SC-900 Practice Test 25 — 15 Questions

Question 1

Your organization needs to monitor and respond to security threats across on-premises, cloud, and hybrid environments. Which Microsoft solution provides a unified SIEM and SOAR capability?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution. It provides unified threat monitoring, detection, and response across on-premises, cloud, and hybrid environments by ingesting data from various sources, using built-in analytics, and enabling automated playbooks.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Question 2

A company regularly performs automated backups of its critical databases and has a disaster recovery plan to restore operations quickly after a system failure. Which security principle is primarily being addressed by these measures?

Accepted Answer

Availability. Automated backups and a disaster recovery plan directly support the Availability principle of the CIA triad by ensuring that critical databases can be restored and operations resumed quickly after a system failure. Availability guarantees that systems and data are accessible to authorized users when needed, and these measures minimize downtime and data loss.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 3

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to enable network security recommendations for all virtual networks. Which security policy should you enable?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark provides a comprehensive set of security recommendations, including network security controls for virtual networks, such as restricting inbound/outbound traffic and enforcing encryption. Enabling this policy in Microsoft Defender for Cloud applies built-in Azure Policy initiatives that assess and recommend network security configurations across all virtual networks. This directly meets the requirement to enable network security recommendations for all virtual networks.

Answer

Adaptive network hardening

Answer

Network Security Group (NSG) flow logs

Answer

Just-in-time VM access

Question 4

Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?

Accepted Answer

Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.. The correct first step because Microsoft Defender for Identity provides an activity timeline for each account, allowing you to review all logins, resources accessed, and other suspicious activities. This helps determine if the account is compromised before taking any action. Option A is incorrect because the account may be a member of privileged groups, but that alone does not confirm compromise; the activity timeline provides more context. Option B is incorrect because immediately resetting the password could disrupt legitimate operations and destroy evidence. Option D is incorrect because the user of a service account is typically not a person, and lateral movement alerts indicate automated or unauthorized behavior, so contacting a user is not appropriate.

Answer

Check if the account is a member of any privileged groups.

Answer

Immediately reset the service account password.

Answer

Contact the user to verify if they performed the logins.

Question 5

Which TWO actions can be performed using Microsoft Purview Data Lifecycle Management?

Accepted Answer

Create a retention policy to keep financial records for 7 years. Microsoft Purview Data Lifecycle Management allows administrators to create retention policies that specify how long data must be kept to meet regulatory or business requirements, such as retaining financial records for 7 years. Option C is correct because the same solution enables deletion policies that automatically remove outdated content, like drafts older than 30 days, ensuring data is not kept longer than necessary.

Answer

Monitor internal emails for policy violations

Answer

Block sharing of sensitive files with external users

Answer

Automatically classify documents containing PII

Question 6

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. The security team wants to automatically block the use of a newly discovered high-risk cloud app across all users. What is the most efficient approach?

Accepted Answer

Create an app discovery policy with governance action to unsanction the app.. Microsoft Defender for Cloud Apps (MDCA) Cloud Discovery uses app discovery policies to automate governance actions on discovered apps. Creating an app discovery policy that targets the high-risk app and applies the 'Unsanction' governance action automatically blocks it across all users, which is the most efficient and purpose-built approach. This leverages MDCA's native discovery and governance workflow rather than manual or indirect methods.

Answer

Create a Conditional Access policy to block the app for all users.

Answer

Manually add the app to the blocked list in the cloud discovery settings.

Answer

Configure session controls to monitor app usage.

Question 7

Your company is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive data like credit card numbers via email with external recipients, but allow internal sharing. What should you configure?

Accepted Answer

A DLP policy for Exchange Online with a condition 'content contains sensitive information type' and 'shared with people outside my organization'. Microsoft Purview DLP policies are designed exactly for this scenario: you create a DLP policy scoped to Exchange Online, add a rule with the condition 'Content contains sensitive information type' (e.g., Credit Card Number), and add the condition 'Shared with people outside my organization' to restrict external sharing while allowing internal. This is the canonical DLP configuration for preventing sensitive data exfiltration via email. Sensitivity labels and retention labels serve different purposes (classification/encryption and lifecycle management), and Conditional Access controls access to services, not content sharing.

Answer

Sensitivity labels with encryption

Answer

Retention labels and policies

Answer

Conditional Access policies with session controls

Question 8

Your organization uses Microsoft Purview Audit (Standard) and needs to investigate a data breach that occurred 120 days ago. You discover that the required audit logs are not available. What is the most likely reason?

Accepted Answer

Audit log retention is limited to 90 days for Audit (Standard). Microsoft Purview Audit (Standard) retains audit logs for only 90 days by default. Since the data breach occurred 120 days ago, the logs would have been automatically purged after the retention period expired, making them unavailable for investigation.

Answer

The user does not have an appropriate license

Answer

The organization has insufficient storage

Answer

The audit logs were manually deleted by an administrator

Question 9

An organization wants to ensure that its security team can quickly identify and respond to threats across all workloads, including identities, endpoints, email, and cloud apps. Which Microsoft security solution provides a unified incident management experience?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR is the unified extended detection and response platform that correlates signals across Microsoft 365 Defender workloads — Defender for Identity, Defender for Endpoint, Defender for Office 365, and Defender for Cloud Apps — into a single incident queue and investigation experience in the Microsoft 365 Defender portal. This cross-domain correlation is exactly what 'unified incident management across identities, endpoints, email, and cloud apps' describes.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Question 10

A company wants to implement just-in-time (JIT) privileged access management for their Global Administrators in Microsoft Entra ID. They require that a user must request activation of the Global Administrator role, the request must be approved by a separate administrator, and the role will automatically expire after 4 hours. Additionally, they need an audit trail of all activations. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator on-demand, requiring approval from designated approvers, setting a maximum activation duration (e.g., 4 hours), and automatically deactivating the role upon expiry. It also maintains a full audit trail of all activations, approvals, and role assignments via the PIM audit history and Microsoft Entra ID audit logs, meeting all the stated requirements.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Azure Role-Based Access Control (RBAC)

Question 11

A company wants to allow employees to access corporate resources such as email and internal apps using their personal smartphones. The IT team does not want to fully manage or domain-join these devices but needs each device to have a simple identity that links the user's work account to the device. Which Microsoft Entra ID device identity option should they implement?

Accepted Answer

Microsoft Entra ID Registered. Microsoft Entra ID Registered (formerly Azure AD Registered) provides a device identity for personal (BYOD) devices without requiring organizational domain join or full management. It links the user's work account to the device, enabling access to corporate resources via conditional access and Intune app protection policies. This matches the requirement of a simple identity for personal smartphones without full management.

Answer

Microsoft Entra ID Joined

Answer

Hybrid Microsoft Entra ID Joined

Answer

Active Directory Joined

Question 12

A security analyst needs to query Microsoft 365 audit logs to find all activities where a user deleted a file from SharePoint Online in the last 24 hours. Which tool should they use?

Accepted Answer

Microsoft Purview compliance portal audit search. Microsoft Purview compliance portal audit search is the correct tool because it provides a dedicated, searchable interface for querying the Microsoft 365 unified audit log. This log records all user and admin activities, including file deletions from SharePoint Online, and supports time-based filters (e.g., last 24 hours) to retrieve specific events. It is purpose-built for compliance and security investigations without requiring additional licensing or complex scripting.

Answer

Microsoft Sentinel

Answer

Microsoft Graph PowerShell

Answer

Microsoft Defender for Cloud Apps

Question 13

You run the PowerShell command shown in the exhibit. What is the purpose of this command?

Accepted Answer

Applies a sensitivity label to a document. The PowerShell command shown in the exhibit is used to apply a sensitivity label to a document. Sensitivity labels in Microsoft 365 are applied using cmdlets like Set-AIPFileLabel or Set-Label, which tag the file with the specified label for classification and protection. This action does not encrypt the document by itself; encryption is a potential outcome of the label's protection settings, but the command's primary purpose is labeling.

Answer

Encrypts a document using Azure Information Protection

Answer

Removes a sensitivity label from a document

Answer

Exports audit logs for labeled documents

Question 14

Refer to the exhibit. A legal team needs to preserve all documents in SharePoint and OneDrive for 5 years. The current policy retains for 1 year. What should the administrator do to meet the requirement?

Accepted Answer

Change the retention duration to 1825 days.. The retention duration is expressed in days, and 5 years equals 1,825 days (5 × 365). Changing the retention duration to 1825 days directly satisfies the legal team's requirement to preserve documents for 5 years. The retention type and action control whether items are kept or deleted, but the duration is the parameter that defines how long they are retained.

Answer

Add Exchange Online to the locations.

Answer

Change the retention type to Delete.

Answer

Change the retention action to KeepAndDelete.

Question 15

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to prevent users from sharing credit card numbers via email. Which type of sensitive information type should you use in the DLP rule?

Accepted Answer

Built-in sensitive information type. Microsoft Purview ships with built-in sensitive information types (SITs) that already detect credit card numbers using validated patterns, including the Luhn checksum and contextual keywords like 'credit card' or 'CVV.' Using the built-in 'Credit Card Number' SIT is the fastest, most accurate way to enforce a DLP rule blocking card numbers in email. Custom or EDM approaches are unnecessary when a ready-made SIT exists.

Answer

Custom keyword list

Answer

Trainable classifier

Answer

Exact data match (EDM) based classification