SC-900 Practice Test 3 — 10 Questions

Question 1

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Accepted Answer

Identify anomalous user activities such as mass file downloads. Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Answer

Review communications for policy violations

Answer

Conduct eDiscovery searches for legal cases

Answer

Block sharing of sensitive data via email

Question 2

A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?

Accepted Answer

Scheduled query rules. Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.

Answer

Hunting rules

Answer

Machine learning rules

Question 3

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 4

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Accepted Answer

Enforce company policies on communication channels. Microsoft Purview Communication Compliance allows organizations to enforce company policies on communication channels such as email, Microsoft Teams, and third-party platforms. It does this by scanning communications for policy violations (e.g., insider trading, harassment) and enabling designated reviewers to take remediation actions like escalating or archiving messages.

Answer

Automatically apply sensitivity labels to documents

Answer

Prevent sharing of credit card numbers via email

Answer

Place legal holds on user mailboxes

Question 5

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behaviors, such as a spike in file downloads within a short time window. This policy uses machine learning to establish a baseline of normal activity and triggers alerts when deviations like downloading more than 10 files from SharePoint Online in 5 minutes occur, making it the correct choice for this use case.

Answer

Session policy

Answer

OAuth app policy

Answer

File policy

Question 6

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 7

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. It combines a Conditional Access policy that requires a compliant device (enforced by Intune) with an Intune app protection policy (MAM) that prevents copying corporate data to unmanaged apps. This meets both requirements. Option A is incorrect because Windows Autopilot is for provisioning, not compliance enforcement. Option B is incorrect because MFA and Windows Hello for Business do not control device compliance or data leakage. Option C is incorrect because requiring an approved client app alone does not enforce device compliance, and Azure AD Application Proxy is for remote access to on-premises apps, not data protection.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 8

An organization wants to enable passwordless authentication for its users by using a mobile app. Which Microsoft Entra ID authentication method should they implement?

Accepted Answer

Microsoft Authenticator (passwordless sign-in). Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate via app notification. FIDO2 security keys are hardware tokens. Windows Hello for Business uses biometrics. Temporary Access Pass is for initial setup.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Question 9

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because data loss prevention policies use classification but are not the classification mechanism itself. Option B is wrong because sensitivity labels are used for applying protection based on classification, not for classification itself. Option D is wrong because retention labels are for data retention policies.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 10

A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?

Accepted Answer

A conditional access policy is blocking access based on the user's location. Although the user is a member of the Finance group and has the required sensitivity label permission, the conditional access policy blocks access based on the user's location (country). Conditional access policies can override label permissions. Option A is incorrect because the user does have the required label permission. Option B is incorrect because no licensing issue is indicated; Microsoft 365 E5 is not required for sensitivity labels. Option D is incorrect because the document does have a sensitivity label applied.

Answer

The user does not have the required sensitivity label permission

Answer

The user does not have a Microsoft 365 E5 license

Answer

The document does not have a sensitivity label applied