SC-900 Practice Test 4 — 25 Questions

Question 1

Your organization uses Microsoft Purview to enforce retention policies. You need to retain all documents in a specific SharePoint site for 5 years after they are created, and then delete them permanently. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A retention policy set to retain for 5 years and then delete. A retention policy scoped to a SharePoint site can be configured to retain items for 5 years after creation and then delete them permanently. This applies automatically to all content in the site without requiring manual action or labels. Option A is incorrect because DLP policies are for preventing data loss, not retention. Option C is incorrect because a retention label is applied per item and requires explicit assignment or auto-application rules, whereas a policy applies broadly to a location. Option D is incorrect because sensitivity labels are for classification and protection, not retention.

Answer

A DLP policy with a retention rule

Answer

A retention label set to retain for 5 years and then delete

Answer

A sensitivity label with a retention setting

Question 2

Your organization is implementing Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers in emails and documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect sensitive information like credit card numbers and apply protective actions, such as blocking or encrypting the content. Information Protection refers to sensitivity labels and encryption, but DLP is the feature that uses policies to detect and protect data in transit and at rest. Data Lifecycle Management handles retention and deletion. Insider Risk Management focuses on user behavior.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Information Protection

Question 3

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention. Option B, the Password reset admin portal, is intended for administrators to reset passwords for users, not for self-service. Option C, Identity Protection, is a feature that detects and responds to identity-based risks, not for password resets. Option D, Privileged Identity Management, manages and monitors privileged roles and access, not password recovery.

Answer

Password reset admin portal

Answer

Identity Protection

Answer

Privileged Identity Management

Question 4

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Accepted Answer

Access reviews. Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Answer

Conditional Access policies

Answer

Self-service password reset (SSPR) with writeback

Question 5

An organization uses Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers stored in SharePoint Online. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Data Loss Prevention. Data Loss Prevention (DLP) policies can identify sensitive data like credit card numbers and apply protection actions such as blocking access. Information Protection (sensitivity labels) classifies data but does not automatically detect and protect specific patterns like credit card numbers without DLP integration.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Question 6

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

Classify and label sensitive data. Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Answer

Block external sharing of files

Answer

Detect malware in email attachments

Answer

Monitor user activities in real-time

Question 7

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Accepted Answer

Create a retention label with a retention period of 7 years. A retention label with a 7-year retention period allows you to apply specific retention and deletion rules to individual documents, such as financial records, rather than to an entire site. This granularity is necessary when only a subset of content within a SharePoint site must be retained for compliance.

Answer

Create a data loss prevention policy

Answer

Create a retention policy for the entire SharePoint site

Question 8

A company stores customer data in Microsoft 365 and needs to identify which data is subject to GDPR. Which Microsoft Purview solution should be used?

Accepted Answer

Data Classification. Microsoft Purview Data Classification enables organizations to identify and classify sensitive data across their Microsoft 365 environment. This includes detecting personal data that may be subject to regulations like GDPR. The other options serve different purposes: lifecycle management for retention, DLP for protection, and audit for logging.

Answer

Data Lifecycle Management

Answer

Data Loss Prevention

Answer

Audit

Question 9

A company requires that all sensitive data in Microsoft Teams messages be automatically encrypted and labeled with a 'Confidential' tag. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection includes sensitivity labels that can be auto-applied to sensitive data in Teams messages. DLP policies can detect data but do not apply labels directly. Data Lifecycle Management handles retention. Compliance Manager is for assessments.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Question 10

Your organization uses Microsoft Purview Audit to investigate a security incident. You need to search for activities performed by a specific user over the past 90 days. Which solution should you use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) provides 90-day retention for audit logs, which meets the requirement to search for user activities over the past 90 days. Option B (Audit Premium) offers longer retention but is not necessary for this 90-day search. Option C (Microsoft Defender XDR Advanced Hunting) is used for advanced threat hunting, not for auditing user activities. Option D (eDiscovery Standard) is designed for legal and compliance searches, not for routine audit log searches.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Defender XDR Advanced Hunting

Answer

Microsoft Purview eDiscovery (Standard)

Question 11

A compliance officer wants to automatically classify emails containing credit card numbers as 'Highly Confidential' and apply encryption. Which Microsoft Purview feature should be used?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies are designed to detect sensitive information such as credit card numbers and automatically apply protective actions like encryption. Option A is incorrect because sensitivity labels are classification tools that can be applied manually or automatically via DLP, but the automation of encryption based on content is a DLP capability. Option B is incorrect because retention labels are used for data retention and deletion policies, not for encryption. Option C is incorrect because eDiscovery is used for searching and exporting data for legal or investigative purposes, not for automatic classification and encryption.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Retention Labels

Answer

Microsoft Purview eDiscovery

Question 12

A company wants to ensure that only users with appropriate permissions can access sensitive data stored in Microsoft SharePoint Online. Which principle should they implement?

Accepted Answer

Apply the principle of least privilege. The principle of least privilege ensures that users have only the minimum permissions necessary to perform their tasks, which directly limits access to sensitive data. Option B (RBAC) is a method to enforce least privilege, but the question asks for the principle itself. Option C (MFA) adds authentication security but does not control permissions. Option D (defense in depth) is a broader security strategy, not specifically about permission minimization.

Answer

Assign roles based on job function using role-based access control (RBAC)

Answer

Enable multi-factor authentication (MFA) for all users

Answer

Implement defense in depth

Question 13

A healthcare organization must comply with HIPAA regulations regarding the protection of patient health information (PHI). Which cloud compliance concept ensures that the organization has controls in place to meet regulatory requirements?

Accepted Answer

Compliance management. Compliance management is the discipline of ensuring that an organization adheres to regulations like HIPAA by implementing controls. Security management focuses on protecting assets from threats. Identity management deals with authentication and authorization. Privacy management addresses personal data protection. The question specifically asks about meeting regulatory requirements.

Answer

Privacy management

Answer

Identity management

Answer

Security management

Question 14

Your organization has a Microsoft Purview retention policy that retains SharePoint documents for 5 years. After 5 years, you want an administrator to review and approve deletion. Which configuration is required?

Accepted Answer

Configure a disposition review at the end of the retention period. A disposition review allows an administrator to manually review and approve or reject deletion at the end of the retention period, meeting the requirement for admin approval.

Option B is incorrect: applying a retention label and enabling disposition review is not required; the configuration needed is to enable disposition review on the retention policy itself. Option C is incorrect: eDiscovery (Premium) is used for legal investigations and exports, not for managing disposition workflows. Option D is incorrect: automatic deletion would delete files without any admin review, which contradicts the requirement.

Answer

Apply a retention label and enable disposition review

Answer

Use eDiscovery (Premium) to export and then delete

Answer

Set the retention policy to delete automatically after 5 years

Question 15

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy configuration for a compliance team. What is the effect of this policy?

Accepted Answer

The policy blocks access but allows users to override with a justification. The policy includes a BlockAccess action with behavior set to BlockWithOverride, meaning the action is blocked by default but the user can override with a business justification. Additionally, the NotifyUser action sends a custom notification to the user. This matches Option A. Option B is incorrect because there is no encryption action configured. Option C is incorrect because the policy does block access (with override), not just send a notification. Option D is incorrect because the policy allows user override, so it does not automatically block without override.

Answer

The policy automatically applies encryption to the content

Answer

The policy sends a notification but does not block access

Answer

The policy automatically blocks access without user override

Question 16

A company uses Microsoft Defender for Cloud to secure its hybrid cloud workload. The security team needs to ensure that all virtual machines (VMs) have Just-In-Time (JIT) VM access enabled. What should they use to enforce this across subscriptions?

Accepted Answer

Assign an Azure Policy initiative that requires JIT VM access. Azure Policy can enforce JIT VM access via a built-in initiative. Assigning an Azure Policy initiative across subscriptions ensures that any VM without JIT VM access enabled is non-compliant and can be remediated. Option B (Azure Blueprints) is an orchestration tool that can deploy resources but does not enforce configuration across subscriptions at scale. Option C (Defender for Cloud servers plan) enables security features but does not enforce specific settings like JIT. Option D (Secure Score recommendations) is advisory and does not enforce compliance.

Answer

Use Azure Blueprints to deploy JIT access configuration

Answer

Enable the Defender for Cloud servers plan

Answer

Implement a Secure Score recommendation for JIT access

Question 17

A multinational corporation must comply with GDPR and requires that personal data of EU users be retained for a maximum of 90 days after account closure. After that, all personal data must be permanently deleted. Which combination of Microsoft Purview capabilities should be used?

Accepted Answer

Create a retention label with a retention period of 90 days and then delete the content automatically. A retention label can be configured to retain data for a specified period (90 days) and then automatically trigger a disposition review or permanent deletion. This meets the GDPR requirement to retain data for 90 days and then delete it. Option B is correct. eDiscovery cases (A) are used for legal holds and searches, not automated lifecycle management. Sensitivity labels (C) do not enforce retention or deletion; they classify data. DLP policies (D) are designed to prevent unauthorized sharing, not to manage retention periods.

Answer

Configure an eDiscovery case to delete content after 90 days

Answer

Apply a sensitivity label that expires after 90 days

Answer

Use a Data Loss Prevention policy to block retention after 90 days

Question 18

Your organization is required to retain all HR-related documents for 7 years after an employee leaves. After that period, the documents must be permanently deleted. Which two Microsoft Purview features should you use together?

Accepted Answer

Retention labels and retention policies. Retention labels and retention policies. Retention labels allow you to apply retention settings (e.g., retain for 7 years then delete) to specific documents, while retention policies enforce those settings at the location level (e.g., all HR document libraries). Option A (eDiscovery and audit logs) is for search and audit, not retention. Option B (DLP policies and sensitivity labels) is for data protection and classification, not retention. Option C (Sensitivity labels and auto-labeling) is for classification and automated labeling, not retention.

Answer

eDiscovery and audit logs

Answer

DLP policies and sensitivity labels

Answer

Sensitivity labels and auto-labeling

Question 19

Your organization uses Microsoft Entra ID P2 and wants to reduce the risk of identity compromise by requiring multifactor authentication (MFA) for all users, but excluding users when they are on the corporate network. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies allow you to enforce MFA based on network location, user, and device conditions. Option A is correct because the policy can target all users and exclude trusted IPs (e.g., the corporate network). Option B is wrong because self-service password reset (SSPR) does not enforce MFA. Option C is wrong because Identity Protection detects risk but does not directly enforce MFA by location. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time access for privileged roles, not general MFA.

Answer

Self-service password reset (SSPR) policy

Answer

Identity Protection risk policy

Answer

Privileged Identity Management (PIM) activation policy

Question 20

A user reports that they cannot access a critical application, receiving an error that their session has expired. The sign-in logs show the user was prompted for multifactor authentication (MFA) multiple times during the same session. What should an administrator review to reduce these interruptions?

Accepted Answer

Microsoft Entra Conditional Access session controls. Session controls in Conditional Access policies can be configured to reduce repeated MFA prompts within the same session, such as by adjusting the sign-in frequency or persistent browser session settings. Option A is wrong because tenant-wide MFA settings enforce MFA globally but do not control session-specific behavior. Option C is wrong because Identity Protection focuses on risk-based policies, not directly on session lifetime. Option D is wrong because Privileged Identity Management manages role activation and assignment, not session controls.

Answer

Microsoft Entra tenant-wide MFA settings

Answer

Microsoft Entra Identity Protection policies

Answer

Microsoft Entra Privileged Identity Management settings