SC-900 Practice Test 29 — 15 Questions

Question 1

Which TWO conditions can be used in a Microsoft Entra Conditional Access policy? (Choose two.)

Accepted Answer

Device platform. Device platform is a standard condition in Microsoft Entra Conditional Access policies, allowing administrators to target policies based on the operating system (e.g., Windows, iOS, Android). Option D is correct because User risk level is a condition derived from Microsoft Entra ID Protection, reflecting the probability that a user's identity has been compromised, and can be used to trigger step-up authentication or block access.

Answer

MFA registration status

Answer

Password complexity

Answer

Login frequency

Question 2

Which TWO of the following are capabilities of Microsoft Purview Data Loss Prevention?

Accepted Answer

Block sharing of sensitive data via email.. Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent the accidental or intentional sharing of sensitive information. Option C is correct because DLP policies can block the sharing of sensitive data via email by inspecting content in transit and applying actions such as blocking the message. Option E is correct because DLP can display policy tips to users in real time, warning them before they share sensitive data and allowing them to override the block with justification.

Answer

Define retention periods for documents.

Answer

Search for content in Exchange Online mailboxes.

Answer

Automatically apply sensitivity labels to content.

Question 3

A company uses Microsoft Entra ID. They have a critical application that requires additional security. The security team wants to enforce multifactor authentication (MFA) for every access to the application, but they also want users to reauthenticate with MFA if a session lasts longer than 60 minutes, regardless of device compliance. Which Conditional Access control should the administrator configure?

Accepted Answer

Session control: Sign-in frequency. The requirement to force reauthentication with MFA after a specific time period (60 minutes) is a session-level control, not a grant control. The 'Sign-in frequency' session control in Conditional Access allows administrators to define how often a user must reauthenticate, including re-prompting for MFA, regardless of device compliance. This directly meets the scenario's need for a time-based reauthentication policy.

Answer

Grant control: Require multifactor authentication

Answer

Session control: Application enforced restrictions

Answer

Grant control: Require device to be marked as compliant

Question 4

Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?

Accepted Answer

Azure Network Security Groups (NSGs). Azure Network Security Groups (NSGs) are the correct service for implementing microsegmentation because they allow you to create granular, stateful filtering rules based on source/destination IP addresses, ports, and protocols at the subnet or individual virtual machine (NIC) level. This enables east-west traffic segmentation between workloads within the same virtual network, which is a core principle of Zero Trust network architecture.

Answer

Azure Firewall

Answer

Azure App Service

Answer

Azure Front Door

Question 5

A company uses Microsoft Entra ID. A new IT support technician is hired and needs to be able to reset passwords for users but must not be allowed to delete user accounts or modify group memberships. Which built-in Microsoft Entra ID role should be assigned to this technician?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific permissions required to reset passwords for all users, including administrators, while explicitly excluding permissions to delete user accounts or modify group memberships. This role is designed for scenarios where a technician needs to perform password-related tasks without broader user management capabilities.

Answer

User Administrator

Answer

Helpdesk Administrator

Answer

Global Administrator

Question 6

You are reviewing a Microsoft Purview auto-labeling policy configuration. Based on the exhibit, what happens when a document contains a credit card number and is labeled 'Confidential'?

Accepted Answer

Access is blocked. The exhibit shows a Microsoft Purview auto-labeling policy configured to apply the 'Confidential' label when a credit card number is detected. The policy's action for this label is set to 'Block access,' meaning that when the condition is met, the document's access is blocked. Therefore, option D is correct because the policy explicitly blocks access to the document.

Answer

Access is allowed

Answer

Encryption is applied to the document

Answer

An administrator is notified

Question 7

An organization uses Microsoft Sentinel for security information and event management (SIEM) and security orchestration automated response (SOAR). They want to automatically respond to a specific incident by running a playbook. What should they configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running playbooks. When an incident is created or updated, an automation rule can trigger a playbook (a collection of automated workflows based on Azure Logic Apps) to perform actions such as blocking a user or isolating a machine, directly addressing the requirement to automatically respond to a specific incident.

Answer

Workbook

Answer

Hunting query

Answer

Analytics rule

Question 8

A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 9

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then trigger alerts for deviations, such as impossible travel, unusual data exfiltration, or risky sign-in patterns. This directly addresses the requirement to detect anomalous user behavior across cloud applications.

Answer

App connectors

Answer

Secure Score

Answer

Cloud Discovery

Question 10

Your organization uses Microsoft Purview to manage data sensitivity and compliance. Which TWO capabilities are provided by Microsoft Purview Information Protection?

Accepted Answer

Create and publish sensitivity labels that can be applied to documents and emails.. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Option D is correct because sensitivity labels are the core mechanism in MIP for applying protection actions (e.g., encryption, access restrictions) to documents and emails. Option E is correct because MIP includes automatic classification using built-in sensitive information types (e.g., credit card numbers) and trainable classifiers based on machine learning models.

Answer

Define retention labels to keep data for a specified period.

Answer

Detect and manage insider risk activities such as data theft by employees.

Answer

Enforce Data Loss Prevention (DLP) policies to prevent accidental sharing of sensitive data.

Question 11

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access with Named Locations. Conditional Access with Named Locations allows you to define geographic locations (e.g., countries) and then create a policy that blocks sign-ins from locations that are not approved for business operations. This is the correct feature because it directly enforces access controls based on the user's physical location at the time of authentication, using IP address ranges or country/region mapping.

Answer

Privileged Identity Management

Answer

Terms of Use

Answer

Identity Protection user risk policy

Question 12

Refer to the exhibit. You are creating a Microsoft Purview sensitivity label for HR data. The JSON shows a label configuration. What is the likely effect of setting the sensitivity value to 90?

Accepted Answer

The label will be applied with higher priority than labels with lower sensitivity values. In Microsoft Purview, sensitivity labels are assigned an integer priority value (typically 0 to 100). A higher sensitivity value indicates a higher priority. When multiple labels are available, the label with the highest sensitivity value is applied by default or takes precedence in auto-labeling and policy conflicts. Setting the value to 90 ensures this HR label is prioritized over labels with lower values, such as 75 or 50.

Answer

The label automatically encrypts the document

Answer

The label triggers auditing for 90 days

Answer

The label sets a 90-day retention period

Question 13

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel are designed to correlate and analyze data from multiple sources, such as AWS CloudTrail and Azure AD sign-in logs, to detect security threats. By creating a multi-source analytics rule, you can define conditions that trigger alerts when suspicious patterns emerge across these disparate log streams, enabling centralized threat detection.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting

Question 14

Which TWO are capabilities of Microsoft Intune? (Choose two.)

Accepted Answer

Mobile application management (MAM). Microsoft Intune is a cloud-based endpoint management solution that provides both Mobile Device Management (MDM) and Mobile Application Management (MAM). MDM allows administrators to enroll, configure, and secure devices (e.g., enforce PIN policies, wipe lost devices), while MAM enables management of applications and their data on both enrolled and unenrolled devices (e.g., restrict copy/paste between managed apps). These are the two core capabilities of Intune.

Answer

Identity protection

Answer

Security posture management

Answer

Data loss prevention

Question 15

A global company uses Microsoft Teams and SharePoint Online. They need to automatically detect and prevent sharing of intellectual property files containing 'Project X' with external users. What should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive. Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive can be configured to automatically detect files containing sensitive content (e.g., 'Project X') and block sharing with external users. DLP policies inspect content at rest and during sharing actions, applying rules to prevent unauthorized external access.

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Defender for Cloud Apps Session Policy