SC-900 Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). A user reports receiving a suspicious email with a link. The email was not blocked by Exchange Online Protection (EOP). Which feature should you use to investigate the link's reputation in real time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Safe Links policy. Safe Links is the correct feature because it provides real-time URL reputation checking at the time of click. When a user clicks a link in an email, Safe Links checks the link against Microsoft's threat intelligence to determine if it is malicious, even if the email itself was not blocked by EOP. This allows investigation of the suspicious link's reputation after delivery.

Answer

Exchange Online Protection (EOP) filtering

Answer

Anti-phish policy

Answer

Safe Attachments policy

Question 2

Your organization uses Microsoft Entra ID. You need to ensure that guest users can access resources without requiring invitation redemption. Which feature should you enable?

Accepted Answer

B2B Direct Connect. B2B Direct Connect allows guest users to access resources in your Microsoft Entra ID tenant without requiring them to redeem an invitation or accept a consent prompt. This feature establishes a mutual, two-way trust relationship between your tenant and an external Microsoft Entra ID tenant, enabling seamless resource access for users who already exist in the partner's directory.

Answer

Application Proxy

Answer

B2B Collaboration

Answer

Privileged Identity Management

Question 3

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove malicious attachments from emails before they reach user inboxes. Which protection feature should be configured?

Accepted Answer

Safe Attachments policies. Safe Attachments policies in Microsoft Defender for Office 365 are specifically designed to detect and neutralize malicious attachments in email messages before they reach user inboxes. This feature uses a detonation environment to open attachments in a sandbox, analyzing their behavior for threats, and then automatically removes or replaces the attachment if it is found to be malicious.

Answer

Anti-spam policies

Answer

Anti-phishing policies

Answer

Safe Links policies

Question 4

During a security incident, a SOC analyst needs to investigate a compromised user account that accessed multiple cloud apps. Which Microsoft Defender XDR feature provides a unified view of the attack timeline across endpoints, identities, and cloud apps?

Accepted Answer

Incident response. Incident response in Microsoft Defender XDR aggregates alerts and activities from endpoints, identities, and cloud apps into a single incident view, providing a unified attack timeline. This allows the SOC analyst to see the full scope of the compromised user account's actions across all integrated workloads without switching between consoles.

Answer

Microsoft Secure Score

Answer

Advanced hunting

Answer

Action center

Question 5

An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?

Accepted Answer

A DLP policy with a rule that detects credit card numbers and blocks sharing. Microsoft Purview DLP policies are specifically designed to detect and automatically block the sharing of sensitive data, such as credit card numbers, across services like Exchange Online (email) and Microsoft Teams. By creating a DLP policy with a rule that includes a sensitive information type for credit card numbers and an action to block external sharing, the organization can enforce the required protection. Retention labels, audit policies, and sensitivity labels do not provide the real-time blocking capability needed for this scenario.

Answer

A retention label to retain credit card data

Answer

An audit policy to log credit card sharing

Answer

A sensitivity label that marks credit card data

Question 6

Your organization needs to monitor Microsoft Teams chats for inappropriate language and alert compliance officers. Which Microsoft Purview solution should you implement?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect inappropriate language, such as profanity, harassment, or sensitive content, in Microsoft Teams chats and other communication channels. It uses built-in trainable classifiers and customizable policies to automatically flag violations and alert compliance officers, enabling proactive remediation.

Answer

eDiscovery

Answer

Auditing

Answer

Information Protection

Question 7

A company deploys a sensitivity label as shown in the exhibit. The custom sensitive information type 'Custom_PII_Type' is configured to detect employee IDs. What happens when a user creates a new document in SharePoint Online that contains an employee ID?

Accepted Answer

The document is automatically labeled 'Highly Confidential' and encrypted.. The sensitivity label is configured for auto-labeling with a condition that detects the custom sensitive information type 'Custom_PII_Type'. When a user creates a document in SharePoint Online containing an employee ID, Microsoft 365 automatically applies the 'Highly Confidential' label and enforces encryption as defined in the label policy, without requiring manual user action.

Answer

The user is prompted to manually apply the label.

Answer

The document is blocked from being shared externally.

Answer

The document is deleted automatically.

Question 8

Your organization uses Microsoft Entra ID free tier. You need to synchronize user accounts from your on-premises Active Directory to the cloud. You also need to synchronize password hashes so that users can use the same password for cloud and on-premises resources. Which tool should you use?

Accepted Answer

Install Microsoft Entra Connect and enable password hash synchronization.. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory user accounts to Microsoft Entra ID (formerly Azure AD) and enabling password hash synchronization. Password hash synchronization allows users to use the same password for both on-premises and cloud resources by syncing a hash of the on-premises password to Entra ID, which is supported in the free tier of Entra ID.

Answer

Configure Microsoft Entra Domain Services to sync from on-premises.

Answer

Use Microsoft Graph API to create users and set passwords.

Answer

Deploy Active Directory Federation Services (AD FS) to enable single sign-on.

Question 9

Refer to the exhibit. An administrator runs this PowerShell command. What is the purpose of this command?

Accepted Answer

To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.. The PowerShell cmdlet `Search-UnifiedAuditLog` is used to retrieve audit records from the Microsoft 365 unified audit log. The `-StartDate` and `-EndDate` parameters define the time range (last 90 days), and the `-RecordType` parameter filters for SharePoint audit events. The `-Operations` parameter with `FileAccessed` and `FileModified` specifies that only file access and modification events should be returned, making this command's purpose to retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.

Answer

To set a retention policy for the HR site.

Answer

To apply a retention label to all files in the HR site.

Answer

To delete all files in the HR site that were accessed in the last 90 days.

Question 10

A company wants to classify and label documents in SharePoint automatically based on sensitive content like social security numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically detect sensitive content such as social security numbers in SharePoint documents and apply the appropriate sensitivity label. This enables consistent classification and protection without manual user intervention, directly meeting the company's requirement.

Answer

eDiscovery

Answer

Audit log

Answer

Data loss prevention policy

Question 11

A company runs Azure SQL databases containing customer transaction data. The security team needs to detect and alert on suspicious database access patterns, such as SQL injection attempts or access from unusual locations. Which Microsoft security solution should they enable?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides advanced threat protection for Azure SQL databases, including anomaly detection for suspicious activities like SQL injection and unusual access patterns. It uses machine learning to baseline normal database behavior and triggers alerts when deviations occur, such as access from atypical geographic locations or malicious query patterns.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 12

Refer to the exhibit. A Microsoft Purview Data Loss Prevention (DLP) policy is configured. What does this policy do?

Accepted Answer

It generates an alert if more than 10 emails with the Confidential label are sent to an external recipient.. The DLP policy rule shown in the exhibit specifies an action to 'Send an alert' when the condition 'Number of emails sent to external recipients with label Confidential exceeds 10' is met. This means the policy generates an alert (e.g., via email or incident report) when more than 10 emails containing the Confidential label are sent to external recipients, without blocking the emails.

Answer

It blocks all emails sent to external recipients with the Confidential label.

Answer

It prevents internal users from sending Confidential emails to each other.

Answer

It automatically applies the Confidential label to emails sent to external recipients.

Question 13

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender for Endpoint. The query returns no results. What is the most likely cause?

Accepted Answer

The device is not onboarded to Defender for Endpoint. The KQL query in Microsoft Defender for Endpoint returns no results because the device is not onboarded. Defender for Endpoint can only report on devices that have been enrolled and are actively sending telemetry. If a device is not onboarded, no data exists for it in the security portal, so any query targeting that device will return empty results.

Answer

The device has a risk score of zero

Answer

The device runs macOS

Answer

The analyst lacks permissions to view the device

Question 14

You are designing an identity solution for a new company that will use Microsoft Entra ID. The company wants employees to use biometrics (fingerprint) on their mobile devices to sign in without typing a password. Which Microsoft Entra feature should you implement?

Accepted Answer

Microsoft Authenticator app (passwordless). The Microsoft Authenticator app (passwordless) allows users to sign in to Microsoft Entra ID using biometrics (fingerprint, face, or PIN) on their mobile device without entering a password. This feature uses the device's built-in biometric capabilities to verify the user's identity, making it the correct choice for the described scenario.

Answer

Windows Hello for Business

Answer

SMS-based sign-in

Answer

FIDO2 security keys

Question 15

Refer to the exhibit. You are configuring an access package in Microsoft Entra Entitlement Management. Based on the policy, which users can request access to the HR App?

Accepted Answer

Any user in the organization can request access, but guests require manager approval.. The access package policy shown in the exhibit is configured with 'For users in your directory' as the scope and 'Specific connected organization' is not selected, meaning any internal user can request. The policy also has 'Approval' set to 'Manager approval' only for 'Guest users', so internal users do not require approval, while guests do. This matches the description that any user in the organization can request, but guests need manager approval.

Answer

Only administrators can assign access.

Answer

Only users in the HR department can request access.

Answer

Only guest users can request access.