SC-900 Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. The JSON snippet shows a rule designed to create an incident when a high-severity alert is generated. However, the rule is not triggering. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.. Automation rules in Microsoft Sentinel that are triggered on alert creation (i.e., when an alert is generated) are designed only to run playbooks (automated response actions), not to create incidents. Incident creation from alerts is handled automatically by Sentinel's built-in analytics rules or by the incident creation rule type, not by an automation rule triggered on alert creation. The JSON snippet shows a trigger type of 'Microsoft.SecurityInsights/AlertRule/Alert', which confirms the rule fires on alert creation, and the action attempts to create an incident, which is not supported for this trigger type.

Answer

The logicAppResourceId is missing a required parameter.

Answer

The action should be of type 'Microsoft.SecurityInsights/AlertRule/Alert' instead.

Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Incident'.

Question 2

A company uses Microsoft Entra ID. They want to ensure that users who are traveling to a high-risk country, based on the sign-in IP address, are prompted for multi-factor authentication before accessing the company's CRM application. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in signals—such as the user's location derived from the IP address—and enforce access controls like requiring multi-factor authentication (MFA) before granting access to a specific application (e.g., the CRM app). By configuring a Conditional Access policy with a location condition targeting high-risk countries, the company can ensure that only users signing in from those IP ranges are prompted for MFA, while other sign-ins proceed normally.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Azure AD Join

Question 3

An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?

Accepted Answer

Verify explicitly. The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.

Answer

Use least privilege access

Answer

Assume breach

Answer

Never trust, always verify

Question 4

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

Accepted Answer

Endpoint DLP with clipboard control. Endpoint DLP with clipboard control is the correct setting because it monitors and restricts data movement at the device level, specifically preventing users from copying sensitive content (like credit card numbers) from a web application and pasting it into an unauthorized personal cloud storage app. This policy enforces restrictions on clipboard operations between different applications on the endpoint, directly addressing the cross-application data exfiltration scenario described.

Answer

Browser DLP

Answer

Exchange DLP

Answer

Teams DLP

Question 5

A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is designed to detect and flag messages containing offensive language, harassment, or other policy violations in Microsoft Teams, Exchange Online, and Yammer. It uses customizable policies and machine learning classifiers to automatically review communications and route flagged items for human review, making it the correct solution for this requirement.

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Question 6

A security architect is implementing a Zero Trust security model. The architect insists that the network perimeter should not be trusted and that security controls must be applied to all traffic, even within the corporate network. They also emphasize the need for continuous monitoring and detection of threats as if a breach has already occurred. Which Zero Trust principle is the architect primarily applying?

Accepted Answer

Assume breach. The architect's emphasis on not trusting the network perimeter and applying security controls to all traffic, combined with continuous monitoring as if a breach has already occurred, directly aligns with the 'Assume breach' principle of Zero Trust. This principle operates on the mindset that a breach is inevitable or has already happened, thus requiring constant verification and monitoring of all network traffic, even within the corporate network, rather than relying on a trusted internal zone.

Answer

Verify explicitly

Answer

Least privilege access

Answer

Trust but verify

Question 7

Your company uses Microsoft Defender for Cloud to secure multicloud workloads. You need to ensure that regulatory compliance frameworks (e.g., SOC 2, ISO 27001) are continuously assessed and any drift is reported. What should you implement?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. Regulatory compliance standards in Defender for Cloud provide continuous assessment against frameworks. Option B is wrong because Microsoft Sentinel is for SIEM/SOAR, not compliance assessment. Option C is wrong because Azure Policy is used for policy enforcement, not assessment of compliance frameworks. Option D is wrong because Defender for Cloud Apps focuses on cloud app security.

Answer

Microsoft Sentinel analytics rules

Answer

Azure Policy initiatives

Answer

Microsoft Defender for Cloud Apps session policies

Question 8

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Highly Confidential' sensitivity label to emails containing a specific credit card pattern. Which solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically apply sensitivity labels to emails based on content inspection, such as detecting credit card patterns using built-in sensitive info types. DLP policies can be configured to classify and label messages in transit in Exchange Online, ensuring the 'Highly Confidential' label is applied before the email leaves the organization.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit

Question 9

An organization is redesigning its security architecture based on the Zero Trust model. Which principle requires that every access request must be fully authenticated, authorized, and encrypted before granting access, regardless of the network location?

Accepted Answer

Verify explicitly. The Zero Trust model is built on three core principles: verify explicitly, least privilege, and assume breach. The principle that mandates every access request—regardless of whether it originates from inside or outside the corporate network—must be fully authenticated, authorized, and encrypted before granting access is 'verify explicitly'. This means using strong authentication methods (e.g., multifactor authentication), continuous validation of authorization (e.g., Conditional Access policies), and enforcing encryption (e.g., TLS 1.3) for every request, not just those from untrusted locations.

Answer

Assume breach

Answer

Least privilege

Answer

Trust but verify

Question 10

A company hosts a mission-critical customer portal on Azure virtual machines. To ensure continuous availability, they deploy the application across two separate Azure regions. If one region experiences a failure, traffic is automatically routed to the other region with minimal disruption. Which security goal is primarily being addressed by this architecture?

Accepted Answer

Availability. Deploying a mission-critical application across two Azure regions with automatic traffic routing directly addresses the security goal of availability. This architecture ensures that if one region fails, the application remains accessible from the other region, minimizing downtime. Azure Traffic Manager or Azure Front Door can be used to route traffic based on priority or latency, providing high availability and disaster recovery.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 11

Which TWO scenarios are appropriate uses of Microsoft Purview Audit (Standard)?

Accepted Answer

Investigating a user who accessed a sensitive file in SharePoint.. Microsoft Purview Audit (Standard) logs key events such as file access and admin activities, and retains logs for 90 days. Option A is correct because accessing a sensitive file in SharePoint generates an audit event captured by Audit (Standard). Option B is correct because searching the audit log for admin activities within the 90-day retention period is a core capability of Audit (Standard).

Answer

Generating custom reports with PowerShell for all activities.

Answer

Tracking when sensitivity labels are applied to documents.

Answer

Retaining audit logs for 2 years for compliance purposes.

Question 12

A company wants to use Microsoft Defender for Cloud to secure their hybrid cloud environment. Which FOUR resource types can be assessed by Defender for Cloud?

Accepted Answer

Azure Virtual Machines. Microsoft Defender for Cloud can assess Azure Virtual Machines (native), AWS EC2 instances via multi-cloud connector, on-premises servers connected via Azure Arc, and Kubernetes clusters (Azure or multi-cloud) via Defender for Containers. On-premises SQL Server without Azure Arc is not directly assessed.

Answer

On-premises SQL Server

Question 13

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

Accepted Answer

Emails are preserved and not deleted despite the retention policy. When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Answer

Only emails created before the hold are deleted

Answer

Emails are deleted immediately to avoid conflicting policies

Answer

Emails are deleted after 3 years as per the retention policy

Question 14

A company needs to ensure that employees cannot share sensitive financial reports with external parties via email. They want to automatically detect and block emails that contain the phrase 'Confidential-Financial' in the subject line or body, regardless of the recipient's domain. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block sensitive content—such as the phrase 'Confidential-Financial'—in emails, regardless of the recipient's domain. DLP policies can inspect subject lines and body text, then enforce actions like blocking delivery or notifying the user, making it ideal for preventing unauthorized external sharing of financial reports.

Answer

Information Protection (sensitivity labels)

Answer

Data Lifecycle Management (retention policies)

Answer

Audit

Question 15

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

Accepted Answer

Improvement action. Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Answer

Assessment

Answer

Control

Answer

Template