for managing the security of its own applications and data, while Microsoft is responsible for the security of the underlying physical infrastructure, such as hardware and data centers. This division of security responsibilities is an example of which concept?

Accepted Answer

Shared responsibility model. The scenario directly describes the shared responsibility model, which delineates security obligations between the cloud provider and the customer. Microsoft secures the physical infrastructure (hardware, data centers, networking), while the customer is responsible for securing their own applications, data, and identity management. This division is a foundational concept in cloud computing, explicitly defined in Microsoft's documentation for Azure.

Answer

Defense in depth

Answer

Zero Trust

Answer

Least privilege

Question 20

A company is migrating its on-premises workloads to Azure. The CISO wants to understand the division of security responsibilities between Microsoft and the customer across cloud service models. For which cloud service model does the customer have the most security responsibility?

Accepted Answer

Infrastructure as a Service (IaaS). In the Infrastructure as a Service (IaaS) model, the customer is responsible for securing the operating system, applications, data, and network configurations, while Microsoft only secures the physical datacenter, host servers, and hypervisor. This gives the customer the most security responsibility compared to PaaS or SaaS, where Microsoft manages more of the stack.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

On-premises