SC-900 Practice Exam 4 — 20 Questions

Question 1

Your company, Wingtip Toys, uses Microsoft Entra ID with a Premium P1 license. You have a third-party SaaS application that supports Security Assertion Markup Language (SAML) 2.0. You need to enable single sign-on (SSO) for users to access this application. The app requires attributes like department and employee ID in the SAML token. You also need to ensure that only users from a specific security group can access the app. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the app from the gallery as a SAML application, configure claims mapping to include department and employee ID, and assign the app to the security group.. With Microsoft Entra ID Premium P1, you can add the SaaS application from the gallery as a SAML application, configure custom claims to include department and employee ID in the SAML token, and assign the application to the security group. OpenID Connect is not SAML SSO. Password-based SSO cannot provide SAML attributes. Application Proxy is used for on-premises applications, not SaaS apps.

Answer

Register the app using OpenID Connect and assign users to the app.

Answer

Add the app from the gallery using password-based SSO and configure group assignment.

Answer

Use Microsoft Entra Application Proxy to publish the app and configure pre-authentication.

Question 2

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

Accepted Answer

Create an automation rule that triggers a playbook for high-severity ransomware incidents. Microsoft Sentinel automation rules allow you to define automated responses triggered when incidents are created or updated. By configuring an automation rule with a condition that checks for 'AlertSeverity' equal to 'High' and 'Ransomware' as the related alert, you can invoke a playbook to automatically respond to high-severity ransomware incidents, such as isolating affected machines or blocking indicators of compromise.

Answer

Create an analytics rule for ransomware

Answer

Create a hunting query for ransomware

Answer

Create a workbook to display ransomware alerts

Question 3

A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?

Accepted Answer

Information Barriers and Data Loss Prevention. Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.

Answer

Communication Compliance and Insider Risk Management

Answer

Information Barriers and Communication Compliance

Answer

Data Lifecycle Management and Data Loss Prevention

Question 4

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified extended detection and response platform that natively integrates signals from Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Endpoint (endpoint detection and response), and Microsoft Defender for Identity (on-premises identity threat detection). These three components share telemetry and automate incident correlation across domains, which is the core purpose of Defender XDR.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 5

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

Accepted Answer

An automation rule. Automation rules in Microsoft Sentinel can be configured to trigger automated responses when an incident is created, such as running a playbook (a Logic App) that opens a ticket in ServiceNow and sends an email notification. Option B is wrong because workbooks are for visualization and reporting, not automation. Option C is wrong because analytics rules generate alerts/incidents based on data queries, but they do not directly perform response actions; instead, automation rules handle the response. Option D is wrong because watchlists are collections of data for correlation and enrichment, not for automated response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 6

An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?

Accepted Answer

Zero Trust. Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.

Answer

Perimeter-based security

Answer

Defense in depth

Answer

Shared responsibility

Question 7

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Accepted Answer

Access reviews. Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Answer

Conditional Access policies

Answer

Self-service password reset (SSPR) with writeback

Question 8

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

Classify and label sensitive data. Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Answer

Block external sharing of files

Answer

Detect malware in email attachments

Answer

Monitor user activities in real-time

Question 9

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Accepted Answer

Create a retention label with a retention period of 7 years. A retention label with a 7-year retention period allows you to apply specific retention and deletion rules to individual documents, such as financial records, rather than to an entire site. This granularity is necessary when only a subset of content within a SharePoint site must be retained for compliance.

Answer

Create a data loss prevention policy

Answer

Create a retention policy for the entire SharePoint site

Question 10

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy configuration for a compliance team. What is the effect of this policy?

Accepted Answer

The policy blocks access but allows users to override with a justification. The policy includes a BlockAccess action with behavior set to BlockWithOverride, meaning the action is blocked by default but the user can override with a business justification. Additionally, the NotifyUser action sends a custom notification to the user. This matches Option A. Option B is incorrect because there is no encryption action configured. Option C is incorrect because the policy does block access (with override), not just send a notification. Option D is incorrect because the policy allows user override, so it does not automatically block without override.

Answer

The policy automatically applies encryption to the content

Answer

The policy sends a notification but does not block access

Answer

The policy automatically blocks access without user override

Question 11

A user reports that they cannot access a critical application, receiving an error that their session has expired. The sign-in logs show the user was prompted for multifactor authentication (MFA) multiple times during the same session. What should an administrator review to reduce these interruptions?

Accepted Answer

Microsoft Entra Conditional Access session controls. Session controls in Conditional Access policies can be configured to reduce repeated MFA prompts within the same session, such as by adjusting the sign-in frequency or persistent browser session settings. Option A is wrong because tenant-wide MFA settings enforce MFA globally but do not control session-specific behavior. Option C is wrong because Identity Protection focuses on risk-based policies, not directly on session lifetime. Option D is wrong because Privileged Identity Management manages role activation and assignment, not session controls.

Answer

Microsoft Entra tenant-wide MFA settings

Answer

Microsoft Entra Identity Protection policies

Answer

Microsoft Entra Privileged Identity Management settings

Question 12

Match each security control type to its example.

Accepted Answer

Preventive: Firewall rules blocking unauthorized traffic. Security control types categorize how controls operate: preventive controls block incidents, detective controls identify them, and corrective controls fix issues. Common examples include firewall rules (preventive), IDS (detective), and backup/restore (corrective).

Answer

Preventive: Intrusion detection system monitoring network traffic

Answer

Detective: Backup and restore procedures

Answer

Corrective: Firewall rules blocking unauthorized traffic

Question 13

Match each Azure security service to its purpose.

Accepted Answer

Microsoft Defender for Cloud: A unified infrastructure security management system that strengthens security posture and provides advanced threat protection.. Common confusions involve mixing up the purposes of security management (Defender for Cloud), SIEM/SOAR (Sentinel), and secret management (Key Vault).

Answer

Microsoft Defender for Cloud: A cloud-native SIEM and SOAR solution.

Answer

Azure Sentinel: A tool for securely storing and managing secrets, keys, and certificates.

Answer

Azure Key Vault: A unified infrastructure security management system that strengthens security posture.

Question 14

A multinational organization uses Microsoft 365 and must demonstrate compliance with both GDPR and ISO 27001. The compliance team needs a centralized tool to assess their current compliance posture against these frameworks, receive prioritized improvement actions, and track the implementation of those actions over time. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a centralized dashboard that assesses an organization's compliance posture against frameworks like GDPR and ISO 27001. It offers prioritized improvement actions based on built-in assessments and tracks the implementation of those actions over time, directly meeting the requirements for a unified compliance management tool.

Answer

Data Lifecycle Management

Answer

Audit

Answer

eDiscovery

Question 15

You are reviewing a Microsoft Sentinel KQL query. What is the primary purpose of this query?

```kql
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName == "Microsoft Teams"
| summarize TotalAttempts = count(), FailedAttempts = countif(ResultType != 0) by UserPrincipalName
| where TotalAttempts > 10 and FailedAttempts > 5
| project UserPrincipalName, TotalAttempts, FailedAttempts
```

Accepted Answer

Identify users with high logon attempts to Teams and high failed sign-ins, possibly indicating a brute-force attack. The query filters Microsoft Teams sign-ins from the last 7 days, aggregates total and failed sign-in attempts per user, and returns users with more than 10 total attempts and more than 5 failed attempts. This pattern of high volume and repeated failure is indicative of a brute-force attack, making option B correct. The query does not filter for global administrator role or conditional access policies.

Answer

Identify all users who have attempted to log on to Microsoft Teams more than 10 times in the last 7 days and who are global administrators

Answer

Identify users with high failed sign-ins and check if they have conditional access policies applied

Answer

Identify users with high successful logon attempts to Teams and correlate with failed sign-ins to detect account compromise

Question 16

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

Accepted Answer

Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.. Microsoft Purview auto-labeling for emails requires the 'applyWithOverride' action to allow users to override the label, whereas 'apply' is used for static labeling in other scenarios like SharePoint. The JSON policy uses 'apply' without override, which prevents automatic labeling on emails, as email auto-labeling policies specifically need the 'applyWithOverride' behavior to function correctly.

Answer

The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

Answer

The encryption setting prevents auto-labeling on emails.

Answer

The label is not published to users.

Question 17

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

Accepted Answer

A conditional access policy is blocking access to that specific app.. The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Answer

The user's account is disabled.

Answer

The tenant is blocked for all sign-ins.

Answer

The user's password expired.

Question 18

A user downloads a software update from a company's internal website. The update file is hashed, and the hash value is published on a separate secure page. After downloading, the user computes the hash of the downloaded file and compares it to the published hash. The two values match. Which security concept is primarily demonstrated by this comparison?

Accepted Answer

Integrity. Hashing is a one-way cryptographic function that produces a fixed-size digest from input data. By comparing the computed hash of the downloaded file to the published hash, the user verifies that the file has not been altered during transit or storage. This directly demonstrates the security concept of integrity, which ensures data has not been tampered with or corrupted.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 19

Which TWO Microsoft Purview solutions help organizations respond to data subject requests under GDPR?

Accepted Answer

eDiscovery. eDiscovery (A) is correct because it enables organizations to search for and export personal data across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject access and export requests under GDPR Article 15. Data Lifecycle Management (C) is correct because it allows organizations to retain personal data for the minimum necessary period and permanently delete it when no longer needed, supporting the right to erasure under GDPR Article 17.

Answer

Information barriers

Answer

Data Loss Prevention (DLP)

Answer

Communication compliance

Question 20

Your organization uses Microsoft Entra ID to manage user identities. A new employee named John joins the company and needs access to Microsoft 365 apps. You want to ensure John's identity is verified using a phone call. Which authentication method should you configure?

Accepted Answer

Phone call (voice call). The question explicitly requires verification using a phone call. The Phone call (voice call) authentication method in Microsoft Entra ID delivers an automated voice call to the user's registered phone number, prompting them to press a key to confirm their identity. This directly matches the requirement, making D the correct choice.

Answer

Time-based one-time password (TOTP)

Answer

Email one-time passcode

Answer

Text message (SMS)

Answer

FIDO2 security key