SC-900 Practice Test 21 — 15 Questions

Question 1

A financial services company is required by regulation to prevent sensitive customer financial information from being shared externally via email. The compliance team wants to automatically scan all outgoing emails for patterns that match credit card numbers or account numbers. If a match is found, the email should be blocked and the sender should receive a policy tip. Which Microsoft Purview solution should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive information—such as credit card numbers and account numbers—in outgoing emails. DLP policies can scan email content and attachments for predefined sensitive information types, and when a match is found, the email can be blocked and a policy tip sent to the sender, meeting the compliance requirement.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Question 2

A company stores HR documents in SharePoint Online. The compliance team wants to automatically apply a sensitivity label that encrypts the document whenever it contains a passport number. They do not want users to be able to override this classification. Which Microsoft Purview solution should they configure?

Accepted Answer

Auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels can automatically apply a sensitivity label (e.g., 'Highly Confidential') that encrypts documents when they contain sensitive data like passport numbers. This policy can be configured to enforce mandatory labeling without allowing user override, meeting the compliance team's requirement. In contrast, a DLP policy can detect and block sharing of sensitive data but does not apply encryption labels automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention policy

Answer

Communication compliance policy

Question 3

A company uses Microsoft Entra ID (Azure AD). The IT team has created a security group named 'SalesTeam' that contains all sales department users. They want to ensure that only members of this group can access the company's CRM application, which is registered as an enterprise application in Entra ID. What should the IT team configure?

Accepted Answer

Enterprise application user and group assignment. Enterprise applications in Microsoft Entra ID can be configured to require user or group assignment, which restricts access to only assigned users or groups. By assigning the 'SalesTeam' security group to the CRM enterprise application, the IT team ensures that only members of that group can authenticate and access the application. This is the standard method for controlling access to gallery or custom enterprise applications in Entra ID.

Answer

A Conditional Access policy that requires group membership

Answer

Self-service group management settings

Answer

Application registration settings

Question 4

A company wants to automatically apply a 'Confidential' sensitivity label to any document that contains a credit card number, and also encrypt the document as part of the label. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

A sensitivity label with encryption settings. Option A is correct because the requirement to encrypt the document as part of the label can only be fulfilled by a sensitivity label that has encryption (Azure Rights Management) configured in its protection settings. Option C is correct because automatically applying that label to any document containing a credit card number requires an auto-labeling policy (client-side or service-side) that uses a sensitive information type such as Credit Card Number to trigger the label. Option B is incorrect because a DLP policy detects and can block or warn about sensitive content, but it does not apply sensitivity labels or encrypt documents. Option D is incorrect because the data classification dashboard is only a reporting/monitoring view of classified content and performs no labeling or encryption.

Answer

A DLP policy that detects sensitive info

Answer

A data classification dashboard

Question 5

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Federation with AD FS

Question 6

Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?

Accepted Answer

An auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This allows the 'Confidential' label to be applied without user intervention, meeting the requirement.

Answer

A sensitivity label

Answer

A data loss prevention (DLP) policy

Answer

A retention label policy

Question 7

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

Accepted Answer

File entities. The KQL query filters for evidence related to alert-5678 by specifying a hash value (SHA256) of a file. In Microsoft 365 Defender, file entities are uniquely identified by their hash values, such as SHA256, SHA1, or MD5. The query uses the `where` clause to match the specific file hash, confirming that the filtered entities are file entities.

Answer

Registry entities

Answer

Process entities

Answer

Network entities

Question 8

A financial services company needs to comply with GDPR and requires that personal data be automatically classified and protected when stored in Microsoft SharePoint and OneDrive. They also need to retain certain records for a minimum of 7 years. Which combination of Microsoft Purview capabilities should they use?

Accepted Answer

Sensitivity labels and retention labels. Sensitivity labels classify and protect personal data (e.g., encrypt, apply markings), while retention labels enforce the required 7-year retention period. Option A is incorrect because DLP policies detect and prevent data loss but do not enforce retention. Option C is incorrect because DLP policies do not classify data. Option D is incorrect because eDiscovery is for searching and exporting data, not for classification or retention.

Answer

Sensitivity labels and data loss prevention (DLP) policies

Answer

Data loss prevention (DLP) policies and retention labels

Answer

eDiscovery and sensitivity labels

Question 9

A security administrator receives an alert from Microsoft Sentinel about a possible brute-force attack against a virtual machine. The administrator wants to automatically block the attacker's IP address for 24 hours using a playbook. Which automation trigger should the playbook use?

Accepted Answer

Incident trigger. An incident trigger allows the playbook to run automatically when a new incident is created in Microsoft Sentinel. In this scenario, the alert about the brute-force attack generates an incident, and the playbook can then block the attacker's IP address for 24 hours. Option B (Alert trigger) runs on alert generation, but the administrator wants to respond to the incident for a coordinated response. Option C (Scheduled trigger) runs on a timer and is not event-driven. Option D (Action trigger) is not a valid trigger type in Microsoft Sentinel.

Answer

Alert trigger

Answer

Scheduled trigger

Answer

Action trigger

Question 10

A company wants to monitor Microsoft Teams messages and corporate emails for policy violations related to potential harassment and inappropriate behavior. They need a solution that allows them to define policies with conditions (e.g., keywords, patterns), automatically flag suspicious conversations, and optionally send notifications to the sender or escalate to a reviewer. Additionally, they need the ability to train employees when a minor violation is detected. Which Microsoft Purview solution should they use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and corporate emails by scanning for keywords, patterns, and other conditions. It can automatically flag suspicious conversations, send notifications to the sender, escalate to a reviewer, and even train employees on minor violations through its built-in remediation workflows.

Answer

Data Loss Prevention (DLP)

Answer

Information Protection

Answer

Audit

Question 11

A company uses Microsoft Entra ID and wants to provide external business partners with access to a specific internal application. The partners already use Microsoft Entra ID in their own organization. The company wants the partners to use their existing corporate credentials to sign in, without creating new user accounts in the company's tenant. The company also wants to manage the access lifecycle, including automatically removing access after a project ends. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows external users from partner organizations who already have their own Microsoft Entra ID accounts to sign in using their existing corporate credentials, without requiring new user accounts in the company's tenant. It also supports access lifecycle management through features like entitlement management and access reviews, enabling automatic removal of access when a project ends.

Answer

Microsoft Entra B2C

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 12

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to emails containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to content that matches specific conditions, such as the presence of credit card numbers (a sensitive information type). This policy scans emails and files for sensitive data and applies the appropriate label without user intervention. Retention and DLP policies serve different purposes, and sensitivity label policies publish labels but do not automatically apply them based on content inspection.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention (DLP) policy

Question 13

An organization wants to ensure that only managed and compliant devices can access corporate email in Exchange Online. Which Microsoft Entra ID Conditional Access policy setting should they use?

Accepted Answer

Require device to be marked as compliant. To ensure only managed and compliant devices access corporate email in Exchange Online, the 'Require device to be marked as compliant' setting in a Conditional Access policy evaluates the device's compliance status reported by Microsoft Intune. This ensures that devices meet security policies (e.g., encryption, patch levels) before granting access, directly addressing the requirement for managed and compliant access.

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Answer

Require multi-factor authentication

Question 14

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps?

Accepted Answer

Session controls to monitor and control app access in real time. Microsoft Defender for Cloud Apps provides session controls that leverage reverse proxy architecture to monitor and control user app access in real time, enabling conditional access policies for cloud apps. Cloud discovery uses traffic logs from network appliances or Windows endpoints to identify shadow IT by analyzing app usage and risk scores.

Answer

Information protection for files in Microsoft 365

Answer

Identity governance and access reviews

Answer

Vulnerability assessment for Azure virtual machines

Question 15

A company must retain all vendor contracts for 10 years to meet regulatory requirements. After 10 years, the contracts must be permanently destroyed with no possibility of recovery. The compliance team wants to automate this lifecycle and ensure that during the retention period, the contracts cannot be edited or deleted by users. Which Microsoft Purview solution should they use?

Accepted Answer

Records Management. Records Management in Microsoft Purview is designed to declare records (regulatory or legal) that must be retained for a specific period and then disposed of in a compliant manner. It enforces immutability during the retention period—users cannot edit or delete records—and supports a disposition review or automatic permanent deletion after the retention period ends, exactly matching the requirement for 10-year retention followed by destruction with no recovery.

Answer

Data Lifecycle Management (DLM)

Answer

eDiscovery (Premium)

Answer

Sensitivity Labels