SC-900 Practice Test 2 — 25 Questions

Question 1

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 2

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. It combines a Conditional Access policy that requires a compliant device (enforced by Intune) with an Intune app protection policy (MAM) that prevents copying corporate data to unmanaged apps. This meets both requirements. Option A is incorrect because Windows Autopilot is for provisioning, not compliance enforcement. Option B is incorrect because MFA and Windows Hello for Business do not control device compliance or data leakage. Option C is incorrect because requiring an approved client app alone does not enforce device compliance, and Azure AD Application Proxy is for remote access to on-premises apps, not data protection.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 3

An organization wants to enable passwordless authentication for its users by using a mobile app. Which Microsoft Entra ID authentication method should they implement?

Accepted Answer

Microsoft Authenticator (passwordless sign-in). Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate via app notification. FIDO2 security keys are hardware tokens. Windows Hello for Business uses biometrics. Temporary Access Pass is for initial setup.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Question 4

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because data loss prevention policies use classification but are not the classification mechanism itself. Option B is wrong because sensitivity labels are used for applying protection based on classification, not for classification itself. Option D is wrong because retention labels are for data retention policies.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 5

A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?

Accepted Answer

A conditional access policy is blocking access based on the user's location. Although the user is a member of the Finance group and has the required sensitivity label permission, the conditional access policy blocks access based on the user's location (country). Conditional access policies can override label permissions. Option A is incorrect because the user does have the required label permission. Option B is incorrect because no licensing issue is indicated; Microsoft 365 E5 is not required for sensitivity labels. Option D is incorrect because the document does have a sensitivity label applied.

Answer

The user does not have the required sensitivity label permission

Answer

The user does not have a Microsoft 365 E5 license

Answer

The document does not have a sensitivity label applied

Question 6

Refer to the exhibit. A legal team needs to preserve all documents in SharePoint and OneDrive for 5 years. The current policy retains for 1 year. What should the administrator do to meet the requirement?

Accepted Answer

Change the retention duration to 1825 days.. The policy retains for 365 days (1 year), but the requirement is 5 years. Changing the retention duration to 1825 days (5 years) meets the requirement. Option A is wrong because the policy already includes both locations. Option B is wrong because changing to Delete would delete content. Option D is wrong because changing to KeepAndDelete would still delete after retention, but the duration is the issue.

Answer

Add Exchange Online to the locations.

Answer

Change the retention type to Delete.

Answer

Change the retention action to KeepAndDelete.

Question 7

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Accepted Answer

Sensitive information type for passport numbers. A sensitive information type (SIT) for passport numbers defines the pattern and validation logic that Microsoft Purview uses to detect passport numbers in content. An auto-labeling policy then applies the specified sensitivity label automatically when the SIT is matched, enabling automated classification and protection without user intervention.

Answer

Retention label

Answer

Data loss prevention (DLP) policy

Answer

Trainable classifier

Question 8

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

Accepted Answer

The location condition is configured to include trusted locations. The policy includes MFA for Exchange Online, but the location condition 'includeLocations' with 'AllTrusted' means it applies to trusted locations, not excludes them. To exclude trusted locations, the policy should use 'excludeLocations'. Therefore, the user is prompted for MFA when accessing from a trusted IP because the policy is incorrectly configured to include trusted locations, making option A the most likely cause.

Answer

The policy targets high sign-in risk

Answer

The policy does not apply to Exchange Online

Answer

The policy requires device compliance

Question 9

Which THREE are features of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time VM access. Just-in-time (JIT) VM access is a feature of Microsoft Defender for Cloud that reduces exposure to brute-force attacks by locking down inbound traffic to VMs. It allows you to control when specific ports (e.g., RDP port 3389 or SSH port 22) are opened on demand, based on role-based access control (RBAC) and approved requests, and automatically closes them after a configured time window.

Answer

Data classification

Answer

Incident investigation

Question 10

Which TWO of the following are benefits of using Microsoft Entra ID for identity management?

Accepted Answer

Single sign-on (SSO) to cloud applications. Single sign-on (SSO) and multi-factor authentication (MFA) are key benefits of Entra ID. Password hash synchronization is a feature of Entra Connect, not a direct benefit. On-premises Active Directory is a separate service. Security incident detection is more aligned with Microsoft Sentinel or Defender.

Answer

Password hash synchronization

Answer

Automated security incident detection

Answer

Replacement of on-premises Active Directory

Question 11

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Accepted Answer

View a compliance score that indicates your overall compliance posture.. Compliance Manager provides a compliance score to indicate your overall compliance posture (B), suggests improvement actions to achieve compliance (D), and allows you to assign compliance tasks to other users (C). Option A is incorrect because Data Loss Prevention policies are created in the Microsoft Purview compliance portal, not directly in Compliance Manager. Option E is incorrect because automatically applying sensitivity labels is done through auto-labeling policies, not Compliance Manager.

Answer

Create Data Loss Prevention policies.

Answer

Automatically apply sensitivity labels to documents.

Question 12

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security Information and Event Management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that collects and analyzes security data from across an enterprise. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response. These two core functions—SIEM and SOAR—are explicitly listed as features of Sentinel.

Answer

Data loss prevention

Answer

Endpoint detection and response

Answer

Identity governance

Question 13

A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 14

A company uses Azure SQL Database, which is a Platform as a Service (PaaS) offering. The security team is reviewing the shared responsibility model and wants to know who is responsible for applying operating system patches to the underlying infrastructure that hosts the database. Who is responsible for this task?

Accepted Answer

Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.. Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system. In the shared responsibility model for PaaS, Microsoft is responsible for applying OS patches to the host servers, while the customer manages the database configuration and data. Therefore, option B correctly identifies Microsoft as responsible for OS patching in this context.

Answer

The customer is responsible for patching the OS on virtual machines but not for PaaS; however, the customer must patch the OS for Azure SQL Database.

Answer

Both the customer and Microsoft share equal responsibility for patching the OS in a PaaS model.

Answer

The cloud service provider partner (e.g., a managed service provider) is responsible for OS patches in PaaS.

Question 15

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct solution because it is specifically designed to inspect email content and attachments for sensitive data types, such as credit card numbers, using built-in sensitive info types. When a match is detected, the policy can automatically block the email from being sent externally, enforcing the organization's data protection requirements without manual intervention.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft Intune App Protection policy

Answer

Microsoft Entra ID Conditional Access policy

Question 16

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Accepted Answer

Conditional Access. Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Answer

Identity Protection

Answer

Security defaults

Answer

Password protection

Question 17

A compliance administrator needs to generate a report showing all user activities related to accessing highly sensitive documents in SharePoint. Which Microsoft Purview solution should they use?

Accepted Answer

Audit (Standard or Premium). Audit (Standard or Premium) logs and records all user activities, including access to highly sensitive documents in SharePoint. Audit (Premium) provides deeper visibility with events like 'FileAccessed' and 'SensitivityLabelApplied', enabling compliance administrators to generate detailed reports on who accessed sensitive content and when.

Answer

eDiscovery

Answer

Data Loss Prevention

Answer

Communication Compliance

Question 18

Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?

Accepted Answer

Add a condition to exclude accounts that are known admin accounts or service accounts.. Known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.

Answer

Change the rule to alert on every admin consent grant event regardless of account creation.

Answer

Remove the join with SigninLogs and only use AuditLogs.

Answer

Increase the time window from 10 minutes to 30 minutes.

Question 19

Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?

Accepted Answer

A sensitivity label with auto-labeling for sensitive information types. Sensitivity labels with auto-labeling can automatically detect sensitive information types (such as credit card numbers) in emails and apply a label that enforces encryption. This meets the requirement to both classify and protect the data in transit.

Answer

A trainable classifier for credit card numbers

Answer

A retention label for credit card information

Answer

A data loss prevention (DLP) policy

Question 20

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Risk-based conditional access policies. Risk-based conditional access policies (B) are a core capability of Microsoft Entra ID Protection, allowing organizations to automatically enforce access controls based on detected risk levels from user and sign-in activities. Reports on risky users and sign-ins (D) provide the foundational telemetry that Entra ID Protection uses to identify and investigate potential identity compromises, making both integral to the service.

Answer

Passwordless authentication

Answer

Just-in-time privileged access

Answer

Conditional access policies for device compliance