SC-900 Practice Test 26 — 15 Questions

Question 1

Your organization uses Microsoft Purview eDiscovery to manage legal cases. You need to place a hold on a user's mailbox to preserve data for an ongoing litigation. Which role do you need to assign to the eDiscovery manager?

Accepted Answer

eDiscovery Manager (with the Legal Hold role enabled). Option D is correct because the eDiscovery Manager role group includes the ability to manage holds (the Legal Hold role). Option A is incorrect because Records Management is for retention labels. Option B is incorrect because Compliance Administrator has broad permissions but is not the recommended role for eDiscovery. Option C is incorrect because Information Protection is for sensitivity labels.

Answer

Records Management

Answer

Information Protection

Answer

Compliance Administrator

Question 2

Your organization wants to label emails and documents as 'Confidential' automatically based on content patterns. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling (sensitivity labels). Option C is correct because auto-labeling policies in Purview automatically apply sensitivity labels based on conditions. Option A is incorrect because retention labels are for retention, not classification. Option B is incorrect because DLP is for protecting data, not labeling. Option D is incorrect because audit is for logging.

Answer

Audit log

Answer

Retention labels

Answer

Data Loss Prevention policy

Question 3

You are reviewing a Microsoft Purview sensitivity label configuration. Based on the exhibit, what will happen when this label is applied to a document?

Accepted Answer

The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.. Option A is correct because the label includes three actions: encrypt with AES256, apply a watermark, and block sharing. Option B is wrong because there is no expiration. Option C is wrong because it blocks sharing, not just warning. Option D is wrong because it includes encryption and watermark, not just marking.

Answer

The document will be watermarked only.

Answer

The document will be encrypted and will expire after a set period.

Answer

The document will display a warning before sharing.

Question 4

A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 includes Conditional Access. Option A is wrong because Free does not include Conditional Access. Option C is wrong because P2 includes Identity Protection but Conditional Access is in P1. Option D is wrong because Microsoft 365 Business Basic includes Entra ID P1 but the question asks for the minimal license, which is Entra ID P1 standalone.

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 5

Refer to the exhibit. An analyst runs a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To retrieve the most recent 10 malware alerts.. The query filters alerts with AlertName 'Malware detected', projects relevant columns, orders by time descending, and takes the top 10. This retrieves the 10 most recent malware alerts. Option A is wrong because it does not count. Option B is wrong because it retrieves multiple alerts, not just one. Option D is wrong because it does not aggregate by computer.

Answer

To find the single highest severity alert.

Answer

To count the total number of malware alerts in the last 24 hours.

Answer

To list all computers with malware alerts.

Question 6

Your organization uses Microsoft Defender for Cloud to assess the security posture of its Azure resources. Which two actions can be taken to improve the Secure Score? (Choose two.)

Accepted Answer

Implement security recommendations by remediating unhealthy resources. Options A and C are correct because enabling Defender plans and implementing recommendations improve Secure Score. Option B is wrong because disabling VMs reduces attack surface but does not improve score. Option D is wrong because removing resources may reduce score. Option E is wrong because disabling logging reduces visibility.

Answer

Delete unused Azure resources to simplify management

Answer

Disable diagnostic logging for storage accounts

Answer

Disable non-critical virtual machines to reduce attack surface

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access. Option A is correct because Conditional Access in Microsoft Entra ID can enforce device compliance for access. Option B is wrong because Identity Protection handles risk, not compliance. Option C is wrong because Privileged Identity Management manages privileged roles. Option D is wrong because Self-Service Password Reset is for password reset.

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 8

Which TWO are features of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Options A and D are correct. Cloud Discovery identifies shadow IT. App governance controls OAuth apps. Option B is wrong because sensitivity labels are in Purview. Option C is wrong because email attack investigation is in Defender for Office 365. Option E is wrong because endpoint vulnerability management is in Defender for Endpoint.

Answer

Apply sensitivity labels to files

Answer

Investigate email-borne attacks

Answer

Vulnerability management for endpoints

Question 9

Which TWO features are available in Microsoft Entra ID P2 licenses? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Options B and D are correct. P2 includes Identity Protection and Privileged Identity Management. Option A is wrong because MFA is in P1 and also included in P2 but it's not exclusively P2; however, typically MFA is in P1 and free? Actually MFA is available in all tiers but P2 adds risk-based MFA. The question asks for features available in P2, and Identity Protection and PIM are key P2 features. Option C is wrong because password hash sync is free. Option E is wrong because self-service password reset is free or P1.

Answer

Self-service password reset (SSPR)

Answer

Multifactor authentication (MFA)

Answer

Password hash synchronization

Question 10

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

Accepted Answer

Anomaly detection policies. Option A is correct because Cloud App Security (now part of Defender for Cloud Apps) provides UEBA and anomaly detection. Options B, C, and D are incorrect: Secure Score is for security posture, Cloud Discovery is for discovering shadow IT, and app connectors are for API integration.

Answer

App connectors

Answer

Secure Score

Answer

Cloud Discovery

Question 11

Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?

Accepted Answer

An anomaly detection policy. Option A is correct because anomaly detection policies in Defender for Cloud Apps can detect activities from unfamiliar locations/IPs. Option B is wrong because app permissions policies govern third-party app permissions, not access from IPs. Option C is wrong because session policies control real-time session monitoring, not alerting on new IPs. Option D is wrong because file policies monitor file activities, not login locations.

Answer

A file policy

Answer

A session policy

Answer

An app permission policy

Question 12

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

Accepted Answer

Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.. Option B is correct because the query filters for result type 50057 (user account disabled) and counts attempts per user, then filters for more than 10 attempts. This could indicate a user trying to sign in with a disabled account. Option A is wrong because it filters for a specific error, not all attempts. Option C is wrong because it counts by user, not IP. Option D is wrong because it does not analyze impossible travel.

Answer

Identify all sign-in attempts from a specific IP address.

Answer

Identify impossible travel activity across different locations.

Answer

Identify locations with the highest number of failed sign-ins.

Question 13

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

Accepted Answer

Open the associated incident to view all related alerts and entities.. The alert is tagged as 'Malware' and has an incident ID, indicating it is part of a larger incident. The best practice is to open the incident to see correlated alerts and entities. Option A is wrong because ignoring the incident loses context. Option B is wrong because the alert is already high severity; mark as resolved later. Option D is wrong because running a simulation on a live alert is not appropriate.

Answer

Isolate the affected user's device immediately.

Answer

Mark the alert as resolved.

Answer

Run an automated simulation to test the alert.

Question 14

Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?

Accepted Answer

Scheduled query rule. Option B is correct because Scheduled query rules allow aggregation over time windows. Option A is wrong because NRT rules run every minute and cannot aggregate over 5 minutes. Option C is wrong because Fusion uses ML to correlate alerts. Option D is wrong because ML Behavior Analytics is for UEBA anomalies.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Near-real-time (NRT) query rule

Question 15

A SOC analyst is investigating a potential security incident in Microsoft Sentinel. Which three are valid methods to gather additional context about a user entity? (Choose three.)

Accepted Answer

Run an advanced hunting query in Microsoft 365 Defender. Options A, C, and D are correct because entity pages, advanced hunting, and playbooks provide context. Option B is wrong because watchlists are static and not for investigation. Option E is wrong because automation rules are for incident handling, not investigation.

Answer

Create an automation rule to assign the incident

Answer

Add the user to a watchlist