SC-900 Practice Test 25 — 15 Questions

Question 1

Match each compliance term to its correct definition.

Accepted Answer

Data Loss Prevention: Helps prevent sensitive information from being shared outside the organization. Compliance terms in Microsoft 365 cover data protection, communication restrictions, data governance, and legal discovery. DLP prevents data leaks, Information Barriers control internal communication, Records Management handles retention, and eDiscovery supports legal processes.

Answer

Data Loss Prevention: Restricts communication and collaboration between specific groups

Answer

Records Management: Helps prevent sensitive information from being shared outside the organization

Question 2

A security team manages a hybrid environment with Azure VMs and on-premises Windows servers. They want a single dashboard that provides continuous assessment of security posture, actionable recommendations to harden configurations, and integration with Microsoft Defender for Cloud to detect threats. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (MDC) is the correct solution because it provides a unified dashboard for continuous security posture assessment, actionable hardening recommendations based on the Secure Score, and native integration with Microsoft Defender for Cloud's threat detection capabilities. It supports hybrid environments, covering both Azure VMs and on-premises Windows servers via Azure Arc, and delivers the specific requirements of posture assessment, recommendations, and threat detection in a single pane of glass.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 3

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

Accepted Answer

Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.. Communication Compliance policies can be configured to monitor Microsoft Teams channel messages and chat messages natively, without requiring additional DLP policies, retention policies, or third-party archiving. The policy must include Teams messages as a supervised communication channel. Option A is incorrect because DLP policies are not required for Communication Compliance monitoring; they serve a different purpose. Option B is incorrect because Exchange Online retention policies retain data but do not enable monitoring for policy violations. Option C is incorrect because Microsoft provides native integration for Teams monitoring, so a third-party solution is unnecessary.

Answer

Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

Answer

Set up an Exchange Online retention policy to retain Teams messages.

Answer

Deploy a third-party archiving solution for Teams messages.

Question 4

You run the PowerShell command shown in the exhibit. What is the purpose of this command?

Accepted Answer

Applies a sensitivity label to a document. The command assigns a sensitivity label to a document. Option B is wrong because the command does not encrypt the document; labeling may include encryption, but the cmdlet itself only assigns the label. Option C is wrong because it does not remove a label; the command applies a label. Option D is wrong because it does not export audit logs.

Answer

Encrypts a document using Azure Information Protection

Answer

Removes a sensitivity label from a document

Answer

Exports audit logs for labeled documents

Question 5

Which TWO of the following are types of identity in Microsoft Entra ID? (Select two.)

Accepted Answer

Synchronized identity. Options A and B are correct. Microsoft Entra ID supports two primary types of identity: synchronized identity (A) and cloud-only identity (B). A synchronized identity is created in an on-premises directory and synchronized to Entra ID. A cloud-only identity is created and managed entirely in Entra ID. Option C, Guest identity, is a type of external identity used for B2B collaboration, but it is not a primary identity type. Option D, Managed identity, is a service principal used for Azure resources to authenticate, not a user identity type. Option E, Hybrid identity, is a term for using both on-premises and cloud identities but is not a distinct identity type.

Answer

Guest identity

Answer

Managed identity

Answer

Hybrid identity

Question 6

A company runs critical applications on Windows Server virtual machines in Azure and on-premises. The security team wants to reduce the exposure of administrative ports (e.g., RDP, SSH) by requiring administrators to request just-in-time (JIT) access. The request should require approval from a central team, and the port should be opened only for a limited time. Which Microsoft security solution provides this JIT capability for both Azure and on-premises servers (when connected via Azure Arc)?

Accepted Answer

Microsoft Defender for Cloud (with just-in-time VM access). Microsoft Defender for Cloud's just-in-time (JIT) VM access capability reduces exposure to administrative ports (RDP, SSH) by locking down inbound traffic to Azure VMs and Azure Arc-enabled on-premises servers. It requires administrators to request access, which can be configured to require approval from a central team, and automatically opens the specified ports for a limited time before closing them again. This directly matches the scenario's need for JIT access with approval and time-limited port opening across hybrid environments.

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 7

A small consulting company, Northwind Traders, uses Microsoft 365 Business Premium and wants to implement basic compliance solutions. They have 50 users and need to: (1) prevent employees from sharing customer credit card information via email; (2) retain all deleted emails for 1 year; (3) allow users to classify documents as 'Confidential' manually; (4) generate reports on policy violations. The company has limited IT staff and wants a quick, out-of-the-box solution. What should they configure?

Accepted Answer

Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.. Microsoft Purview (formerly Microsoft 365 Compliance) provides out-of-the-box solutions for all three requirements: DLP policies to prevent sharing of credit card info, retention policies to retain deleted emails for 1 year, and sensitivity labels for manual document classification. Option A is wrong because Microsoft Intune focuses on device management, not compliance. Option C is wrong because Microsoft 365 Defender is primarily for security detection and response, not compliance features like retention labels. Option D is wrong because Microsoft Entra ID is for identity and access management, not compliance policies.

Answer

Use Microsoft Intune to set data loss prevention policies and configure document classification.

Answer

Use Microsoft 365 Defender to block sharing of credit card data and configure email retention.

Answer

Use Microsoft Entra ID to create conditional access policies and enable retention.

Question 8

A user reports that they cannot access Microsoft 365 apps from a public Wi-Fi network. The admin sees a Conditional Access policy requiring a compliant device and a trusted location. Which component enforces this policy?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID enforces Conditional Access policies during the authentication process. While Conditional Access is where policies are defined, the actual enforcement—checking conditions like location and device compliance—occurs within the Microsoft Entra ID service when a token is issued.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Intune

Question 9

Refer to the exhibit. The exhibit shows an Azure Policy definition. A storage account named 'storagedev' is created with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

Accepted Answer

The storage account creation will be denied. The Azure Policy definition shown uses the 'Deny' effect, which explicitly blocks any resource creation that does not meet the specified conditions. Since the storage account 'storagedev' has network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules, it violates the policy's requirement for restricted network access. Therefore, Azure Policy will deny the creation of this storage account, preventing it from being provisioned.

Answer

The storage account will be created successfully

Answer

The policy will audit the storage account and mark it as non-compliant

Answer

The storage account will be created, but the policy will modify the ACLs

Question 10

Your company is implementing a hybrid identity solution with Microsoft Entra ID. You need to ensure that password changes on-premises are synchronized to the cloud within minutes. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (A) synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID in near real-time, ensuring that password changes made on-premises are reflected in the cloud within minutes. Password Writeback (D) performs the reverse: it writes password changes from the cloud back to on-premises, not from on-premises to the cloud. Pass-through Authentication (B) validates passwords against on-premises AD directly without syncing hashes, and Seamless SSO (C) provides automatic sign-in but does not handle password synchronization.

Answer

Pass-through Authentication

Answer

Seamless Single Sign-On

Answer

Password Writeback

Question 11

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.. Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

Question 12

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. You need to ensure that when a user clicks a malicious link in an email, the user is warned and the action is blocked. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links in Defender for Office 365 provides real-time time-of-click protection against malicious links. Option A is wrong because Safe Attachments scans attachments, not links. Option C is wrong because anti-phishing policies protect against spoofing and impersonation but do not block links at click time. Option D is wrong because anti-spam policies filter spam, not malicious links.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 13

Your organization wants to ensure that only users with a specific sensitivity label can access a SharePoint site. Which Microsoft Purview feature should you configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection allows you to apply sensitivity labels to content, and these labels can be used to control access to SharePoint sites via conditional access policies. Option A is wrong because Insider Risk Management focuses on detecting risky activities, not on label-based access control. Option B is wrong because Communication Compliance monitors communications for policy violations. Option C is wrong because Data Lifecycle Management focuses on retention and deletion, not access control.

Answer

Insider Risk Management

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 14

Your organization has implemented Microsoft Entra ID Governance. You need to review and attest to the access rights of users in a specific group every quarter. The group contains both direct members and members from nested groups. Which Microsoft Entra feature should you use to automate this review?

Accepted Answer

Access reviews. Access Reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group membership, including both direct members and transitive members from nested groups. This feature automates the attestation process by sending reviewers notifications and tracking their decisions, ensuring compliance with quarterly review requirements.

Answer

Lifecycle workflows

Answer

Privileged Identity Management

Answer

Entitlement management

Question 15

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events via Azure Monitor Agent. To capture command execution logs on Azure VMs, you need guest OS-level logs, which are provided by Windows Security Events (or Syslog) collected by the Azure Monitor Agent. Microsoft Sentinel can ingest these logs using the Windows Security Events connector. Option A (Office Activity log) is incorrect; it captures Microsoft 365 user and admin activities, not VM commands. Option C (Azure AD audit logs) is incorrect; it logs Azure Active Directory sign-ins and changes, not OS-level events. Option D (Azure Activity log) is incorrect; it records resource management operations on Azure resources, not guest OS commands executed within a VM.

Answer

Office Activity log

Answer

Azure AD audit logs

Answer

Azure Activity log