SC-900 Practice Test 29 — 15 Questions

Question 1

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

Accepted Answer

A Conditional Access policy. Option D is correct because Conditional Access policies in Microsoft Entra ID can integrate with Intune compliance policies to block non-compliant devices. Option A is wrong because compliance policies define the compliance criteria but do not block access by themselves. Option B is wrong because configuration policies manage settings, not access control. Option C is wrong because app protection policies manage data in apps, not device-level access.

Answer

An app protection policy

Answer

A compliance policy

Answer

A configuration policy

Question 2

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies use machine learning to detect unusual user behavior based on historical baselines, such as mass file downloads. Activity policies are rule-based but require explicit thresholds; however, the scenario describes behavior that is best detected by an anomaly detection policy because it adapts to typical usage patterns. Option A is wrong because session policies control real-time access. Option C is wrong because OAuth app policies govern app permissions. Option D is wrong because file policies apply to specific files or metadata.

Answer

Session policy

Answer

OAuth app policy

Answer

File policy

Question 3

Which THREE of the following are features of Microsoft Purview Insider Risk Management?

Accepted Answer

Detection of repeated security policy violations by a user. Insider Risk Management includes detecting data leaks, detecting security policy violations, and providing forensic evidence. Vulnerability scanning (D) is not part of Insider Risk Management; it's part of Defender for Cloud. Phishing simulation (E) is part of Attack Simulation Training.

Answer

Phishing simulation campaigns

Answer

Vulnerability scanning of network endpoints

Question 4

Your organization uses Microsoft Entra ID and wants to provide a single sign-on (SSO) experience for a third-party SaaS application that supports SAML 2.0. The app must also enforce multifactor authentication (MFA) for external users. What should you configure?

Accepted Answer

Set up SAML-based federation in Microsoft Entra ID and assign a Conditional Access policy requiring MFA. Option B is correct because SAML-based federation provides SSO and can be combined with Conditional Access for MFA. Option A is wrong because OAuth 2.0 is for delegated access, not SAML SSO. Option C is wrong because password-based SSO does not support SAML. Option D is wrong because Linked Sign-On uses existing IdP, not federation.

Answer

Add the app as a Linked Sign-On application

Answer

Use password-based SSO in Microsoft Entra ID

Answer

Configure OAuth 2.0 authorization in Microsoft Entra ID

Question 5

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

Accepted Answer

Email & collaboration in Microsoft Defender XDR. Option C is correct because Email & collaboration in Microsoft Defender XDR provides detailed analysis of email threats. Option A is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security, not email. Option B is wrong because Microsoft Defender for Identity focuses on identity threats. Option D is wrong because Microsoft Defender for Endpoint focuses on endpoint threats.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 6

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to assess compliance with the CIS benchmark. What should you enable?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. Option A is correct because regulatory compliance standards in Defender for Cloud include CIS benchmarks. Option B is wrong because Azure Firewall is a network security service, not compliance assessment. Option C is wrong because Microsoft Sentinel is a SIEM. Option D is wrong because Azure Policy is used for compliance but within Defender for Cloud you enable regulatory compliance standards.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Firewall

Question 7

An organization uses Microsoft Sentinel for security information and event management (SIEM) and security orchestration automated response (SOAR). They want to automatically respond to a specific incident by running a playbook. What should they configure?

Accepted Answer

Automation rule. Option D is correct because automation rules in Sentinel trigger playbooks based on incidents. Option A is wrong because analytics rules generate alerts, not responses. Option B is wrong because workbooks visualize data. Option C is wrong because hunting queries proactively search for threats.

Answer

Workbook

Answer

Hunting query

Answer

Analytics rule

Question 8

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

Accepted Answer

Create an automation rule that triggers a playbook for high-severity ransomware incidents. Option D is correct because an automation rule can trigger a playbook for high-severity incidents. Option A is wrong because analytics rules generate alerts, not automate responses. Option B is wrong because hunting queries are proactive. Option C is wrong because workbooks visualize data.

Answer

Create an analytics rule for ransomware

Answer

Create a hunting query for ransomware

Answer

Create a workbook to display ransomware alerts

Question 9

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. The security team wants to automatically block the use of a newly discovered high-risk cloud app across all users. What is the most efficient approach?

Accepted Answer

Create an app discovery policy with governance action to unsanction the app.. Defender for Cloud Apps can generate a governance action to block the app via the API. Option A is incorrect because manual blocking is not automatic. Option C is incorrect because Conditional Access policies block at the identity level, not app level. Option D is incorrect because session controls are for monitoring, not blocking.

Answer

Create a Conditional Access policy to block the app for all users.

Answer

Manually add the app to the blocked list in the cloud discovery settings.

Answer

Configure session controls to monitor app usage.

Question 10

Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?

Accepted Answer

Cloud Security Posture Management (CSPM). Option A is correct because Microsoft Defender for Cloud's security posture management (CSPM) continuously assesses resources against security benchmarks and identifies misconfigurations. Option B is wrong because workload protections focus on threats, not configuration. Option C is wrong because the security score provides a score but not specific misconfigurations. Option D is wrong because regulatory compliance checks against standards, not general misconfigurations.

Answer

Cloud Workload Protection (CWP)

Answer

Regulatory compliance dashboard

Answer

Security score

Question 11

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email outside the company. Which type of DLP rule action should they configure?

Accepted Answer

Block. The 'Block' action prevents the email from being sent and can optionally notify the user and admin. Option A is wrong because 'Audit only' logs the event but does not block. Option C is wrong because 'Encrypt' is a separate action but not the primary block mechanism. Option D is wrong because 'Notify' only sends an alert without blocking.

Answer

Notify

Answer

Audit only

Answer

Encrypt

Question 12

Which TWO of the following are included in Microsoft Entra ID Protection?

Accepted Answer

Risk-based Conditional Access policies. Entra ID Protection includes risk-based conditional access and risk detections like sign-in risk. Privileged Identity Management (B) is a separate feature but related, and is included in Entra ID P2. Passwordless authentication (C) is a feature of Entra ID, not specifically Protection. DLP (D) is Purview. Identity Governance (E) is Entra ID Governance.

Answer

Data loss prevention (DLP)

Answer

Privileged Identity Management (PIM)

Answer

Passwordless authentication support

Question 13

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

Accepted Answer

Search in Advanced Hunting for the file's SHA256 hash across all devices. Option D is correct because the file SHA256 allows querying threat intelligence and hunting for the file across devices. Option A is wrong because the alert is already triggered. Option B is wrong because the device is already identified. Option C is wrong because the user action is already captured.

Answer

Isolate the device DESKTOP-01 immediately

Answer

Trigger the automated investigation for this alert

Answer

Review the user jdoe's recent activities

Question 14

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

Accepted Answer

Data Loss Prevention (DLP) policies. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies can be extended to cover Copilot interactions. Option A is wrong because Sensitivity labels are for classification, but DLP is the enforcement mechanism. Option C is wrong because eDiscovery is for search and export, not prevention. Option D is wrong because Customer Lockbox is for access control, not data loss prevention.

Answer

Customer Lockbox

Answer

Sensitivity labels

Answer

eDiscovery

Question 15

A user reports that they cannot access a sensitive document in SharePoint Online. The document has a 'Highly Confidential' sensitivity label. You verify the label is applied correctly. What is the most likely reason for the access issue?

Accepted Answer

The label's encryption settings restrict access to specific users. Option C is correct because sensitivity labels can have encryption and rights management that restrict access. Option A is wrong because the label is applied correctly, not missing. Option B is wrong because retention policies do not block access. Option D is wrong because DLP policies block sharing, not access by authorized users.

Answer

The sensitivity label is missing

Answer

A DLP policy is blocking access

Answer

A retention policy is blocking access