SC-900 Practice Test 24 — 15 Questions

Question 1

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel are designed to correlate and analyze data from multiple sources, such as AWS CloudTrail and Microsoft Entra ID sign-in logs, to detect security threats. By creating a multi-source analytics rule, you can define conditions that trigger alerts when suspicious patterns emerge across these disparate log streams, enabling centralized threat detection.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting

Question 2

Which TWO are capabilities of Microsoft Intune? (Choose two.)

Accepted Answer

Mobile application management (MAM). Microsoft Intune is a cloud-based endpoint management solution that provides both Mobile Device Management (MDM) and Mobile Application Management (MAM). MDM allows administrators to enroll, configure, and secure devices (e.g., enforce PIN policies, wipe lost devices), while MAM enables management of applications and their data on both enrolled and unenrolled devices (e.g., restrict copy/paste between managed apps). These are the two core capabilities of Intune.

Answer

Identity protection

Answer

Security posture management

Answer

Data loss prevention

Question 3

A global company uses Microsoft Teams and SharePoint Online. They need to automatically detect and prevent sharing of intellectual property files containing 'Project X' with external users. What should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive. Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive can be configured to automatically detect files containing sensitive content (e.g., 'Project X') and block sharing with external users. DLP policies inspect content at rest and during sharing actions, applying rules to prevent unauthorized external access.

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Defender for Cloud Apps Session Policy

Question 4

A company wants to use Microsoft Defender for Office 365 to protect against malicious links in email. Which feature should they enable?

Accepted Answer

Safe Links. Safe Links is the correct feature because it specifically protects against malicious links in email by scanning URLs at the time of click, checking them against real-time threat intelligence, and blocking or warning users if the link is malicious. This is a core capability of Microsoft Defender for Office 365 designed to prevent phishing and malware delivery via hyperlinks.

Answer

Safe Attachments

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 5

Your organization is implementing Microsoft Purview to manage data governance. You need to classify sensitive data such as social security numbers automatically. What should you create?

Accepted Answer

Sensitive information type. Sensitive information type. Sensitive information types (SITs) are predefined or custom patterns that detect sensitive data like social security numbers automatically. Option A is incorrect because a data loss prevention (DLP) policy uses SITs to enforce actions, but it does not classify data on its own. Option B is incorrect because retention labels manage data retention and disposal, not classification. Option D is incorrect because trainable classifiers require training with sample data to identify content, whereas SITs use pattern matching out of the box.

Answer

Data loss prevention policy

Answer

Retention label

Answer

Trainable classifier

Question 6

A company uses Microsoft Defender for Cloud to secure its Azure resources. The security team wants to receive a single recommendation for all resources that are missing just-in-time (JIT) VM access. Which Microsoft Defender for Cloud feature should they use?

Accepted Answer

Security recommendations. Microsoft Defender for Cloud's security recommendations feature provides a centralized list of actionable steps to improve your security posture, including a specific recommendation to enable just-in-time (JIT) VM access on all eligible virtual machines. This recommendation aggregates all resources missing JIT configuration into a single entry, allowing the security team to remediate them collectively. The other options do not aggregate missing JIT configurations into a single recommendation.

Answer

Regulatory compliance dashboard

Answer

Inventory

Answer

Security alerts

Question 7

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to create a policy that prevents users from sharing credit card numbers via email to external recipients. The policy should only apply to users in the Finance department. Which action should you take?

Accepted Answer

Create a DLP policy, select the Finance user location, and add the credit card number condition. To apply a DLP policy to specific users, you select their group (e.g., Finance) as a location when creating the policy. This ensures only Finance users are affected. Option A is wrong because auto-labeling with retention labels does not enforce DLP rules. Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because copying a default template may not allow precise scoping to Finance users; creating a new policy from scratch with location selection is more accurate.

Answer

Create a retention label and apply auto-labeling for Finance

Answer

Create a sensitivity label and publish it to Finance users

Answer

Copy the default DLP template for financial data and modify it

Question 8

Which TWO Microsoft Entra features can be used to enforce multifactor authentication (MFA)?

Accepted Answer

Security defaults. Security defaults (B) is correct because it is a Microsoft Entra ID setting that, when enabled, automatically enforces MFA for all users, requiring them to register for MFA and use it at sign-in. Conditional Access (E) is correct because it lets administrators create policies that require MFA based on conditions such as user, group, application, location, or risk, making it the primary policy engine for enforcing MFA. Self-Service Password Reset (A) only allows users to reset or unlock their accounts and does not enforce MFA at sign-in. Identity Protection (C) detects and reports risky sign-ins and users and can feed risk signals into Conditional Access, but by itself it does not enforce MFA. Privileged Identity Management (D) manages just-in-time role activation and approvals for privileged roles, not MFA enforcement for general sign-ins.

Answer

Self-Service Password Reset

Answer

Identity Protection

Answer

Privileged Identity Management

Question 9

Your company uses Microsoft Entra ID. You need to ensure that when a user's account is compromised and used to send spam, the account is automatically blocked from signing in. Which feature should you configure?

Accepted Answer

Microsoft Entra Identity Protection with a user risk policy to block high-risk users. Microsoft Entra Identity Protection uses machine learning to detect user risk, such as when an account is compromised and used to send spam. A user risk policy can be configured to automatically block sign-ins for high-risk users, directly addressing the requirement to block the compromised account from signing in.

Answer

Microsoft Entra Conditional Access policy to block sign-ins from high-risk users

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Self-Service Password Reset

Question 10

A user reports that they cannot access a sensitive document in SharePoint Online. The administrator checks the document's permissions and sees that the user is not listed directly, but a group they belong to has been granted access. Which identity concept describes this scenario?

Accepted Answer

Group-based access control. The scenario describes group-based access control: the user is not directly granted permission, but inherits access because a security group they belong to has been granted access to the document. This is the standard mechanism in SharePoint Online and Microsoft 365 for scaling permissions management.

Answer

Role-based access control (RBAC)

Answer

Privilege escalation

Answer

Attribute-based access control (ABAC)

Question 11

Your organization uses Microsoft Purview Information Protection to classify and protect documents. You have created a sensitivity label that applies encryption to documents marked as 'Confidential'. Users are able to apply the label manually. However, you need to ensure that all documents containing personally identifiable information (PII) are automatically labeled as 'Confidential' when they are saved to SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that scans for PII sensitive info types and applies the 'Confidential' label.. Auto-labeling policies in Microsoft Purview can scan documents for sensitive info types (such as PII) and automatically apply the 'Confidential' label when they are saved to SharePoint Online. Option B is incorrect because configuring a default label for SharePoint libraries would apply to all documents, not just those containing PII, and it would not scan for specific content. Option C is incorrect because a DLP policy blocks sharing or other actions but does not apply sensitivity labels. Option D is incorrect because manual labeling does not meet the requirement for automatic labeling.

Answer

Configure a default label for SharePoint libraries so that all documents are labeled 'Confidential'.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of PII.

Answer

Train users to apply the 'Confidential' label manually when they create documents with PII.

Question 12

You run the following PowerShell command in your Microsoft Entra ID environment:

Get-AzureADPolicy -Type TokenLifetimePolicy

What is the command retrieving?

Accepted Answer

Token lifetime policies. The cmdlet Get-AzureADPolicy with the -Type parameter set to TokenLifetimePolicy retrieves the token lifetime policies configured in Microsoft Entra ID (formerly Azure AD). These policies control how long access tokens, ID tokens, and refresh tokens remain valid before requiring re-authentication. This is part of the legacy Microsoft Entra ID PowerShell module used to manage organizational token configuration.

Answer

Conditional access policies

Answer

Named locations

Answer

Role assignments

Question 13

Which TWO Microsoft Entra ID features can be used to protect against credential theft? (Choose two.)

Accepted Answer

Passwordless authentication. Passwordless authentication (A) is correct because it removes the password from the sign-in process entirely, using methods such as Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app, so there is no password credential for attackers to phish, replay, or steal. Conditional Access policies that require MFA (E) are correct because they enforce a second verification factor at sign-in, so even if a password is compromised through phishing or breach, the stolen credential alone is insufficient to authenticate. SSPR (B) only lets users reset forgotten passwords and does not itself prevent credential theft. Microsoft Entra ID Domain Services (C) provides managed domain services such as LDAP and domain join for legacy workloads, and Microsoft Entra ID Connect (D) synchronizes on-premises identities to Entra ID; neither feature directly protects credentials from theft.

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Connect

Question 14

A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident investigation. D is correct because Microsoft Sentinel's incident investigation feature provides a visual, interactive graph that maps relationships between entities (e.g., accounts, devices, IP addresses) involved in an incident. This allows the analyst to quickly see the full scope of a ransomware attack by exploring all affected resources and their connections, rather than relying on static reports or automated responses.

Answer

Analytics rules

Answer

Workbooks

Answer

Playbooks

Question 15

A law firm needs to retain client documents for 10 years after case closure, but automatically delete drafts after 30 days. Which two Microsoft Purview solutions should be combined?

Accepted Answer

Microsoft Purview Records Management and Data Lifecycle Management. Microsoft Purview Records Management enables the firm to mark client documents as records and enforce a 10-year retention period after case closure, while Data Lifecycle Management allows automatic deletion of drafts after 30 days. Together, they provide both long-term retention for compliance and short-term cleanup for non-record content, aligning with the firm's specific requirements.

Answer

Microsoft Purview Data Loss Prevention and eDiscovery

Answer

Microsoft Purview eDiscovery and Audit

Answer

Microsoft Purview Audit and Data Loss Prevention