SC-900 Practice Test 28 — 15 Questions

Question 1

A security team is evaluating Microsoft security solutions to monitor user activities across multiple SaaS applications, including Salesforce and Dropbox, for signs of compromised accounts and data exfiltration. Which solution is specifically designed for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides deep visibility, data classification, and threat detection across SaaS applications like Salesforce and Dropbox. It uses behavioral analytics and anomaly detection to identify compromised accounts and data exfiltration by monitoring user activities and applying policies such as activity policies and app governance.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft 365 Defender

Question 2

A company assigns permissions to users based strictly on their job title (e.g., Sales Manager can edit documents, Sales User can only read). Which identity and access management concept is being implemented?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct concept because it assigns permissions to users based on their job title or role within the organization. In this scenario, the Sales Manager role is granted edit permissions, while the Sales User role is restricted to read-only, which is a direct implementation of RBAC where access rights are tied to roles rather than individual users.

Answer

Least privilege

Answer

Defense in depth

Answer

Zero Trust

Question 3

A security administrator is explaining the concept of defense in depth to a new team member. Which statement best describes this approach?

Accepted Answer

Layering multiple security controls across different areas of the IT environment. Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different areas of the IT environment (network, endpoint, application, data, and physical). This approach ensures that if one control fails, another is already in place to mitigate the threat, providing redundancy and reducing the risk of a single point of failure. Microsoft's security framework, including tools like Microsoft Defender for Cloud and Azure Firewall, operationalizes this concept by integrating protections at each layer.

Answer

Using a single, strong firewall to block all external traffic

Answer

Relying solely on encryption to protect all data at rest and in transit

Answer

Implementing only physical security measures to protect the data center

Question 4

A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?

Accepted Answer

Least privilege. The scenario describes granting employees only the permissions necessary to perform their job functions, which is the core definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required Azure RBAC roles or Microsoft Entra ID directory roles, ensuring users have no more access than needed. This directly reduces the attack surface and limits potential damage from compromised accounts.

Answer

Segregation of duties

Answer

Defense in depth

Answer

Zero Trust

Question 5

A company uses Microsoft Entra ID. They have a financial application that should only be accessible from Windows devices. The security team wants to create a Conditional Access policy to block access from other operating systems such as macOS or Linux. Which assignment condition should they configure?

Accepted Answer

Device platforms. The Device platforms condition in a Conditional Access policy allows administrators to target specific operating systems (e.g., Windows, iOS, Android, macOS) or block others. By configuring this condition to only include Windows devices, the policy will block access from macOS, Linux, or any other non-Windows platform. This directly addresses the security team's requirement to restrict the financial application to Windows devices only.

Answer

Locations

Answer

Client apps

Answer

Sign-in risk

Question 6

A healthcare company stores patient records in an Azure SQL database. To protect the data, they enable Transparent Data Encryption (TDE) for the database and require all client connections to use TLS. Which security goal is being primarily addressed by these measures?

Accepted Answer

Confidentiality. Transparent Data Encryption (TDE) encrypts data at rest in the Azure SQL database, ensuring that even if the physical storage media is compromised, the data remains unreadable. Requiring TLS for client connections encrypts data in transit, preventing eavesdropping or interception. Both measures directly protect the confidentiality of patient records by preventing unauthorized access to the data.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 7

A security team needs to collect and analyze security logs from a hybrid environment consisting of on-premises Windows servers, Azure virtual machines, and AWS workloads. They want to correlate events, detect anomalous behavior, and create custom security alerts with automated response playbooks. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct solution because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution designed to ingest logs from hybrid and multi-cloud environments, including on-premises Windows servers, Azure VMs, and AWS workloads. It provides advanced correlation of events across these sources, built-in anomaly detection using machine learning, and the ability to create custom security alerts and automated response playbooks via Azure Logic Apps. This directly matches the requirement for collecting, analyzing, correlating, detecting anomalies, and automating responses.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 8

A company implements a policy where each employee is granted only the permissions necessary to perform their specific job role. For example, a marketing specialist has read-only access to the customer database and cannot modify financial records. Which security principle is primarily being applied?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions. In this scenario, the marketing specialist receives read-only access to the customer database and no access to financial records, which directly aligns with limiting permissions to the minimum required. This reduces the attack surface and limits potential damage from accidental or malicious actions.

Answer

Defense in depth

Answer

Zero Trust

Answer

Separation of duties

Question 9

A security team wants to discover all cloud applications being used by employees, including unsanctioned file sharing and collaboration apps. They plan to analyze traffic logs from their network firewall to identify usage patterns and assess each app's risk level. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs from network firewalls and proxies to identify all cloud applications in use, including unsanctioned ones. It uses the Microsoft Defender for Cloud Apps catalog to assess each app's risk level based on factors like security posture, compliance certifications, and industry standards. This directly matches the scenario of discovering unsanctioned file sharing and collaboration apps from firewall logs.

Answer

App Connectors

Answer

Conditional Access App Control

Answer

Information Protection

Question 10

A consulting firm is involved in a legal investigation. They need to preserve all emails and documents from two specific employees (custodians) related to a contract dispute. The data must be collected and stored in a secure location for legal review without modifying the original data. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing you to identify, preserve, collect, and analyze data from custodians (e.g., employees) without altering the original data. It places a legal hold on mailboxes and sites, ensuring that emails and documents related to the contract dispute are stored in a secure review location for legal review, meeting the requirement of non-modification.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Communication Compliance

Question 11

A user logs into a company's application using their username and password. After logging in, the application checks whether the user belongs to the 'Admin' role before granting access to the user management page. Which security concept is primarily illustrated by the role check?

Accepted Answer

Authorization. The role check after login determines what actions the authenticated user is allowed to perform, specifically whether they can access the user management page. This is the essence of authorization, which controls access to resources based on identity and assigned permissions. In Microsoft identity and access management, authorization is enforced via role-based access control (RBAC), where the application verifies the user's role claim (e.g., 'Admin') in the access token.

Answer

Authentication

Answer

Accounting

Answer

Non-repudiation

Question 12

A company implements a security strategy that includes multiple layers of controls: a perimeter firewall, an intrusion detection system, endpoint antivirus software, and multi-factor authentication for user access. The goal is that if one layer fails, another layer is in place to prevent or mitigate an attack. Which security principle does this approach best represent?

Accepted Answer

Defense in depth. Defense in depth is a security strategy that layers independent defensive mechanisms so that if one layer fails, another layer is already in place to prevent or mitigate an attack. The scenario explicitly describes multiple layers (firewall, IDS, endpoint antivirus, MFA) working together, which is the core definition of defense in depth. This approach ensures no single point of failure can compromise the entire security posture.

Answer

Zero Trust

Answer

Least privilege

Answer

CIA triad

Question 13

A company uses Microsoft Entra ID. The security team wants to automatically detect user behaviors that indicate possible compromise, such as leaked credentials, impossible travel, or anomalous login patterns. When a user is determined to be at high risk, the system should automatically require the user to reset their password the next time they sign in. Which Microsoft Entra capability should they use?

Accepted Answer

Identity Protection. Identity Protection is the correct Microsoft Entra capability because it is specifically designed to automatically detect risky user behaviors such as leaked credentials, impossible travel, and anomalous sign-in patterns. It assigns a risk level to users and sign-ins, and can be configured with a Conditional Access policy to enforce actions like requiring a password reset at next sign-in when a user is deemed high risk. This directly matches the security team's requirement for automated detection and remediation.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Question 14

A company wants to gain visibility into the cloud applications that employees are using (e.g., unsanctioned SaaS apps), assess the risk level of each app based on multiple factors, and block access to high-risk applications. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud application usage, assesses risk based on factors like compliance, app store ratings, and security controls, and can block access to high-risk apps via reverse proxy or API integration. This directly matches the requirement to discover unsanctioned SaaS apps and enforce access controls.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 15

A company uses Microsoft 365 and needs to comply with a regulatory requirement to retain all customer contracts for 5 years after the contract's end date, after which they must be automatically deleted. Additionally, the legal department needs the ability to preserve all documents related to an ongoing lawsuit, overriding any deletion timelines. Which Microsoft Purview solution should the company use?

Accepted Answer

Data Lifecycle Management with retention labels and eDiscovery holds. Data Lifecycle Management (DLM) with retention labels allows the company to apply a retention label to customer contracts that retains them for 5 years after the contract end date and then automatically deletes them. eDiscovery holds can be placed on all documents related to an ongoing lawsuit, which overrides any deletion timelines, ensuring that content is preserved until the hold is released. This combination directly meets both the regulatory retention and legal preservation requirements.

Answer

Information Barriers

Answer

Communication Compliance

Answer

Audit (Premium)