SC-900 Practice Test 5 — 25 Questions

Question 1

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Accepted Answer

Block access from locations that are not trusted. Conditional Access policies can enforce multi-factor authentication based on user risk (D) and block access from untrusted locations (B). Option A (allow users to reset their own passwords) is a feature of self-service password reset (SSPR), not Conditional Access. Option C (automatically grant temporary admin access) is a benefit of Privileged Identity Management (PIM). Option E (eliminate the need for passwords entirely) is related to passwordless authentication, not Conditional Access.

Answer

Allow users to reset their own passwords

Answer

Automatically grant temporary admin access

Answer

Eliminate the need for passwords entirely

Question 2

Your organization uses Microsoft Entra ID with P2 licenses. You need to review and approve role activations for the Global Administrator role on a weekly basis. Which feature should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) allows you to manage, control, and monitor access to important resources in your organization, including the ability to review and approve role activations for privileged roles like Global Administrator. Option A is wrong because Identity Protection is for detecting risks and vulnerabilities. Option B is wrong because Conditional Access controls access based on conditions, not role activation approval. Option D is wrong because Access Reviews are for reviewing and recertifying access assignments, but not specifically for approving activations in real-time.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Access Reviews

Question 3

Match each security control type to its example.

Accepted Answer

Preventive: Firewall rules blocking unauthorized traffic. Security control types categorize how controls operate: preventive controls block incidents, detective controls identify them, and corrective controls fix issues. Common examples include firewall rules (preventive), IDS (detective), and backup/restore (corrective).

Answer

Preventive: Intrusion detection system monitoring network traffic

Answer

Detective: Backup and restore procedures

Answer

Corrective: Firewall rules blocking unauthorized traffic

Question 4

Which THREE of the following are core principles of the Zero Trust security model? (Choose three.)

Accepted Answer

Verify explicitly. Zero Trust principles include 'Verify explicitly', 'Least privilege', and 'Assume breach'. 'Trust but verify' is a traditional perimeter-based model. 'Single factor' contradicts explicit verification.

Answer

Trust but verify

Answer

Single factor authentication

Question 5

Which THREE capabilities are part of Microsoft Purview Data Lifecycle Management?

Accepted Answer

Retention labels. Data Lifecycle Management in Microsoft Purview focuses on managing data through its lifecycle, including retention, deletion, and records management. The key capabilities are retention policies (C), retention labels (A), and records management (E). Data Loss Prevention (B) is a separate capability for preventing data leaks, not lifecycle management. eDiscovery (D) is about discovering and exporting data for legal purposes, not lifecycle management. Therefore, the correct options are A, C, and E.

Answer

Data Loss Prevention policies

Answer

eDiscovery

Question 6

Match each Azure security service to its purpose.

Accepted Answer

Microsoft Defender for Cloud: A unified infrastructure security management system that strengthens security posture and provides advanced threat protection.. Common confusions involve mixing up the purposes of security management (Defender for Cloud), SIEM/SOAR (Sentinel), and secret management (Key Vault).

Answer

Microsoft Defender for Cloud: A cloud-native SIEM and SOAR solution.

Answer

Azure Sentinel: A tool for securely storing and managing secrets, keys, and certificates.

Answer

Azure Key Vault: A unified infrastructure security management system that strengthens security posture.

Question 7

Which TWO of the following are Microsoft Entra ID editions that include Identity Protection? (Choose two.)

Accepted Answer

Microsoft Entra ID P2. Identity Protection is available in Azure AD Premium P2 and Microsoft Entra ID Governance (which includes P2 features). Free and P1 do not include Identity Protection.

Answer

Microsoft Entra External ID

Answer

Microsoft Entra ID Free

Answer

Microsoft Entra ID P1

Question 8

Which TWO of the following are benefits of using Microsoft Entra ID Governance?

Accepted Answer

Automated access reviews for group memberships.. The correct answers are B and D. Microsoft Entra ID Governance provides automated access reviews to ensure that only the right people have access to resources, and lifecycle workflows automate onboarding and offboarding processes to manage user identities throughout their lifecycle. Option A (network segmentation) is not a feature of Entra ID Governance but rather network security. Option C (synchronizing identities) is done by Microsoft Entra Connect, not ID Governance. Option E (MFA enforcement) is a Conditional Access policy, not ID Governance.

Answer

Network segmentation for on-premises resources.

Answer

Synchronizing identities from on-premises Active Directory.

Answer

Enforcing multi-factor authentication for all users.

Question 9

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

Accepted Answer

Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.. Microsoft Purview auto-labeling for emails requires the 'applyWithOverride' action to allow users to override the label, whereas 'apply' is used for static labeling in other scenarios like SharePoint. The JSON policy uses 'apply' without override, which prevents automatic labeling on emails, as email auto-labeling policies specifically need the 'applyWithOverride' behavior to function correctly.

Answer

The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

Answer

The encryption setting prevents auto-labeling on emails.

Answer

The label is not published to users.

Question 10

Which TWO capabilities are provided by Microsoft Entra External ID? (Choose two.)

Accepted Answer

Support for social identity providers like Google. Options A and C are correct. Microsoft Entra External ID enables collaboration with external users from partner organizations (option C) and supports social identity providers like Google, Facebook, and Microsoft accounts (option A). Option B is incorrect because mobile device management is handled by Microsoft Intune, not Entra External ID. Option D is incorrect because on-premises server monitoring is not a capability of Entra External ID; it is unrelated to identity and access management. Option E is incorrect because identity risk detection is part of Microsoft Entra Identity Protection, not External ID.

Answer

Mobile device management

Answer

On-premises server monitoring

Answer

Identity risk detection

Question 11

A user reports that they cannot access the company's HR application, which requires Microsoft Entra ID authentication. The user can access other apps that also use Entra ID. What is the most likely cause?

Accepted Answer

A conditional access policy is blocking access to that specific app.. The user can access other Microsoft Entra ID-integrated apps, which rules out account-level issues like a disabled account or expired password. A conditional access policy can target specific applications, so it is the most likely cause of the block on just the HR app.

Answer

The user's account is disabled.

Answer

The tenant is blocked for all sign-ins.

Answer

The user's password expired.

Question 12

A user downloads a software update from a company's internal website. The update file is hashed, and the hash value is published on a separate secure page. After downloading, the user computes the hash of the downloaded file and compares it to the published hash. The two values match. Which security concept is primarily demonstrated by this comparison?

Accepted Answer

Integrity. Hashing is a one-way cryptographic function that produces a fixed-size digest from input data. By comparing the computed hash of the downloaded file to the published hash, the user verifies that the file has not been altered during transit or storage. This directly demonstrates the security concept of integrity, which ensures data has not been tampered with or corrupted.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 13

Which TWO Microsoft Purview solutions help organizations respond to data subject requests under GDPR?

Accepted Answer

eDiscovery. eDiscovery (A) is correct because it enables organizations to search for and export personal data across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject access and export requests under GDPR Article 15. Data Lifecycle Management (C) is correct because it allows organizations to retain personal data for the minimum necessary period and permanently delete it when no longer needed, supporting the right to erasure under GDPR Article 17.

Answer

Information barriers

Answer

Data Loss Prevention (DLP)

Answer

Communication compliance

Question 14

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 15

Your organization uses Microsoft Entra ID to manage user identities. A new employee named John joins the company and needs access to Microsoft 365 apps. You want to ensure John's identity is verified using a phone call. Which authentication method should you configure?

Accepted Answer

Phone call (voice call). The question explicitly requires verification using a phone call. The Phone call (voice call) authentication method in Microsoft Entra ID delivers an automated voice call to the user's registered phone number, prompting them to press a key to confirm their identity. This directly matches the requirement, making D the correct choice.

Answer

Time-based one-time password (TOTP)

Answer

Email one-time passcode

Answer

Text message (SMS)

Answer

FIDO2 security key

Question 16

A company uses Microsoft 365 and is concerned about phishing attacks targeting employees. They want to deploy a solution that can automatically analyze email messages for malicious links and attachments, and also provide click-time protection by rewriting URLs. Which Microsoft 365 Defender component should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct component because it is specifically designed to protect against email-borne threats such as phishing. It includes Safe Links and Safe Attachments features that automatically scan email messages for malicious links and attachments, and it rewrites URLs to provide click-time protection by checking the link against a dynamic threat intelligence feed at the moment of the click.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 17

A company wants to automatically apply a 'Confidential' sensitivity label to all documents containing credit card numbers. Which Microsoft Purview feature should be used to create the auto-labeling policy?

Accepted Answer

Microsoft Purview Auto-labeling policies. Microsoft Purview Auto-labeling policies are specifically designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This feature uses exact data match or pattern-based detection to label content at rest or in transit, fulfilling the requirement without manual intervention.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 18

A company's security policy requires that customer data must only be accessible by authorized sales representatives. Which security principle does this requirement directly enforce?

Accepted Answer

Confidentiality. The principle of confidentiality ensures that information is accessible only to authorized individuals or systems. In this scenario, restricting access to customer data to only authorized sales representatives aligns with maintaining confidentiality. The other options are incorrect: Integrity ensures data is not improperly modified, Availability ensures systems are operational, and Non-repudiation ensures actions cannot be denied.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 19

Your organization wants to use Microsoft Entra ID to authenticate users from a partner company that uses its own identity provider. Which federation standard should you use?

Accepted Answer

SAML 2.0. SAML 2.0 is the correct federation standard because it enables cross-organization authentication by allowing Microsoft Entra ID to trust assertions from a partner company's own identity provider. SAML 2.0 is specifically designed for enterprise federation scenarios where an external IdP authenticates users and sends a SAML assertion to Entra ID for access.

Answer

OAuth 2.0

Answer

SCIM

Answer

OpenID Connect

Question 20

A compliance administrator configures the above retention policy. A document created on January 1, 2025, in SharePoint Online will be retained until when?

Accepted Answer

December 31, 2025. The retention policy uses the 'When created' trigger, so a document created on January 1, 2025 is retained for 365 days from that date, expiring on December 31, 2025. Option A is incorrect because the retention period is finite. Option B is incorrect because the retention duration is 365 days from creation, not from the end of the year. Option D is incorrect because the retention period does not end on the creation date itself.

Answer

Indefinitely

Answer

January 1, 2026

Answer

January 1, 2025