SC-900 Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

Accepted Answer

A dynamic security group based on department attribute.. The exhibit shows a rule syntax of `(user.department -eq "Sales")`, which is the expression used to dynamically add or remove members based on the department attribute. This is the defining characteristic of a dynamic security group in Microsoft Entra ID, where membership is evaluated automatically when user attributes change.

Answer

A Microsoft 365 group with dynamic membership.

Answer

A dynamic group based on user location.

Answer

A static security group with assigned members.

Question 2

Your organization wants to automatically investigate and remediate email-based threats in Microsoft 365. Which security solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct solution because it is specifically designed to protect against email-based threats such as phishing, malware, and business email compromise (BEC). It provides automated investigation and remediation capabilities through features like Automated Investigation and Response (AIR) and Threat Explorer, which can automatically analyze and remediate malicious emails, attachments, and URLs in Exchange Online.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 3

Which Microsoft Entra ID feature allows an organization to provide external partners with access to its applications while maintaining control over authentication and governance?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (including B2B collaboration) enables secure sharing of apps with external users. It allows the organization to manage identities and enforce policies like MFA for guests.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 4

A compliance officer needs to monitor internal emails for inappropriate language and potential data leaks. The officer wants to detect policy violations and allow users to report concerns. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in internal and external communications, including inappropriate language and potential data leaks. It also provides a built-in mechanism for users to report concerns, aligning directly with the compliance officer's requirements.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 5

Refer to the exhibit. You are configuring a Conditional Access policy that requires compliant device for access to Microsoft 365. The device shown in the exhibit is Azure AD joined, compliant, and managed. However, a user signing in from this device is still blocked. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires Hybrid Azure AD joined device.. The exhibit shows the device is Azure AD joined, compliant, and managed, yet the user is still blocked. This indicates the Conditional Access policy is configured to require a Hybrid Azure AD joined device, which is a stricter requirement than just being Azure AD joined. A Hybrid Azure AD joined device must be both domain-joined to on-premises Active Directory and registered with Azure AD, whereas an Azure AD joined device is only cloud-joined. Since the device in the exhibit is only Azure AD joined, it does not satisfy the Hybrid Azure AD joined condition, causing the block.

Answer

The device profile type is 'Workplace', which is not allowed.

Answer

The device is not compliant.

Answer

The device is not managed.

Question 6

Which TWO of the following are Microsoft Purview compliance solutions?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is a Microsoft Purview compliance solution that helps organizations detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers or personally identifiable information (PII), across email, SharePoint, OneDrive, and endpoints. eDiscovery is another Purview compliance solution that allows legal and compliance teams to search, hold, and export content from Microsoft 365 services for litigation or investigation purposes. Both are core capabilities within the Microsoft Purview compliance portal, distinct from identity, device management, or cloud security tools.

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud

Question 7

Refer to the exhibit. You are reviewing a Communication Compliance policy. What does this policy do when a user sends an email containing EU GDPR PII to privacy@contoso.com?

Accepted Answer

It notifies the policy owner and generates a case for investigation.. Communication Compliance policies in Microsoft 365 are designed to detect and investigate policy violations, not to enforce real-time blocking or automated deletion. When a user sends an email containing EU GDPR PII to a specified recipient like privacy@contoso.com, the policy triggers an alert, notifies the policy owner, and generates a case for investigation in the Compliance Center. This allows organizations to review and remediate potential data privacy violations without disrupting email flow.

Answer

It blocks the email from being sent.

Answer

It automatically deletes the email after 30 days.

Answer

It applies a sensitivity label to the email.

Question 8

A security analyst needs to investigate a potential ransomware attack affecting multiple endpoints. They want to centralize detection and response across devices, email, and applications. Which Microsoft solution should they use?

Accepted Answer

Microsoft 365 Defender (now Microsoft Defender XDR). Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and response across endpoints, email, identities, and applications. Microsoft Sentinel is a SIEM for broader security data. Defender for Cloud is for cloud workloads. Defender for Endpoint only covers endpoints.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud

Question 9

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

Accepted Answer

Regulatory record. Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record. Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Answer

Disposition review

Answer

Event-based retention policy

Answer

Retention label with default settings

Question 10

Match each Microsoft 365 compliance feature to its function.

Accepted Answer

eDiscovery: Search and export content from various data sources. The correct matches are: eDiscovery for searching and exporting content, Retention policies for managing retention and deletion, and Sensitivity labels for classifying and protecting data. Common confusions include mixing DLP with Sensitivity labels, and Communication Compliance with DLP.

Answer

Data Loss Prevention: Classify and protect data with encryption and visual markings

Answer

Communication Compliance: Detect and prevent accidental sharing of sensitive information

Question 11

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Accepted Answer

Security information and event management (SIEM). Correct: A (SIEM), B (UEBA), D (SOAR). C is not a Sentinel capability; it is a feature of Microsoft Intune. E is a feature of Microsoft Purview.

Answer

Mobile device management

Answer

Data loss prevention

Question 12

You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?

Accepted Answer

Requires MFA for all external users accessing any cloud app. The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.

Answer

Requires MFA for guest users only

Answer

Requires MFA for all users accessing all cloud apps

Answer

Requires MFA for external users except those with global admin role

Question 13

Refer to the exhibit. A compliance administrator runs the PowerShell commands to create a DLP policy. Users complain that they are blocked from sending emails containing credit card numbers but cannot override the block. The administrator wants to allow override with a business justification. What should they do?

Accepted Answer

Change the NotifyAllowOverride parameter to $true in the rule.. The `NotifyAllowOverride` parameter controls whether users can override a DLP rule action with a business justification. Setting it to `$true` enables the override prompt, allowing users to bypass the block when they provide a valid reason. The current policy blocks emails with credit card numbers without offering this option, so changing this parameter directly addresses the requirement.

Answer

Change the SentInfo parameter to a different sensitive info type.

Answer

Remove the SharePoint location from the policy.

Answer

Enable the DLP policy by setting the Policy's Enabled parameter to $true.

Question 14

A company uses Microsoft Entra ID and needs to regularly review membership of a group that grants access to a sensitive HR application. The identity team wants to automate quarterly reviews and automatically remove users who fail to respond or are denied by the reviewer. Which Microsoft Entra ID feature should they use?

Accepted Answer

Access Reviews. Microsoft Entra Access Reviews are specifically designed to automate periodic attestation of group memberships, including the ability to automatically remove users who do not respond or are denied by the reviewer. This feature supports quarterly recurring reviews and integrates directly with Entra ID groups to enforce access governance for sensitive applications.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 15

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that collects security data from across an organization, providing threat detection, investigation, and response. It also includes SOAR (Security Orchestration, Automation, and Response) capabilities through playbooks and automation rules, enabling automated incident response. These two features are core to Sentinel's functionality.

Answer

Identity governance and administration

Answer

Endpoint detection and response (EDR)

Answer

Data classification and labeling