SC-900 Practice Test 24 — 15 Questions

Question 1

A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Microsoft Entra Verified ID

Question 2

A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?

Accepted Answer

Conditional Access policies. Conditional Access policies allow administrators to enforce MFA based on conditions such as application sensitivity, user risk, or location. Option A (Privileged Identity Management) is incorrect because it manages just-in-time access for privileged roles, not MFA enforcement. Option C (Password Protection) is incorrect because it blocks weak passwords but does not enforce MFA. Option D (Identity Protection) is incorrect because it detects identity risks and can trigger remediation but does not directly enforce MFA.

Answer

Privileged Identity Management (PIM)

Answer

Password Protection

Answer

Identity Protection policies

Question 3

A company uses Microsoft Entra ID. A junior administrator needs to occasionally reset passwords for the IT department. The security team wants to grant this permission only for a limited time and require an approval from a senior administrator before the permission becomes active. All password reset actions must be audited. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Entra ID Privileged Identity Management (PIM). Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing the junior administrator to request a time-limited role for password reset that requires approval from a senior administrator. PIM also enables auditing of all role activations and actions, meeting the security team's requirements for limited duration, approval workflow, and auditability.

Answer

Entra ID Identity Protection

Answer

Entra ID Conditional Access

Answer

Entra ID Terms of Use

Question 4

A healthcare organization uses Microsoft 365 and must comply with HIPAA regulations. They need to assess their current compliance posture, identify gaps, and implement improvement actions. They want a tool that provides a compliance score based on best practices and regulatory frameworks, and offers recommended actions to improve the score. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is a Microsoft Purview solution that helps organizations assess their compliance posture against various regulations (including HIPAA) by providing a compliance score and actionable improvement recommendations. Insider Risk Management detects risky user activities. Communication Compliance monitors communications for policy violations. Audit provides logging capabilities but does not assess compliance posture or provide a score.

Answer

Insider Risk Management

Answer

Communication Compliance

Answer

Audit

Question 5

Your company uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on a specific device. Which feature should you use to get real-time visibility into running processes and network connections?

Accepted Answer

Live response. Live response gives security operators a remote shell connection to the device, enabling real-time investigation of running processes, network connections, and other forensic data. This is the correct feature for interactive, real-time visibility into a specific device during an active malware outbreak.

Answer

Threat analytics

Answer

Device inventory

Answer

Automated investigation

Question 6

Your organization wants to allow employees to use their personal mobile devices to access corporate resources, but you need to ensure that corporate data is protected if the device is lost or stolen. You also need to enforce a PIN policy on the device. Which combination of Microsoft Entra and Microsoft Intune features should you use?

Accepted Answer

Enroll devices in Microsoft Intune MDM, create a device compliance policy requiring PIN, and configure a Conditional Access policy to allow only compliant devices.. Enrolling devices in Microsoft Intune MDM allows the organization to apply device compliance policies (such as requiring a PIN) and then use Conditional Access to grant access only to compliant devices. If a device is lost or stolen, the organization can perform a selective wipe to remove corporate data while leaving personal data intact. Option A (Windows Autopilot) is a device provisioning tool, not a security or protection solution. Option B (Conditional Access with MFA and trusted locations) does not enforce device-level policies like PIN. Option D (MAM without enrollment) can enforce a PIN for managed apps but cannot manage the device itself or perform selective wipe of all corporate data; it is less comprehensive than MDM.

Answer

Use Windows Autopilot to configure devices and then apply a device restriction policy.

Answer

Implement a Conditional Access policy requiring multi-factor authentication and trusted locations.

Answer

Use Microsoft Intune app protection policies (MAM) without device enrollment, requiring PIN for managed apps.

Question 7

A multinational organization uses Microsoft Entra ID and wants to allow employees to sign in to a custom customer-facing application using their existing social identities (e.g., LinkedIn, Google). They also need to enforce a specific terms of use agreement and be able to revoke a user's access if their social account is compromised. Which Microsoft Entra capability should they configure?

Accepted Answer

Microsoft Entra External ID (B2C). Microsoft Entra External ID (B2C) is the correct choice because it is specifically designed for customer-facing applications that need to support social identity providers (like LinkedIn and Google) via OAuth 2.0 and OpenID Connect. It allows you to enforce a custom terms of use agreement during sign-up and provides the ability to revoke a user's access by disabling their account in the B2C directory or removing the social identity mapping, which directly addresses the requirement to respond to a compromised social account.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 8

A multinational organization uses Microsoft Entra ID for identity management. External contractors need temporary elevated access to Azure resources for a critical project. The access must be time-bound (expires after 8 hours), require manager approval, and enforce multifactor authentication (MFA) when contractors activate the role. Which Microsoft Entra capability should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation (e.g., 8-hour expiry), requires approval workflows (manager approval), and enforces multifactor authentication (MFA) during role activation. PIM is specifically designed to manage, control, and monitor access to critical resources through time-limited, approved, and MFA-protected role assignments.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access Reviews

Question 9

You are a security administrator for Contoso Ltd., a global financial services company with 5,000 employees. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. Recently, the security team identified a risk: employees are sharing sensitive financial reports via external email recipients without encryption. To address this, you need to implement a solution that automatically applies encryption to emails containing the sensitive information type 'U.S. Bank Account Number' when sent to external recipients. The solution must not block the email but should encrypt it. Additionally, you want to notify the sender with a policy tip that the email will be encrypted. You have access to the Microsoft Purview compliance portal. What should you configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in Microsoft Purview that detects 'U.S. Bank Account Number' and applies encryption to emails sent to external recipients, with a policy tip.. A Data Loss Prevention (DLP) policy in Microsoft Purview can automatically detect sensitive information types like 'U.S. Bank Account Number' and apply encryption to emails sent to external recipients, while also showing a policy tip to notify the sender. Option A is incorrect because Microsoft Defender for Office 365 does not provide DLP policies; DLP is part of Microsoft Purview. Option C is incorrect because simply enabling Message Encryption for all users does not automatically apply encryption based on content; it requires a DLP policy or other mechanism. Option D is incorrect because sensitivity labels require manual application or auto-labeling rules, whereas DLP can automatically enforce encryption based on conditions like sensitive data detection.

Answer

Configure an email encryption rule in Microsoft Defender for Office 365.

Answer

Enable Microsoft Purview Message Encryption for all users.

Answer

Create a sensitivity label with encryption and publish it to all users, then train users to apply it manually.

Question 10

You are a security administrator for a company using Microsoft Entra ID P2. The company has a critical application that should only be accessible by a specific group of users (the 'Finance' group). You need to ensure that any access to this application is automatically logged and that an administrator is notified when a user outside the Finance group attempts to access it. Additionally, the CEO wants a quarterly review of all users who have access to this application. Which combination of features should you use?

Accepted Answer

Create a Conditional Access policy that restricts access to the Finance group, configure audit logging for the application, and set up an access review for the Finance group.. It combines Conditional Access to restrict access to the Finance group, audit logging to log access attempts (and trigger alerts), and access reviews for quarterly recertification. Option A is wrong because B2B collaboration is for external users, not for internal group-based access control. Option B is wrong because Identity Protection is for risk detection, not for group-based access restrictions. Option C is wrong because Privileged Identity Management (PIM) is for managing privileged roles, not for assigning application access to standard user groups.

Answer

Grant access to the application via B2B collaboration and configure auditing.

Answer

Use Identity Protection to detect access attempts from non-Finance users and send alerts.

Answer

Assign the application to the Finance group using Privileged Identity Management, and enable sign-in logs.

Question 11

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Accepted Answer

Create labels, then Publish labels, then Set auto-labeling rules, then Run scans, then Review results. Data classification involves creating labels, publishing them, setting auto-labeling rules, running scans, and reviewing results.

Answer

Create labels, then Set auto-labeling rules, then Publish labels, then Run scans, then Review results

Answer

Run scans, then Create labels, then Publish labels, then Set auto-labeling rules, then Review results

Answer

Create labels, then Publish labels, then Run scans, then Set auto-labeling rules, then Review results

Question 12

A security team needs to investigate a potential data breach in Microsoft 365. They require detailed forensic logs showing every instance of mailbox access, mailbox search performed by administrators, and changes to email forwarding rules in Exchange Online. The logs must be retained for 1 year. Which Microsoft Purview solution should they use?

Accepted Answer

Audit (Premium). Audit (Premium) is required because the question specifies detailed forensic logs for mailbox access, administrator mailbox searches, and changes to email forwarding rules—all of which are high-value, user-specific events that are only captured by Audit (Premium). Audit (Standard) logs basic events but lacks the granularity for these specific operations, and it retains logs for only 90 days by default, whereas Audit (Premium) supports up to 1 year of retention. eDiscovery solutions are for searching and exporting content, not for continuous logging of administrative actions.

Answer

Audit (Standard)

Answer

eDiscovery (Standard)

Answer

eDiscovery (Premium)

Question 13

A company uses Microsoft 365 and wants to protect its users from malicious links and attachments in email, as well as phishing attacks. Which Microsoft security solution is specifically designed for email and collaboration protection?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) is the dedicated security solution for email and collaboration workloads. It provides protection against malicious links (Safe Links), malicious attachments (Safe Attachments), and anti-phishing policies specifically for Exchange Online, SharePoint, OneDrive, and Teams. This directly matches the question's requirement for email and collaboration protection.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 14

Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?

Accepted Answer

Access is blocked. The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.

Answer

Access is granted because the policy is only for Office 365 and the user uses Exchange Online

Answer

Access is granted after MFA registration prompt

Answer

Access is granted because the device is compliant

Question 15

A company uses Microsoft Entra ID. They want to ensure only current employees have access to a sensitive HR application. They implement a process where group membership for the HR app is reviewed quarterly by the HR manager, and any unnecessary access is automatically removed. Which Microsoft Entra feature should they use?

Accepted Answer

C. The scenario describes a recurring review of group membership for the HR application, with automatic removal of unnecessary access. This is exactly what Microsoft Entra ID Governance's Access Reviews feature provides: scheduled reviews (e.g., quarterly) where a reviewer (the HR manager) attests to each member's continued need, and stale access is automatically revoked upon completion.

Answer

A

Answer

B

Answer

D