SC-900 Practice Test 27 — 15 Questions

Question 1

You are reviewing a Microsoft Purview auto-labeling policy configuration. Based on the exhibit, what happens when a document contains a credit card number and is labeled 'Confidential'?

Accepted Answer

Access is blocked. Option B is correct because the rule specifies action 'blockAccess' when condition 'contains Credit Card Number' and label 'Confidential'. Option A is wrong because it blocks, not allows. Option C is wrong because it does not apply encryption; it blocks access. Option D is wrong because it does not notify admin.

Answer

Access is allowed

Answer

Encryption is applied to the document

Answer

An administrator is notified

Question 2

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to improve their secure score. What should they do?

Accepted Answer

Implement the security recommendations. Option D is correct because a higher secure score is achieved by implementing security recommendations. Option A is wrong because disabling services lowers score. Option B is wrong because removing compute resources doesn't improve score. Option C is wrong because increasing budget is unrelated.

Answer

Remove all virtual machines from the subscription

Answer

Increase the Azure budget

Answer

Disable Microsoft Defender for Cloud

Question 3

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove malicious attachments from emails before they reach user inboxes. Which protection feature should be configured?

Accepted Answer

Safe Attachments policies. Safe Attachments in Defender for Office 365 detonates attachments in a sandbox and removes malicious ones before delivery. Option A is incorrect because Safe Links protects URLs, not attachments. Option B is incorrect because anti-phishing policies target phishing attempts. Option D is incorrect because anti-spam policies handle spam, not malware.

Answer

Anti-spam policies

Answer

Anti-phishing policies

Answer

Safe Links policies

Question 4

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

Accepted Answer

External identities (B2B) with social identity providers. Option C is correct because external identities (B2B) allow social identity providers as external identity sources. Option A is incorrect because self-service password reset does not provide sign-in. Option B is incorrect because Privileged Identity Management is for managing privileged roles. Option D is incorrect because Microsoft Authenticator is for MFA, not social identity.

Answer

Microsoft Authenticator app for passwordless sign-in

Answer

Privileged Identity Management

Answer

Self-service password reset

Question 5

You are a security administrator for a company that uses Microsoft 365. The compliance team needs to automatically classify and protect sensitive data such as credit card numbers in emails and documents. Which Microsoft Purview solution should you recommend?

Accepted Answer

Microsoft Purview Data Loss Prevention. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) policies automatically detect and protect sensitive data like credit card numbers. Option A is wrong because Information Protection focuses on classification and labeling, but DLP enforces actions. Option B is wrong because Insider Risk Management detects risky user activities, not data classification. Option D is wrong because Records Management manages retention and disposition, not real-time protection.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Question 6

Which TWO of the following are capabilities of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection (CWP). Options A and D are correct. Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP). Option B is wrong because endpoint detection is covered by Defender for Endpoint, not Defender for Cloud. Option C is wrong because email security is covered by Defender for Office 365. Option E is wrong because identity protection is covered by Microsoft Entra ID Protection.

Answer

Email security

Answer

Identity protection

Answer

Endpoint detection and response (EDR)

Question 7

A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?

Accepted Answer

Azure Monitor Agent (AMA). Azure Monitor Agent (AMA) is the recommended agent for collecting logs from Windows and Linux machines and sending to Log Analytics workspaces for Sentinel. Option A is wrong because MMA is legacy. Option C is wrong because the Syslog connector is for Linux but AMA also supports Syslog. Option D is wrong because the Office 365 connector is for cloud services.

Answer

Syslog connector

Answer

Microsoft Monitoring Agent (MMA)

Answer

Office 365 connector

Question 8

Your organization wants to protect against phishing attacks by verifying the sender's identity for incoming emails. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Anti-phishing policy with SPF/DKIM/DMARC settings. Option C is correct because SPF, DKIM, and DMARC are email authentication protocols in Defender for Office 365. Option A is wrong because Safe Attachments checks attachments. Option B is wrong because Safe Links checks URLs. Option D is wrong because Anti-malware policies scan for malware.

Answer

Anti-malware policy

Answer

Safe Links policy

Answer

Safe Attachments policy

Question 9

Refer to the exhibit. The exhibit shows an Azure Policy definition. A storage account named 'storagedev' is created with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

Accepted Answer

The storage account creation will be denied. Option D is correct because the condition matches (defaultAction Allow and no IP rules) and the effect is deny, so the storage account creation will be denied. Option A is wrong because deny effect blocks creation. Option B is wrong because audit would log but not block. Option C is wrong because the condition is met.

Answer

The storage account will be created successfully

Answer

The policy will audit the storage account and mark it as non-compliant

Answer

The storage account will be created, but the policy will modify the ACLs

Question 10

A security analyst in your organization receives an alert from Microsoft Defender XDR indicating that a user's device may be infected with ransomware. The analyst needs to immediately isolate the device from the network to prevent further spread. What should the analyst do?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation. Option B is correct because Microsoft Defender for Endpoint (part of Defender XDR) provides the ability to isolate a device from the network. Option A is wrong because Microsoft Sentinel is SIEM, not endpoint action. Option C is wrong because Microsoft Intune can wipe devices but is slower and not immediate isolation. Option D is wrong because Microsoft Entra ID is for identity, not device isolation.

Answer

Revoke the user's session in Microsoft Entra ID

Answer

Open Microsoft Sentinel and run a playbook

Answer

Use Microsoft Intune to wipe the device

Question 11

Which TWO of the following are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Enable just-in-time access to virtual machines. Microsoft Defender for Cloud provides cloud security posture management (CSPM) and workload protection. Option B is correct because it offers CSPM via secure score. Option D is correct because it provides just-in-time VM access. Option A is wrong because that is Microsoft Defender for Identity. Option C is wrong because that is Microsoft Sentinel. Option E is wrong because that is Microsoft Intune.

Answer

Centralize security event log analysis from multiple sources

Answer

Monitor domain controllers for malicious activity

Answer

Manage mobile devices and enforce compliance policies

Question 12

Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention (DLP) policy. Option B is correct because DLP policies can detect and prevent sharing of sensitive data to unauthorized services. Option A is incorrect because audit logs only record activity, not block. Option C is incorrect because sensitivity labels classify data but do not block sharing. Option D is incorrect because records management focuses on retention.

Answer

Audit log

Answer

Retention policy

Answer

Sensitivity label

Question 13

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

Accepted Answer

An automation rule with a playbook. Option A is correct because automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because analytics rules create alerts, not automated responses. Option C is wrong because workbooks provide visualizations, not automation. Option D is wrong because watchlists are for correlation, not response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 14

Which THREE of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Provide policy tips to users. Options A, C, and D are correct. DLP can detect sensitive data in emails, monitor endpoints, and be customized with policy tips. Option B is wrong because sensitivity labels are part of Information Protection, not DLP directly. Option E is wrong because retention policies are part of Records Management.

Answer

Apply sensitivity labels automatically

Answer

Retain data for a specified period

Question 15

A security operations center (SOC) team uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. They notice an alert about a user accessing a sensitive HR application from an unusual IP address at 3 AM. What does UEBA primarily use to detect this anomaly?

Accepted Answer

Historical behavior baselines and machine learning. UEBA builds a baseline of normal user behavior over time and uses machine learning to detect deviations. Option A is wrong because static rules do not adapt to user patterns. Option B is wrong because threat intelligence feeds are external. Option C is wrong because manual analyst input is not the primary mechanism.

Answer

Static rule-based thresholds defined by the SOC

Answer

Manual input from the SOC team

Answer

Threat intelligence feeds from Microsoft

SC-900 Practice Test 27 — 15 Questions

Exhibit

SC-900 Practice Test 27 — 15 Questions

Exhibit