SC-900 Practice Test 23 — 15 Questions

Question 1

Which TWO scenarios are appropriate uses of Microsoft Purview Audit (Standard)?

Accepted Answer

Investigating a user who accessed a sensitive file in SharePoint.. Microsoft Purview Audit (Standard) logs key events such as file access and admin activities, and retains logs for 90 days. Option A is correct because accessing a sensitive file in SharePoint generates an audit event captured by Audit (Standard). Option B is correct because searching the audit log for admin activities within the 90-day retention period is a core capability of Audit (Standard).

Answer

Generating custom reports with PowerShell for all activities.

Answer

Tracking when sensitivity labels are applied to documents.

Answer

Retaining audit logs for 2 years for compliance purposes.

Question 2

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

Accepted Answer

Emails are preserved and not deleted despite the retention policy. When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Answer

Only emails created before the hold are deleted

Answer

Emails are deleted immediately to avoid conflicting policies

Answer

Emails are deleted after 3 years as per the retention policy

Question 3

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?

Accepted Answer

Windows Security Events via Azure Monitor Agent. To capture command execution logs on Azure VMs, you need to collect Windows Security Events, specifically event ID 4688 (process creation), which includes the command line if audit policy is enabled. The Windows Security Events via Azure Monitor Agent connector in Microsoft Sentinel ingests these events from the VMs. This data source provides the necessary telemetry to detect specific command executions.

Answer

Office Activity log

Answer

Azure AD audit logs

Answer

Azure Activity log

Question 4

A company needs to ensure that employees cannot share sensitive financial reports with external parties via email. They want to automatically detect and block emails that contain the phrase 'Confidential-Financial' in the subject line or body, regardless of the recipient's domain. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block sensitive content—such as the phrase 'Confidential-Financial'—in emails, regardless of the recipient's domain. DLP policies can inspect subject lines and body text, then enforce actions like blocking delivery or notifying the user, making it ideal for preventing unauthorized external sharing of financial reports.

Answer

Information Protection (sensitivity labels)

Answer

Data Lifecycle Management (retention policies)

Answer

Audit

Question 5

A security architect is explaining the Zero Trust model to the board. The architect emphasizes that the network perimeter can no longer be considered a safe zone. Which statement best describes the modern primary security perimeter according to Zero Trust principles?

Accepted Answer

The identity of the user and device. In the Zero Trust model, the primary security perimeter is the identity of the user and device, not the network location. This is because Zero Trust assumes breach and requires explicit verification for every access request, regardless of whether it originates from inside or outside the corporate network. By treating identity as the new control plane, organizations enforce least-privilege access and continuous authentication, making the user and device identity the critical trust boundary.

Answer

The corporate network firewall and VPN

Answer

The physical on-premises data center

Answer

The endpoint antivirus and anti-malware solution

Question 6

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Accepted Answer

Device platform. Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Answer

MFA registration status

Answer

Password complexity

Answer

Login frequency

Question 7

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

Accepted Answer

To detect when a file labeled 'Highly Confidential' is shared externally. The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.

Answer

To identify all files shared externally regardless of sensitivity

Answer

To automatically block external sharing of sensitive files

Answer

To list all alerts generated by the rule

Question 8

Which TWO of the following are capabilities of Microsoft Purview Data Loss Prevention?

Accepted Answer

Block sharing of sensitive data via email.. Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent the accidental or intentional sharing of sensitive information. Option C is correct because DLP policies can block the sharing of sensitive data via email by inspecting content in transit and applying actions such as blocking the message. Option E is correct because DLP can display policy tips to users in real time, warning them before they share sensitive data and allowing them to override the block with justification.

Answer

Define retention periods for documents.

Answer

Search for content in Exchange Online mailboxes.

Answer

Automatically apply sensitivity labels to content.

Question 9

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have multiple on-premises applications that use LDAP for authentication. They want to enable single sign-on (SSO) to these applications from the cloud without modifying the applications. Which approach should they use?

Accepted Answer

Microsoft Entra Domain Services. Microsoft Entra Domain Services provides managed domain services such as LDAP, Kerberos, and NTLM authentication without requiring you to deploy and manage domain controllers. Since the on-premises applications use LDAP for authentication and cannot be modified, Entra Domain Services can be used to lift and shift these applications into Azure while enabling SSO from the cloud, as it presents a compatible LDAP interface that the applications can continue to use.

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Pass-through authentication

Answer

Password hash synchronization with Seamless SSO

Question 10

Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?

Accepted Answer

Azure Network Security Groups (NSGs). Azure Network Security Groups (NSGs) are the correct service for implementing microsegmentation because they allow you to create granular, stateful filtering rules based on source/destination IP addresses, ports, and protocols at the subnet or individual virtual machine (NIC) level. This enables east-west traffic segmentation between workloads within the same virtual network, which is a core principle of Zero Trust network architecture.

Answer

Azure Firewall

Answer

Azure App Service

Answer

Azure Front Door

Question 11

A company uses Microsoft Entra ID. A new IT support technician is hired and needs to be able to reset passwords for users but must not be allowed to delete user accounts or modify group memberships. Which built-in Microsoft Entra ID role should be assigned to this technician?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific permissions required to reset passwords for all users, including administrators, while explicitly excluding permissions to delete user accounts or modify group memberships. This role is designed for scenarios where a technician needs to perform password-related tasks without broader user management capabilities.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Global Administrator

Question 12

An organization uses Microsoft Sentinel for security information and event management (SIEM) and security orchestration automated response (SOAR). They want to automatically respond to a specific incident by running a playbook. What should they configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running playbooks. When an incident is created or updated, an automation rule can trigger a playbook (a collection of automated workflows based on Azure Logic Apps) to perform actions such as blocking a user or isolating a machine, directly addressing the requirement to automatically respond to a specific incident.

Answer

Workbook

Answer

Hunting query

Answer

Analytics rule

Question 13

Your organization uses Microsoft Purview to manage data sensitivity and compliance. Which TWO capabilities are provided by Microsoft Purview Information Protection?

Accepted Answer

Create and publish sensitivity labels that can be applied to documents and emails.. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Option D is correct because sensitivity labels are the core mechanism in MIP for applying protection actions (e.g., encryption, access restrictions) to documents and emails. Option E is correct because MIP includes automatic classification using built-in sensitive information types (e.g., credit card numbers) and trainable classifiers based on machine learning models.

Answer

Define retention labels to keep data for a specified period.

Answer

Detect and manage insider risk activities such as data theft by employees.

Answer

Enforce Data Loss Prevention (DLP) policies to prevent accidental sharing of sensitive data.

Question 14

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access with Named Locations. Conditional Access with Named Locations allows you to define geographic locations (e.g., countries) and then create a policy that blocks sign-ins from locations that are not approved for business operations. This is the correct feature because it directly enforces access controls based on the user's physical location at the time of authentication, using IP address ranges or country/region mapping.

Answer

Privileged Identity Management

Answer

Terms of Use

Answer

Identity Protection user risk policy

Question 15

Refer to the exhibit. You are creating a Microsoft Purview sensitivity label for HR data. The JSON shows a label configuration. What is the likely effect of setting the sensitivity value to 90?

Accepted Answer

The label will be applied with higher priority than labels with lower sensitivity values. In Microsoft Purview, sensitivity labels are assigned an integer priority value (typically 0 to 100). A higher sensitivity value indicates a higher priority. When multiple labels are available, the label with the highest sensitivity value is applied by default or takes precedence in auto-labeling and policy conflicts. Setting the value to 90 ensures this HR label is prioritized over labels with lower values, such as 75 or 50.

Answer

The label automatically encrypts the document

Answer

The label triggers auditing for 90 days

Answer

The label sets a 90-day retention period