SC-900 Practice Test 27 — 15 Questions

Question 1

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

Accepted Answer

File entities. The KQL query filters for evidence related to alert-5678 by specifying a hash value (SHA256) of a file. In Microsoft 365 Defender, file entities are uniquely identified by their hash values, such as SHA256, SHA1, or MD5. The query uses the `where` clause to match the specific file hash, confirming that the filtered entities are file entities.

Answer

Registry entities

Answer

Process entities

Answer

Network entities

Question 2

A company wants to monitor Microsoft Teams messages and corporate emails for policy violations related to potential harassment and inappropriate behavior. They need a solution that allows them to define policies with conditions (e.g., keywords, patterns), automatically flag suspicious conversations, and optionally send notifications to the sender or escalate to a reviewer. Additionally, they need the ability to train employees when a minor violation is detected. Which Microsoft Purview solution should they use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and corporate emails by scanning for keywords, patterns, and other conditions. It can automatically flag suspicious conversations, send notifications to the sender, escalate to a reviewer, and even train employees on minor violations through its built-in remediation workflows.

Answer

Data Loss Prevention (DLP)

Answer

Information Protection

Answer

Audit

Question 3

A company uses Microsoft Entra ID and wants to provide external business partners with access to a specific internal application. The partners already use Microsoft Entra ID in their own organization. The company wants the partners to use their existing corporate credentials to sign in, without creating new user accounts in the company's tenant. The company also wants to manage the access lifecycle, including automatically removing access after a project ends. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows external users from partner organizations who already have their own Microsoft Entra ID accounts to sign in using their existing corporate credentials, without requiring new user accounts in the company's tenant. It also supports access lifecycle management through features like entitlement management and access reviews, enabling automatic removal of access when a project ends.

Answer

Microsoft Entra B2C

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 4

A hotel uses a key card system. Guests insert their card into the door lock, which reads the card's ID number. The system checks the ID number against a list of authorized rooms. If the ID matches an authorized room, the door unlocks. In this scenario, which concept is demonstrated when the system checks the ID number against the list of authorized rooms?

Accepted Answer

Authorization. The system checks the ID number against a list of authorized rooms to determine what action (unlocking the door) the guest is allowed to perform. This is the definition of authorization: granting or denying access rights based on verified identity. Authentication (proving who you are) has already occurred when the card was issued or when the system reads the ID; the check against the list is purely about permissions.

Answer

Identification

Answer

Authentication

Answer

Non-repudiation

Question 5

Which TWO Microsoft Security Copilot capabilities can help security analysts during incident response?

Accepted Answer

Provide guided response steps. Microsoft Security Copilot is an AI-powered security analysis tool that integrates with Microsoft 365 Defender and Sentinel. It can provide guided response steps (option A) by suggesting playbook actions and remediation workflows based on the incident context, and it can generate incident summary reports (option B) by synthesizing data from alerts, entities, and investigations into a concise narrative. These capabilities directly assist analysts in understanding and responding to incidents more efficiently.

Answer

Provision user accounts

Answer

Configure firewall rules

Answer

Automatically block malicious emails

Question 6

Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?

Accepted Answer

It reduces the attack surface by opening ports only when necessary. JIT network access reduces the attack surface by keeping network ports closed by default and opening them only when needed for legitimate traffic, based on user requests. It does not block all inbound traffic permanently; it allows authorized requests. It does not encrypt traffic or replace firewall rules; it complements them.

Answer

It replaces the need for network security groups

Answer

It encrypts all network traffic between the VM and clients

Answer

It permanently blocks all inbound traffic to the VM

Question 7

An organization wants to ensure that only managed and compliant devices can access corporate email in Exchange Online. Which Microsoft Entra ID Conditional Access policy setting should they use?

Accepted Answer

Require device to be marked as compliant. To ensure only managed and compliant devices access corporate email in Exchange Online, the 'Require device to be marked as compliant' setting in a Conditional Access policy evaluates the device's compliance status reported by Microsoft Intune. This ensures that devices meet security policies (e.g., encryption, patch levels) before granting access, directly addressing the requirement for managed and compliant access.

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Answer

Require multi-factor authentication

Question 8

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps?

Accepted Answer

Session controls to monitor and control app access in real time. Microsoft Defender for Cloud Apps provides session controls that leverage reverse proxy architecture to monitor and control user app access in real time, enabling conditional access policies for cloud apps. Cloud discovery uses traffic logs from network appliances or Windows endpoints to identify shadow IT by analyzing app usage and risk scores.

Answer

Information protection for files in Microsoft 365

Answer

Identity governance and access reviews

Answer

Vulnerability assessment for Azure virtual machines

Question 9

A company must retain all vendor contracts for 10 years to meet regulatory requirements. After 10 years, the contracts must be permanently destroyed with no possibility of recovery. The compliance team wants to automate this lifecycle and ensure that during the retention period, the contracts cannot be edited or deleted by users. Which Microsoft Purview solution should they use?

Accepted Answer

Records Management. Records Management in Microsoft Purview is designed to declare records (regulatory or legal) that must be retained for a specific period and then disposed of in a compliant manner. It enforces immutability during the retention period—users cannot edit or delete records—and supports a disposition review or automatic permanent deletion after the retention period ends, exactly matching the requirement for 10-year retention followed by destruction with no recovery.

Answer

Data Lifecycle Management (DLM)

Answer

eDiscovery (Premium)

Answer

Sensitivity Labels

Question 10

A security administrator is configuring permissions for a new cloud-based expense reporting application. The administrator assigns each employee only the permissions they need to perform their job functions. For example, employees in the Sales department can view expense reports but cannot approve or modify financial data. Which security principle is the administrator implementing?

Accepted Answer

Least privilege. The administrator is granting each employee only the permissions necessary to perform their job functions, such as Sales being able to view but not approve or modify financial data. This directly implements the principle of least privilege, which restricts access rights to the minimum required for legitimate tasks. In cloud-based applications like expense reporting systems, least privilege reduces the attack surface and limits potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 11

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

Accepted Answer

Enable automatic investigation and remediation in Microsoft Defender for Business.. Correct: C. Microsoft Defender for Business includes automated investigation and remediation capabilities that can automatically isolate infected devices and run full scans. Option A: Conditional Access policies control access based on conditions but do not perform remediation actions like isolation or scanning. Option B: Intune compliance policies can mark devices as non-compliant but do not automatically remediate malware. Option D: Configuring Microsoft Defender Antivirus to run a weekly scan is a scheduled task, not an automatic response to detected malware.

Answer

Create a Conditional Access policy to block access for devices with malware.

Answer

Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

Answer

Configure Microsoft Defender Antivirus to run a weekly scan.

Question 12

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Accepted Answer

Microsoft Entra Permissions Management. Options D and E are correct. Microsoft Entra ID is the core identity service, and Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution within the Microsoft Entra family. Option A is incorrect because Microsoft Defender for Identity is part of Microsoft Defender XDR, not part of the Microsoft Entra product family. Option B is incorrect because Microsoft Intune is an endpoint management service. Option C is incorrect because Microsoft Purview is a data governance and compliance service.

Answer

Microsoft Defender for Identity

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 13

Your organization uses Microsoft Entra ID and needs to allow external partners to sign in using their own identity providers (e.g., Google or Facebook). Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra External Identities (B2B collaboration). Microsoft Entra External Identities (B2B collaboration) is the correct feature because it allows external partners to sign in using their own identity providers, such as Google or Facebook, through federation. B2B collaboration supports SAML/WS-Fed identity providers and social identity providers like Google, enabling guest users to access your organization's resources without needing a separate Microsoft account. This directly meets the requirement for external partner access with their own credentials.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Verified ID

Answer

Microsoft Entra Identity Protection

Question 14

A company wants to allow users to reset their own passwords from the login screen without contacting IT. Which Microsoft Entra ID feature enables this?

Accepted Answer

Self-Service Password Reset. Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords from the login screen without contacting IT. It is specifically designed to reduce helpdesk workload by enabling password changes or unlocks through a verified authentication method, such as a phone call, text message, or the Microsoft Authenticator app.

Answer

Conditional Access

Answer

Multifactor authentication

Answer

Identity Protection

Question 15

A company is moving its on-premises infrastructure to Azure. The CISO wants to understand the division of security responsibilities between the cloud provider and the customer. Which of the following models defines this division?

Accepted Answer

Shared Responsibility Model. The Shared Responsibility Model defines the division of security responsibilities between the cloud provider (Microsoft) and the customer. Microsoft is responsible for the security of the cloud (physical hosts, network, datacenters), while the customer is responsible for security in the cloud (data, identities, access management, and configurations). This model is foundational for understanding compliance and security ownership in Azure.

Answer

CIA triad (Confidentiality, Integrity, Availability)

Answer

Zero Trust Model

Answer

Defense-in-Depth