SC-900 Practice Test 28 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud to secure its hybrid cloud workload. The security team needs to ensure that all virtual machines (VMs) have Just-In-Time (JIT) VM access enabled. What should they use to enforce this across subscriptions?

Accepted Answer

Assign an Azure Policy initiative that requires JIT VM access. Option B is correct because Azure Policy can enforce JIT VM access via a built-in initiative. Option A is wrong because Secure Score recommendations are advisory, not enforcement. Option C is wrong because Defender for Cloud plans enable features but don't enforce configuration. Option D is wrong because Azure Blueprints are deprecated.

Answer

Use Azure Blueprints to deploy JIT access configuration

Answer

Enable the Defender for Cloud servers plan

Answer

Implement a Secure Score recommendation for JIT access

Question 2

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

Accepted Answer

Decode the Base64 string using a built-in decoder or online tool. Option A is correct because the command is Base64 encoded (the string after -EncodedCommand). Decoding it reveals a download cradle. Option B is wrong because the command is not encrypted. Option C is wrong because there is no script block to log. Option D is wrong because the hash is for identification, not decoding.

Answer

Search for the SHA256 hash in threat intelligence feeds

Answer

Decrypt the command using the device's decryption keys

Answer

Use PowerShell script block logging to capture the decoded command

Question 3

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

Accepted Answer

An automation rule. Option C is correct because automation rules in Microsoft Sentinel can trigger playbooks (Logic Apps) for incident response. Option A is wrong because analytics rules create incidents, not automated responses. Option B is wrong because workbooks are for visualization. Option D is wrong because watchlists are for threat intelligence.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 4

A company wants to protect against malware and phishing attacks in email and collaboration tools like Microsoft Teams. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Option B is correct because Microsoft Defender for Office 365 protects against threats in email and collaboration tools. Option A is wrong because Defender for Endpoint focuses on devices. Option C is wrong because Defender for Cloud Apps is a CASB. Option D is wrong because Defender for Identity protects on-premises Active Directory.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 5

Which THREE components are part of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Office 365. Options A, B, and C are correct. Defender XDR includes Defender for Office 365, Defender for Endpoint, and Defender for Identity. Option D is wrong because Sentinel is a separate product. Option E is wrong because Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 6

Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?

Accepted Answer

A sensitivity label with auto-labeling for sensitive information types. Sensitivity labels with auto-labeling can detect sensitive data and apply encryption automatically. Option B is incorrect because retention labels are for retention, not protection. Option C is incorrect because DLP policies block or warn, not label. Option D is incorrect because trainable classifiers are for data classification, not automatic labeling.

Answer

A trainable classifier for credit card numbers

Answer

A retention label for credit card information

Answer

A data loss prevention (DLP) policy

Question 7

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. You need to ensure that when a user clicks a malicious link in an email, the user is warned and the action is blocked. Which policy should you configure?

Accepted Answer

Safe Links policy. Option B is correct because Safe Links in Defender for Office 365 provides real-time time-of-click protection against malicious links. Option A is wrong because Safe Attachments scans attachments, not links. Option C is wrong because anti-phishing policies protect against spoofing and impersonation but do not block links at click time. Option D is wrong because anti-spam policies filter spam, not malicious links.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 8

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

Accepted Answer

The user's last sign-in dates. Option C is correct because the command uses Get-MgUser with the SignInActivity property to retrieve last sign-in times. Option A is wrong because it does not show group memberships. Option B is wrong because it shows sign-in times, not licenses. Option D is wrong because it shows the user's details, not license assignments.

Answer

The user's license assignments

Answer

The user's assigned roles

Answer

The user's group memberships

Question 9

Refer to the exhibit. A Microsoft Purview DLP policy is configured. When a user attempts to share a document containing a credit card number externally, what will happen?

Accepted Answer

The sharing attempt is blocked and the user receives a notification.. The rule has both 'BlockAccess' and 'NotifyUser' actions, so the sharing will be blocked and the user will be notified. Option A is wrong because only notifying without blocking is not configured. Option B is wrong because the policy does not include encryption. Option D is wrong because the policy is active and will block.

Answer

The document is shared but the user is notified.

Answer

The document is encrypted before sharing.

Answer

The policy has no effect because no severity level is set.

Question 10

Your company uses Microsoft Purview Information Protection to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a custom footer is added. Which two components should you configure?

Accepted Answer

Sensitivity label with auto-classification for credit card numbers. Option A is correct because a sensitive info type label can auto-classify credit card numbers. Option B is correct because an auto-labeling policy applies the protection and footer. Option C is wrong because DLP policies block or warn but do not encrypt. Option D is wrong because retention policies manage lifecycle, not encryption.

Answer

Data Loss Prevention (DLP) policy for credit card numbers

Answer

Retention label and policy for credit card data

Question 11

Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies for Teams. Options A and D are correct because DLP policies and sensitivity labels protect data. Option B is wrong because retention policies manage lifecycle, not sharing. Option C is wrong because audit logs only record events. Option E is wrong because eDiscovery is for legal discovery.

Answer

Audit log search for Teams

Answer

eDiscovery for Teams

Answer

Retention policies for Teams messages

Question 12

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

Accepted Answer

File entities. Option D is correct because the query filters where EntityType == 'File'. Option A is wrong because it filters for File, not Process. Option B is wrong because it filters for File, not Network. Option C is wrong because it filters for File, not Registry.

Answer

Registry entities

Answer

Process entities

Answer

Network entities

Question 13

Your organization uses Microsoft Intune to manage mobile devices. You need to ensure that devices with a jailbroken or rooted OS cannot access corporate resources. What should you configure?

Accepted Answer

A device compliance policy in Microsoft Intune. Option A is correct because a compliance policy in Intune can detect jailbroken devices and mark them as noncompliant. Option B is wrong because a configuration policy sets settings, not compliance. Option C is wrong because an app protection policy manages app data, not device state. Option D is wrong because a conditional access policy in Entra ID uses compliance results but does not detect jailbreak.

Answer

An app protection policy in Microsoft Intune

Answer

A device configuration policy in Microsoft Intune

Answer

A conditional access policy in Microsoft Entra ID

Question 14

An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?

Accepted Answer

A DLP policy with a rule that detects credit card numbers and blocks sharing. Option A is correct because DLP policies can detect and block sensitive data like credit card numbers in email and Teams. Option B is wrong because sensitivity labels apply metadata but don't block sharing. Option C is wrong because retention labels manage retention. Option D is wrong because audit policies log activity but don't block.

Answer

A retention label to retain credit card data

Answer

An audit policy to log credit card sharing

Answer

A sensitivity label that marks credit card data

Question 15

An organization uses Microsoft Sentinel for SIEM. The security operations center (SOC) wants to automatically create an incident when a user account is compromised and suspicious activity is detected. Which Microsoft Sentinel feature should be used?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel can be configured to create incidents based on detection logic. Option A is incorrect because playbooks are for automated responses, not incident creation. Option B is incorrect because workbooks are for visualization. Option D is incorrect because watchlists are for threat intelligence.

Answer

Watchlists

Answer

Automation playbooks

Answer

Workbooks