SC-900 Practice Test 26 — 15 Questions

Question 1

A company wants to use Microsoft Intune to manage devices. Which TWO capabilities does Intune provide?

Accepted Answer

Mobile device management (MDM). Microsoft Intune provides Mobile Device Management (MDM) capabilities, allowing administrators to enroll devices, enforce configuration policies, and remotely wipe corporate data. Option D is correct because Intune also provides Mobile Application Management (MAM), enabling control over app access and data protection without requiring full device enrollment, using app protection policies.

Answer

Compliance assessment for cloud resources

Answer

Endpoint detection and response

Answer

Identity and access management

Question 2

A company wants to classify and label data in Microsoft SharePoint Online automatically based on content containing passport numbers. Which Microsoft Purview feature should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive information types, such as passport numbers. This enables automatic classification and labeling without manual intervention, meeting the requirement to label data based on content.

Answer

Audit log

Answer

Data classification dashboard

Answer

Data loss prevention (DLP) policy

Question 3

Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Lifecycle Management retention policy. Data Lifecycle Management includes retention and deletion policies for Exchange Online. Option B is wrong because Information Protection is about classification. Option C is wrong because Audit is for logging. Option D is wrong because eDiscovery is for search and hold.

Answer

Information Protection sensitivity labels

Answer

Audit log retention

Answer

eDiscovery hold

Question 4

A company uses Microsoft Entra ID with a custom line-of-business application that only supports SAML 2.0. They want to enable single sign-on for users. What should they configure in Microsoft Entra ID?

Accepted Answer

SAML-based single sign-on. D is correct because the custom line-of-business application explicitly supports SAML 2.0, and Microsoft Entra ID can be configured as an identity provider (IdP) to enable SAML-based single sign-on. This allows users to authenticate once in Entra ID and then access the application without re-entering credentials, using SAML assertions to pass authentication and authorization data.

Answer

Kerberos delegation

Answer

OpenID Connect authentication

Answer

SCIM-based user provisioning

Question 5

AdventureWorks, a multinational manufacturing company, uses Microsoft Purview and Microsoft Communication Compliance to monitor and manage internal communications. They need to: (1) detect and review emails containing offensive language or harassment; (2) allow employees to report inappropriate messages; (3) retain reviewed messages for 5 years; (4) ensure that only designated reviewers can access the communication compliance data; (5) integrate with Microsoft Teams and Exchange Online. The company has 10,000 users and Microsoft 365 E5 licenses. The compliance team wants a solution that automates detection and provides secure review. What should they configure?

Accepted Answer

Create a Communication Compliance policy with conditions for offensive language, enable user reporting, and configure a retention policy for 5 years on the original content locations (e.g., Exchange Online mailboxes, Teams chats, SharePoint sites).. Communication Compliance policies detect offensive language and harassment, allow user reporting, and support secure review by designated reviewers. A Microsoft 365 retention policy must be applied to the original content locations where the messages reside to retain them for 5 years. Option A is correct.

Answer

Enable mailbox auditing and create a custom script to search for offensive language.

Answer

Create a Data Loss Prevention (DLP) policy to block offensive language and enable eDiscovery for review.

Answer

Configure information barriers between departments and use audit logs for review.

Question 6

A company implements a security measure to ensure that only authorized employees can view sensitive customer records. Which principle of the CIA triad does this measure primarily protect?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive information is accessible only to authorized individuals. By restricting access to customer records to authorized employees, the company directly prevents unauthorized disclosure, which is the core goal of confidentiality in the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Accountability

Question 7

Which TWO of the following are purposes of the 'Zero Trust' security model?

Accepted Answer

Explicitly verify every access request. Zero Trust assumes breach and verifies each request as though it originates from an open network. It explicitly verifies every access request, regardless of source. It does not assume a trusted internal network; that is the traditional perimeter model. It does not rely solely on a single perimeter firewall.

Answer

Rely on a single perimeter firewall

Answer

Trust internal traffic implicitly

Answer

Assume that the network is always safe

Question 8

A financial services company is required by regulation to prevent sensitive customer financial information from being shared externally via email. The compliance team wants to automatically scan all outgoing emails for patterns that match credit card numbers or account numbers. If a match is found, the email should be blocked and the sender should receive a policy tip. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive information—such as credit card numbers and account numbers—in outgoing emails. DLP policies can scan email content and attachments for predefined sensitive information types, and when a match is found, the email can be blocked and a policy tip sent to the sender, meeting the compliance requirement.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Question 9

A company uses Microsoft Defender for Cloud to secure its hybrid cloud environment. They need to continuously assess compliance with regulatory standards like ISO 27001 and receive recommendations for remediation. Which feature should they enable?

Accepted Answer

Defender for Cloud’s regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard provides continuous assessments against standards like ISO 27001 and offers recommendations. Secure Score is a security posture metric. Defender plans are for workload protection. Workload protections are specific to resources.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Defender for Cloud’s Secure Score

Question 10

A company stores HR documents in SharePoint Online. The compliance team wants to automatically apply a sensitivity label that encrypts the document whenever it contains a passport number. They do not want users to be able to override this classification. Which Microsoft Purview solution should they configure?

Accepted Answer

Auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels can automatically apply a sensitivity label (e.g., 'Highly Confidential') that encrypts documents when they contain sensitive data like passport numbers. This policy can be configured to enforce mandatory labeling without allowing user override, meeting the compliance team's requirement. In contrast, a DLP policy can detect and block sharing of sensitive data but does not apply encryption labels automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention policy

Answer

Communication compliance policy

Question 11

A company uses Microsoft Entra ID (Azure AD). The IT team has created a security group named 'SalesTeam' that contains all sales department users. They want to ensure that only members of this group can access the company's CRM application, which is registered as an enterprise application in Entra ID. What should the IT team configure?

Accepted Answer

Enterprise application user and group assignment. Enterprise applications in Microsoft Entra ID can be configured to require user or group assignment, which restricts access to only assigned users or groups. By assigning the 'SalesTeam' security group to the CRM enterprise application, the IT team ensures that only members of that group can authenticate and access the application. This is the standard method for controlling access to gallery or custom enterprise applications in Entra ID.

Answer

A Conditional Access policy that requires group membership

Answer

Self-service group management settings

Answer

Application registration settings

Question 12

Which TWO of the following are features of Microsoft Purview Audit?

Accepted Answer

Records user and admin activities in the unified audit log. Microsoft Purview Audit provides detailed logging of user and admin activities, and allows searching the audit log for security investigations. It does not automatically block malicious activities (that's DLP or Defender), and it does not manage sensitivity labels (that's Information Protection). It does not provide real-time threat detection (that's Sentinel or Defender).

Answer

Manages sensitivity labels for documents

Answer

Provides real-time threat detection

Answer

Automatically blocks malicious activities

Question 13

An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.

Answer

Seamless Single Sign-On

Answer

Pass-through Authentication

Answer

Federation with AD FS

Question 14

A company wants to discover which cloud applications are being used by employees, assess the risk of those apps, and control data sharing in sanctioned apps like Box or Dropbox. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into shadow IT by discovering cloud app usage, assessing risk based on over 80 risk factors, and enforcing data loss prevention (DLP) policies to control data sharing in sanctioned apps like Box or Dropbox. It integrates with cloud providers via API connectors to monitor and govern data in real time.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 15

Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?

Accepted Answer

An auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This allows the 'Confidential' label to be applied without user intervention, meeting the requirement.

Answer

A sensitivity label

Answer

A data loss prevention (DLP) policy

Answer

A retention label policy